Education – student contact
Students and personal data processing
A large proportion of the University’s staff have daily contact with students. Study administrators, directors of studies and lecturers are not the only staff members who communicate with students; other roles and functions also often come into contact with students. Depending on the context and purpose of the processing of personal data, in certain cases you need to inform the data subject about the processing. Regardless of the purpose of the processing, you always need a legal basis. A crucial factor for how you should proceed is whether the processing involves a student, a prospective student or an alumnus/a.
Student, prospective student or alumnus/a?
The term student can mean different things depending on the context in which it is used: for employees working with marketing and recruitment of new students, the word student implies a prospective student; for a study administrator, a student means a person registered in LADOK; for staff working with former students, the term refers to alumni. Read more below on how to proceed depending on which category of students the personal data processing concerns.
In connection with the start of their studies, the students are registered in LADOK and receive standardised information from the University about how and for what purpose their personal data will be processed during their studies. Thus you do not need to inform students again when the purpose of the processing of the students’ personal data falls within the framework of their education. Personal data within education is processed in the following situations:
- Study administration LADOK, LUVIT, Live@Lund
- Teaching and examination
- Study and careers guidance
Exceptions when the student needs to be informed about the processing of their personal data
There are circumstances in which the purpose of the processing of personal data is not related to the student’s education. In such cases, you need to provide the student with particular information on each new occasion their personal data is to be processed. Examples of circumstances in which the personal data processing is not considered related to education:
- When the student needs learning support
- When the student applies for a library card
- In recruitment of student staff
- In recruitment of volunteer ambassadors or mentors
- When the student contacts the Student Health Centre
Prospective students and alumni
Do you work with marketing, recruitment of prospective students, or registers of people interested in studying at Lund University? If so, you are processing the personal data of prospective students. Do you work with networks and meetings for former students? If so, you are processing the alumni’s personal data. To process the personal data of both these categories, you need to inform the data subjects about the processing.
Which legal basis am I to use?
For all processing of personal data, a legal basis is required. One of the legal bases is consent, which is required for example for marketing. Read more about the legal basis and consent on the following pages:
What information do I need to provide?
Pursuant to Articles 13 and 14 of the GDPR, you have an obligation to inform the data subject about a number of points.
Read more about the information you need to provide on the Information for data subjects page.
Support and tools
dataskyddsombud [at] lu [dot] se
- Personal data controller – the organisation responsible for processing your personal data. In all but a few cases, Lund University is always the personal data controller.
- Data subject – the person whose personal data you collect and/or process.
- Data protection officer – the role and function responsible for Lund University’s compliance with the GDPR.
- The EU’s General Data Protection Regulation (GDPR) - The Swedish translation of GDPR is “Dataskyddsförordningen”.
- Data Protection Act – the Swedish national complement to the EU’s GDPR.