Data protection About

Data protection

London Metropolitan University has to collect and process large quantities of information, much of it personal, and some of it sensitive data. It is crucial that such data, whether in electronic or hard copy format, is managed effectively, securely and in accordance with the United Kingdom General Data Protection Regulation (UK GDPR), as amended by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.

The UK GDPR gives you a right of access (subject to certain exemptions) to the data which organisations hold about you and specifies how that data can be gathered, used and disseminated. London Metropolitan University is required by law to conform to the principles of the UK GDPR. The University’s Data Protection Policy (see below) sets out the way in which we seek to comply with the requirements of the legislation.

The Data Protection Policy is binding on all staff, so staff should familiarise themselves with the policy:

• Data Protection Policy

The University also provides data protection guidance for staff and privacy notices for staff and students about how we handle their data:

• Privacy Statement for University job applicants
• Student Privacy Notice

Requests for information about individual students

Sometimes a third party may request information about a student or wish to discuss a student with us (not to be confused with Exceptional Disclosures, see below). These requests may come from parents or other representatives of the student. Consent should be obtained from the student before proceeding to share information with others. The form below may be used for this purpose:

Data Protection - consent to third party

Exceptional disclosures

If a third party requests information about a student and it would not be appropriate for the student to be aware of the request, for example, if the request is part of a police or other government agency enquiry in compliance with the Data Protection Act 2018, then the enquirer should be directed to the University's Information Compliance Manager.

Complaints Procedure

If you think the university has not followed data protection law in the way it has handled your personal data you can make a complaint. The process for dealing with complaints is set out in our Data Protection Complaints Procedure.

Complaints can be made via the online Complaint Form.