Data Protection

All staff, and students who process personal data, are under a general duty to comply with the Data Protection Act 1998. Individuals can face criminal charges under certain conditions if, without consent, they knowingly or recklessly, obtain or disclose personal data.

Members of staff and students who are processing personal data on behalf of the University must ensure that they comply with the University’s Data Protection Policy (PDF - 181KB)

Information the University holds about me

Any person who believes that the University is holding Personal Information about them, can apply to the University, for a copy of it.

A request must be made in writing and be accompanied by a cheque made payable to The University of Birmingham for the sum of £10.00. The request must give details of the information which is sought and an indication of where the information might be found eg department or school. If the applicant is a current member of staff or student their identity lnumbers will assist in retrieving this information.

The request for information should be addressed to:
Information Compliance Manager
Legal Services
University of Birmingham
B15 2TT

It must be noted that information relating to another person may be withheld. 

External requests for information about individuals

The University collects a wide range of personal data relating to staff and students for its own purposes, and to meet external obligations. This may result in the eventual transfer of personal data to an outside third party, however any such transfers must be permitted under the Act.

Transfers will only be permitted where data subjects have given their consent to the transfer, or where the Act expressly allows transfers without such consent. Consent cannot be inferred from silence, so if the University requests consent so that the University can provide personal data to a third party, and no response is received, the University must infer that consent is withheld.

Personal data must not be disclosed to unauthorised third parties. Unauthorised third parties includes another individual or organisation, family members, friends, local authorities, government bodies, and the police where the individual has not consented to the transfer unless disclosure is exempted by the 1998 Act, or by other legislation. There is no general legal requirement to disclose information to the police.

However data can sometimes be disclosed without consent, where, for example, it is required for:

  • Protecting the vital interests of the data subject (i.e. release of medical data in emergency), or
  • The prevention or detection of crime

NB. The police should only request information on a specified form. Please check with the Information Compliance Manager whether data can be released.

Talking to parents

Staff at the University of Birmingham are not allowed to discuss a student's welfare or progress with a parent unless they have received explicit permission from the student in order to do this. This consent should be in writing either a letter or an email, from a recognised student email account.


The University of Birmingham is not allowed to discuss a student's welfare or progress with a sponsor unless the University has received explicit permission from the student in order to do this.

It should be noted that this consent is often written into the contract between the student and the sponsor.


Explicit consent is required from a student or member of staff before the University is permitted to discuss their financial situation.

Consent can either take the form of written consent or an email from a recognised email address.


If the police contact you asking whether an individual is either a student or member of staff, they should be directed to Legal Services.
This applies whether the individual is connected to the University of Birmingham or not.

All enquiries should be directed to Legal Services.


For issues regarding day-to-day compliance with the Act:

Legal Services  on: 0121 414 3916