Personal data and data protection in education and when in contact with students

Students and personal data processing

A large proportion of the University’s staff have daily contact with students. Study administrators, directors of studies and lecturers are not the only staff members who communicate with students. Other roles and functions also often come into contact with students. Depending on the context and purpose of the processing of personal data, in certain cases you need to inform the data subject about the processing. Regardless of the purpose of the processing, you always need a legal basis. A crucial factor for how you should proceed is whether the processing involves a student, a prospective student or an alumnus/a.

Student, prospective student or alumnus/a?

The term student can mean different things depending on the context in which it is used. For employees working with marketing and recruitment of new students, the word student implies a prospective student. For a study administrator, a student means a person registered in LADOK. For staff working with former students, the term refers to alumni. Read more below on how to proceed depending on which category of students the personal data processing concerns.

Enrolled students

In connection with the start of their studies, the students are registered in LADOK and receive standardised information from the University about how and for what purpose their personal data will be processed during their studies. Thus you do not need to inform students again when the purpose of the processing of the students’ personal data falls within the framework of their education. Personal data within education is processed in the following situations: 

• Admission
• Study administration LADOK, LUVIT, Live@Lund
• Teaching and examination
• Study and careers guidance
• Degrees

Exceptions when the student needs to be informed about the processing of their personal data

There are circumstances in which the purpose of the processing of personal data is not related to the student’s education. In such cases, you need to provide the student with particular information on each new occasion their personal data is to be processed. Examples of circumstances in which the personal data processing is not considered related to education:

• When the student needs learning support
• When the student applies for a library card
• In recruitment of student staff
• In recruitment of volunteer ambassadors or mentors
• When the student contacts the Student Health Centre

Prospective students and alumni

Do you work with marketing, recruitment of prospective students, or registers of people interested in studying at Lund University? If so, you are processing the personal data of prospective students. Do you work with networks and meetings for former students? If so, you are processing the alumni’s personal data. To process the personal data of both these categories, you need to inform the data subjects about the processing.

Which legal basis should you use?

For all processing of personal data, a legal basis is required. One of the legal bases is consent, which is required for example for marketing. Read more about legal basis generally and also more specifically of the legal basis consent by clicking on the following links below:

• Legal basis (link opens in the same window)
• Consent (link opens in the same window)

What information do you need to provide?

Pursuant to Articles 13 and 14 of the GDPR, you have an obligation to inform the data subject about a number of points.

Read more about the information you need to provide on the Information for data subjects page.

Support and tools

For support and tools, click on one of the links below:

• Information for data subjects (link opens in the same window)
• FAQs (link opens in the same window)