Privacy Notice for Student Conduct Case Management
The University of Glasgow will be what is known as the 'Data Controller' of your personal data processed in relation to managing student conduct cases. This privacy notice explains how The University of Glasgow will process your personal data.
1. Your personal data and why we need it
We collect your basic personal data such as: name of reporting individual, contact email/phone, name of responding student (about whom the case is being raised), date/time of incident and a preliminary account of the matter and, where relevant, limited special categories data (such as disability, ethnicity, other health data) in order to review, investigate, and make decisions regarding alleged breaches of the Code of Student Conduct. This may include information about students, staff, and members of the public, obtained either directly from the data subject or indirectly from others, which will be used in accordance with the processes and procedures set out in the Code of Student Conduct.
We will only collect data that we need, to provide and oversee this service to you.
2. Legal basis for processing your data
2.1 We must have a legal basis for processing all personal data. In this instance, the legal basis is:
Article 6 (1)(b) of the UK GDPR EU regulation: processing is necessary for the performance of a contract to which the data subject is party.
All students of the University must sign the Student Contract at the point of annual registration. This is the contract between the University and each student, which states that if a student does not act in accordance with the contract, the University may take disciplinary action under its Code of Student Conduct.
2.2 The University recognises that processing potential breaches of the Code of Student Conduct may involve highly sensitive and personal data. As a result, the University may have to process 'Special Category' data about students, staff, and members of the public or data on criminal charges and convictions. The University must have a legal basis for processing this data. The legal basis is:
Article 9 (2)(g) of the UK GDPR EU regulation: processing is necessary for reasons of substantial public interest, on the basis of the Data Protection Act 2018, Schedule 1, part 2, paras 10 (preventing, investigating or detecting unlawful acts), 12 (involvement in dishonesty, malpractice or other seriously improper conduct), and 18 (safeguarding of children and of individuals at risk).
3. What we do with it and who we share it with
All personal data you submit is processed by staff at the University of Glasgow in the United Kingdom. All information handled under this privacy notice will be stored securely in University of Glasgow records systems and treated in line with the University of Glasgow's Data Protection Policy. All staff involved in the handling and processing of sensitive personal data or Special Category data have a duty of confidentiality in relation to the content and processing of this data.
The University may share information provided by students, staff, and members of the public as described below.
3.1 Information may be shared with people involved in the conduct case as follows:
- the student under investigation ("Responding Student"), for transparency and fairness of process under the principles of natural justice;
- people who have reported alleged misconduct ("Reporting Individual"). As much information regarding the status and outcome of an investigation as is reasonably possible will be shared with a Reporting Individual[1];
- Investigating Officers, Senate Assessors, the Student Conduct Team, the Head of Student Conduct, members of the Senate Student Non-Academic Conduct Committee and of the Senate Student Academic Conduct Committee (including any appeals committees);
- other staff involved in the process of handling and advising on student conduct cases, providing student support services, or for the implementation of any precautionary suspension or penalty applied under the Code of Student Conduct;
- relevant staff, in emergency or crisis situations, in order to facilitate the provision of pastoral care/duty of care responsibilities, in line with the University Student Privacy Notice.
3.2 In relation to Responding Students on professional programmes with ‘Fitness to Practice' requirements, a case may be shared with the relevant Fitness to Practice committee for action or advice.
3.3 When relevant evidence is provided in a language other than English, we may use staff who are native speakers of that language or an approved University supplier as third-party translator to translate the material into English.
3.4 The University may report to the Police any allegation that a criminal offence has been committed for the purpose of prevention and detection of crime; the apprehension and prosecution of offenders; or, exceptionally, to safeguard a person's wellbeing where appropriate. Each instance will be judged on its own merit and any sharing of information will be done within the law.
3.5 The University may also receive reports that a student has a relevant criminal conviction or relevant charge from a third party or agency, for example Police Scotland. Information about criminal charges or convictions will be reviewed to determine whether to take action under the Code of Student Conduct.
3.6 The University may share information regarding investigations with our insurers to enable us to make insurance claims and engage with solicitors, where appropriate.
3.7 The University may share information regarding investigations with solicitors appointed on its behalf for the exercising or defence of legal claims.
3.8 For overseas, non-UK / EU students only, the University may share investigation, criminal offence and convictions data with the internal Immigration Compliance Team, who may share this information with UK Visas and Immigration in order to comply with our obligations as a student visa sponsor/license holder under immigration legislation.
3.9 The University may also share information with the Scottish Public Services Ombudsman if required.
3.10 Details of conduct decisions, including sanctions, will be circulated to relevant University or Student Union, Students’ Representative Council (SRC), or Glasgow University Sports Association (GUSA) officers on a need-to-know basis to implement the decisions.
3.11 It may be necessary to share limited information, on a need-to-know-basis, in cases where a conduct matter which occurred whilst the student was at the University of Glasgow, comes to light subsequently when the student or students are studying or undertaking research as part of their UofG degree with external institutions or organisations.
4. How long do we keep it for
Information gathered in relation to proceedings under the Code of Student Conduct will normally be retained for 6 years after the end of the student relationship with the University, and subsequently destroyed. The University may retain information longer where a case might be relevant to an ongoing relationship between the individual and the University. In cases where a student is permanently excluded under the Code, the University holds all case records in perpetuity.
5. What are your rights?[2]
You can request access to the information we process about you at any time. If at any point you believe that the information we process relating to you is incorrect, you can request to see this information and may in some instances request to have it restricted, corrected or, erased. You may also have the right to object to the processing of data and the right to data portability.
Reporting individuals can request that their statement is deleted and the case closed. The closed case will be included in statistical reports. However, the University may decide to continue to investigate and deal with any issues raised, for example if there is reason to believe there are safeguarding concerns for other students.
If you wish to exercise any of these rights, please submit your request to dp@glasgow.ac.uk
6. Complaints
If you wish to raise a complaint on how we have handled your personal data, you can contact the University Data Protection Officer who will investigate the matter.
Our Data Protection Officer can be contacted at dataprotectionofficer@glasgow.ac.uk
If you are not satisfied with our response or believe we are not processing your personal data in accordance with the law, you can contact the Information Commissioner's Office (ICO) https://ico.org.uk/
Updated September 2026
[1] In determining what information to provide to the Reporting Individual, the University will take account of the need to balance the interests of the Responding Student, the Reporting Individual, and any witnesses, and the University's obligations under relevant data protection, or other, legislation.
[2] Please note that the ability to exercise these rights will vary and depend on the legal basis on which the processing is being carried out.