Corporate Governance

datasubjectpicData Protection for Data Subjects

Much of the information on this page relates to all data subjects.  Where there is specific information just for UoP students, or just for UoP staff, this is clearly highlighted.

What personal data do we process and why?

Personal data may be kept in both paper and electronic formats but it is kept securely in all cases, either in locked cabinets or avvess controlled in the case of  electronic records.

Students only...

The University needs to process (that is, collect, use, store and ultimately destroy) personal information about you as a student to be able to record your application to the University, your progress through your course, to classify your final award(s) and to maintain contact as an alumni of the University.

The University is also obliged in some cases to collect information in line with legal requirements, for instance the University has to provide details of your attendance to the Higher Education Funding Council for England (HEFCE).

The personal data the University collects from you at registration includes:

  • Your name
  • Contact details (address, e-mail, telephone numbers)
  • Emergency contact details
  • Date of birth
  • Country of nationality and of birth
  • Academic qualifications
  • Details of any disability
  • Details of any criminal convictions
  • Fee information and sponsorship details

During your time at University we will also process your assessment marks and background information about the units you choose.

You will be asked by the University to check the data it holds about you and, if necessary, to update that data, each time you register with the University, but you are also encouraged to update your details if they change via your Myport account.

For the full data protection statement relating to student information please see the annual Data Protection Statement.


Staff only...

The University needs to process personal information about you as a staff member in order to carry out the administration necessary for your wages, pension, annual
leave, job applications etc.

The personal data the University collects from you when you apply for a position and subsequently when you start work includes:

  • Your name,
  • Contact details,
  • Emergency contact details,
  • Date of birth,
  • Country of nationality and birth,
  • Academic qualifications,
  • Previous employment details,
  • Details of any disability,
  • Details of any criminal convictions,
  • Contact details for referees.

You will be asked by the University to check the data it holds about you and, if necessary, to update that data, every two years but you are also encouraged to update your details if they change via your account on the staff portal.

For the full data protection statement relating to staff information please see the annual Data Protection Statement.

Special category data 

Some of the personal data the University processes is defined as "special category data" under the GDPR. This information must be treated even more carefully in terms of whether, and why, it needs to be collected and who can have access to it, than the rest of the data processed by the University. Examples of special category data are available on the general data protection pages and the University may hold several sets of special category data about you (e.g. details of your country of nationality and birth and details of your physical and mental health). This data is requested for specific purposes and will not be used for any other purposes. Nor will special category data be released to a third party without your explicit consent unless it is necessary to protect the vital interests of you or another person.

Equal Opportunities Monitoring

Some of the special category data collected from you is used for equal opportunities monitoring. The data is used to prepare statistics for internal use e.g. the Board of Governors receives an annual report on equal opportunity matters, and for external agencies, generally the Office for Students (OfS). The University is legally obliged to make these statistics publicly available, which it will do by publishing the statistics on its website.

All statistics are anonymised but, should the numbers being reported be small enough to potentially identify an individual, the figures will not be publicly reported.

Use of Your Personal Data

If you have any further queries about how your data is to be used, please contact the University's Information Disclosure Manager by email at

Students only...

Your personal data is collected at registration to enable the University to register you as a student with this institution and for the administration of your education, associated financial matters and use of the University's facilities.

The University uses the anti-plagiarism software from Turnitin®. The software works by comparing your assessment against others logged with the service.

You may be required to submit your assessments to your tutors electronically, along with an electronic cover sheet recording your name, e-mail address, course details and the University's name. This information will be loaded onto the Turnitin® software where it will be stored and compared against work submitted by all the other HE institutions using the service, as well as that submitted by any other departments of this University. Your tutor will receive a report from the service which will identify any similarities between your work and the rest of the assessments stored by the service.

Your uploaded assessment and personal data will be retained by Turnitin® all the time the University continues to use the service. If the University chooses to withdraw from using the service, it then has the right to request the removal of any and all data relating to students from this University.

Further details on how the software works are available from your Department/School.


Staff only...

Your personal data is collected on application for a post, when you take up that post and subsequently through your time at the University, for the administration of
your employment.

It is not possible to know and state every purpose for which your data will be used, but it will only ever be used in relation to University business.

Disclosure of Your Personal Data

The University will not give out your personal details to any third party except where you give written consent for the disclosure or when the University is under a legal requirement to provide information.

For example, the University has to send coded and anonymised data on students and staff to the Higher Education Statistics Agency (HESA). This forms your HESA record and contains coded information including ethnicity and disability status. Your record can then be passed on to other bodies with statutory functions in relation to the funding of education. For a full list of these bodies and more information on the uses HESA makes of this information, please visit the HESA website.

The University could also be asked to disclose information if required by the police or other agencies investigating a criminal offence.

Additional info for students only...

The University also needs, at times, to give data to government education departments, the Quality Assurance Agency, funding councils and representatives of these bodies such as auditors.

Data will be released to Student Finance England and, if necessary, Local Education Authorities in relation to financial matters associated with your education, and if necessary to parties involved in the recovery of debts to the University. The University will also disclose the personal details of students enrolled on full-time courses whilst living in the PO1 - PO5 postcodes to Portsmouth City Council for Council Tax purposes.
The University will disclose details about you if it is important to your vital interests e.g. if you are in need of emergency treatment and the University is asked to verify whether you have any medical conditions it would be necessary to know about.

Beyond these instances, the University will not disclose information about you to a third party without your written consent, given to the University either directly or through the third party requesting the data. This means that we will not release your personal data to employment agencies, banks, friends, relatives or sponsors without your consent. If friends or relatives need to contact you, University staff will happily try to pass on a message to you that your friend/relative is trying to contact you but will not give out your contact details.

The University will only supply references where you have already asked a member of staff to provide a reference, or where the request is accompanied by a consent form signed by you, showing that you have consented to a reference being requested. Under the GDPR, the University is exempt from disclosing the contents of a confidential reference that it has provided, but must provide a copy of any reference that it receives. Requests for copies of references received by the University should be made using the Subject Access Request form.

Your Rights as a Data Subject

The rights you have under the GDPR are set out in the earlier section on data subject rights. If you wish to exercise any of these rights, please contact the Information Disclosure Manager, on 023 9284 3642 or

How long will the University keep your personal data?

For full details of the University's record retention, please refer to the University Retention Schedule.

Students only...

The University will keep your full student record - as described above in What do we process? - for six years after the end of the academic year in which you graduate from, or otherwise leave, the University. After six years, the University will retain only the data necessary to identify you and to confirm the dates you studied at the University, the degree and classification you were awarded and a transcript of your marks.

All other personal data on your student record will be disposed of in a secure manner. The University, and several individual departments / schools within the University, operate alumni societies but personal data collected for this purpose is held separately from your student record.


Staff only...

The University will retain your staff record for 6 years after the termination of your employment with the University. After this date only those details necessary to identify you and to show that you worked at the University, in which positions and for how long, will be kept.

Your responsibilities as a data subject

  1. We need you to tell us if any of your details change - particularly your contact details - so that we can keep your records up to date.
  2. Don't give your student number, staff username or computer passwords to anyone else, so there can be no chance of the number, username or password being abused.
  3. Finally, if you are involved in any research work at the University or any other position where you might come into contact with other people's personal data, please remember to treat that information in confidence, in line with the data protection principles, not to pass it on to anyone else and not to access any data that you do not need to complete your work.

    Students only...

    You should also inform your tutor that you will be processing personal data, so that your tutor can ensure the right procedures are followed.