Student Privacy Statement - Admissions

This statement explains how the Academic Registry of Aberystwyth University handles and uses your personal information (i.e. any information which relates to or identifies you as an individual) during the admissions and enrolment processes.  Further information on the Academic Registry can be found at:

Aberystwyth University is the data controller and is committed to protecting the rights of students in line with the UK Data Protection Act 1998 (DPA), the new General Data Protection Regulation (GDPR) and any related legislation.  Aberystwyth University has a Data Protection & Copyright Manager who can be contacted at or 01970 628593.  The University has a range of data protection policies and procedures in place which can be found here:

What personal information do we collect about you?

The Academic Registry will collect information about from at the point of application to study here, when you register as a student, whilst you progress through your course, or after you have ended your studies or graduated with a qualification from Aberystwyth University. We may also receive information about you from outside the University, such as information from UCAS relating to your application, as well as information supplied by referees.  The type of personal information processed by the Academic Registry includes, though is not limited to, the following:

  • Name, date of birth, contact details and other information submitted during the application, verification and registration processes;
  • Details of your course, modules, assessment marks and qualifications.
  • Details of any formal outcomes following on from any University processes and procedures, e.g. academic appeals, disciplinary procedures, formal complaints, etc.
  • Contact details for next of kin to be used in an emergency.

What is the purpose of the processing of any personal information and how will your information be used?

The Academic Registry (Admissions) will process your personal information for a range of practical and administrative purposes which are all required as part of the application, assessment and admissions process for your subsequent registration as a student.  AU is also required to declare the legal basis upon which this data is processed and this is also indicated below.  Although it is not possible to state every purpose for which your information will be used, the following are examples of how it is likely to be used, by the Academic Registry, while you are a student.

  • Aberystwyth University is required to collect, store and process information about you for any purposes connected with your application and enrolment, e.g. for any reasons which are deemed necessary for the performance of your contractual agreement with the University (Article 6(1)(b) of the GDPR).
  • To communicate effectively with you by post, e-mail and telephone, and others in the event of an emergency. Aberystwyth University is required to collect, store and process information about you for any purposes connected with your application and enrolment, e.g. for any reasons which are deemed necessary for the performance of your application(s) to the University (Article 6(1)(b) of the GDPR).
  • To carry out investigations in accordance with academic regulations, complaint and quality assurance processes and arrangements. Aberystwyth University is required to collect, store and process information about you for any purposes connected with your studies, e.g. teaching, support, research, administration, and for any other reasons which are deemed necessary for the performance of your contractual agreement with the University (Article 6(1)(b) of the GDPR).
  • To compile statistics and conduct research for internal and statutory reporting purposes (e.g. HESA). Aberystwyth University is required to process your personal data where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the University (Articles 6(1)(e) and 89).
  • It is a statutory requirement for the University to send some of the information we hold about you to HESA every year (“your HESA information”). HESA is the official source of data about UK universities and higher education colleges  HESA collects, and is responsible for, the database in which your HESA information is stored. HESA is a registered charity and operates on a not-for-profit basis.  HESA uses your HESA information itself for its own purposes.  HESA also shares your HESA information with third parties for specified and lawful purposes.  It may charge other organisations to whom it provides services and data.  HESA's use of your HESA information may include linking information from it to other data, as described in the HESA statement linked to below.  All uses of HESA information must comply with the Data Protection Act 1998 and the General Data Protection Regulation.
  • If you give us information about your disability status, ethnicity, sexual orientation, gender reassignment or religion these may be included in your HESA information and used to assist with monitoring equality of opportunity and eliminating unlawful discrimination in accordance with the Equality Act 2010. Some other sensitive information is used to enable research into the provision of fair access to higher education, for example information as to whether you are a care leaver.  Your sensitive personal data/special category data will not be used to make decisions about you
  • In some instances the University may transfer students’ personal data to third parties located in other countries, including some outside of the European Economic Area. Any such transfers will be strictly in relation to the delivery of the University’s core services, including to partner institutions abroad.  IT services used by the University may involve the transfer or hosting of student personal data overseas.  Personal data may be shared with international agents that the University uses for the delivery of services to overseas students.  All instances of overseas transfers of personal data are subject to appropriate technical safeguards and contractual provisions incorporating appropriate assurances to ensure the security of the data and full compliance with legislative and regulatory requirements.

Who will we share your personal information with?

Your personal information is created, stored and transmitted securely in a variety of paper and electronic formats, with access to this information being limited to AU staff and contracted parties who have a legitimate interest in it for the purpose of carrying out their contractual duties.

Where necessary, personal information will be shared internally within Institutes and with other departments across the University. Personal information is protected by the University and, other than those circumstances listed below, information will not be disclosed to third parties without consent. Listed below are the types of organisations and circumstances where your personal information may normally be disclosed by the Academic Registry.

  • Higher Education Statistics Agency (HESA) – Aberystwyth University is required to send some of the information which we collect about students to HESA for statistical analysis purposes and to conduct the Graduate Outcomes survey.
  • Sponsors and parents where consent has been provided.
  • Educational advisors and institutional partners. Please be aware that if you use an Educational Advisor to help you with your application, Aberystwyth University will share the following personal data with them: your name, course, course fee, your registration status and the value of any scholarships you have been awarded. This is to allow us to process Educational Advisors’ commission claims for student recruitment. Your details will be stored securely for six years (in case of a legally required financial audit) and will then be destroyed.
  • Franchise partnerships and teaching partnerships in order to deliver courses.
  • Higher Education Institutions where you may be spending a period of time, for example, as an exchange student, or a year abroad as part of your degree scheme.
  • UCAS (e.g. the UCAS Verification team).
  • Professional bodies (e.g. the, Law Society) in order to confirm your qualifications and accredit your course.
  • Work placement sites or educational partners involved in joint course provision.
  • The Student Loan Company to confirm enrolment, attendance and identity in order that students can access financial support.
  • Non-UK loan agencies (e.g. US Federal Department of Education (in conjunction with Western Union), Canadian loan federal and provincial loan bodies, private lenders) to confirm enrolment, attendance and identity in order that students can access financial support.
  • Debt recovery and control companies in order to recover debt on behalf of the University, where internal debt recovery procedures have been unsuccessful.
  • Potential employers or providers of education whom you have approached
  • UK agencies with duties relating to prevention and detection of crime, collection of a tax or duty or safeguarding national security.
  • UK Visas and Immigration with regard to their requirements for applicants and students who are visa nationals.
  • Plagiarism detection service providers in accordance with agreed contracts.
  • Doctoral Training Partnerships, where Aberystwyth University is one of the partner universities within the UK, regarding information on the relevant postgraduate applicants and students.
  • UK Research Councils (via the Je-S system) regarding information on UKRC funded postgraduate applicants and students.
  • Internal and external auditors (e.g. QAA, UKVI, KPMG, Deloitte, …)
  • Local Authorities for purposes of council tax exemption where it is necessary for the pursuit of the legitimate interests of the Local Authorities or the student but only where the processing does not fall within our core public function, is not unwarranted and will not cause a prejudicial effect on the rights and freedoms, or legitimate interests, of the student.
  • Local Authorities for voting purposes: under a specific data sharing agreement, the University shares basic personal details with the County Electoral Services Office in order for them to contact you regarding self-registration. The University does not register students itself.

Any other disclosures that the University makes will be in accordance with GDPR legislation and, in each case, your interests will be carefully considered. 

Where it may be necessary to process other information, which AQRO (Admissions) may be required to collect for legitimate purposes, you will normally be given further details about our use of any such data when we collect it from you. Any processing will be proportionate and relate to the provision of services by the University.  When this data is used for monitoring and reporting purposes it will be anonymised if possible.

How long will your information be held?

In the event that your place at the University is not confirmed, your application record will not be held longer than the 2-year retention period.

Should your place be confirmed (i.e. if you register or fail to register) Aberystwyth University will retain your personal information in line with the University Records Management Policy, its Records Retention Schedule and also the model retention schedule published by the Joint Information Systems Committee (JISC). As noted above, a core record of your attendance will be retained indefinitely.

Further information can be found at:

Security of your information

GDPR legislation requires the University to keep your information secure, both in paper form and electronic format.  Your confidentiality will be respected, and all appropriate steps taken to prevent unauthorised access and disclosure. Only members of staff who need access to certain aspects of your information will be given the authority to do so.

How can I access my personal information?

You have the right to access your personal information that is held about you by the University.  Further details are available at:

What do you have to do?

It is very important that you keep your personal details up-to-date, and can do so by visiting your on-line student record at:  

What are your rights?

As a data subject, you have certain rights over the data which we hold about you, depending on the basis on which we collect and process it. 

More details can be found here: and also on the Information Commissioner’s website:

If you have provided information on the basis of consent, you have the right to withdraw that consent. You also have the right to ask us to correct any inaccurate personal information we hold about you (ie. any information you are not able to correct through your on-line student record), to delete personal information, or otherwise restrict our processing, or to object to processing or to receive an electronic copy of the personal information you provided to us.

Please visit the University Data Protection Website for further information in relation to your rights. You can also contact the University Data Protection and Copyright Manager at: