Enrolment Privacy Notice

Enrolment Privacy Notice

Privacy Notice (How we use student information)

We, Greater Brighton Metropolitan College (the College), collect personal information about yourself in order for you to enrol as a student and to allow you to use College systems and services. 

Primarily, your personal data may be used for: -

  • Administrative services, such as course registration, examination, and certification.
  • The provision of student support services and other student guidance.
  • Statistical, funding and research purposes, relating to education, training, employment and well-being.

When we do collect your personal data, we are regulated under the General Data Protection Regulation (GDPR) which applies across the European Union (including in the United Kingdom) and we are responsible as ‘controller’ of that personal information for the purposes of those laws.

This privacy notice was last updated on 31 August 2020.

The categories of student information that we collect, hold and share include:

  • Identity and Contact Data: personal information (such as name, date of birth, next of kin details, unique learner number, national insurance number, home address, email address and telephone number).
  • Characteristics Data: gender, ethnicity, nationality, country of birth, country of domicile).
  • Disabilities Data: Disclosed and assessed learning difficulties / disabilities.
  • Historical Data: Prior attainment levels and the details of previous educational institutions attended.
  • Employment Data: Current employment status
  • Criminal Data: Criminal convictions and offences.
  • Attendance Data: Attendance information (such as sessions attended, number of absences and absence reasons)
  • Study Data: Study programme details.
  • Assessment Data: grades awarded, modules completed, qualifications completed.
  • Image Data: Photographic images or video footage (only where we have obtained explicit consent), CCTV footage.
  • Destination Data: destination and progression records (such as name of institution/organisation that a student attends upon leaving the College).

Why we collect and use this information

We use your personal data:

  • to support student learning and achievement
  • to track, monitor and report on student progress
  • to provide appropriate pastoral care
  • to ensure the health, safety and wellbeing of students
  • to assess the quality of our services
  • to meet statutory funding arrangements
  • to comply with the law regarding data sharing

The lawful basis on which we use this information

We will process your personal data for one or more of the following lawful grounds:

  • Where we need to perform the contract we are about to enter into or have entered into with you.
  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
  • Where it is in your vital interest in order to keep you safe – for example, CCTV footage.
  • Where we need to comply with a legal or regulatory obligation.
  • Where we need to in order to protect your health and well-being or the health and well-being of someone else – for example, other students.
  • Where we rely on your consent – for example, where you agree we can send you information about our other courses.

We call the above grounds Fundamental Grounds in the rest of this section.

When we process certain types of data called “special categories of personal data”(which may include, for example, Characteristics Data, Disabilities Data, Historical Data, Attendance Data and Assessment Data), we will process these special categories of personal data on one or more of the Fundamental Grounds together with one or more of the following lawful grounds;

  • Where we have obtained your explicit consent;
  • Where we need to assess your capacity to study.
  • Where we need to collect these types of information for statistical purposes.
  • Where we need to in order to protect your health and well-being or the health and well-being of someone else – for example, other students – and you cannot give your consent, or we cannot be expected to obtain your consent, or where you have unreasonably withdrawn your consent.
  • Where we need to collect and use information about your race or ethnicity to identify or keeping under review the existence or absence of equality of opportunity or treatment between persons of different racial or ethnic origins, with a view to enabling such equality to be promoted or maintained, and, where we do so. we will put in place appropriate safeguards for your rights and freedoms.

When we process Criminal Data, we will process this data for one or more of the Fundamental Grounds and because we are authorised to do so under the laws of the United Kingdom or because we are doing it under the control of an official authority.

Please contact us if you need details about the specific legal ground we are relying on to process your personal data.

Collecting student information

Whilst the majority of student information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain student information to us or if you have a choice in this.

Storing student data

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

For European Union (EU) funded projects, we are required to keep records until 31st December 2025.

Who we share student information with

We routinely share student information with:

  • educational institutions that the student attends after leaving the College
  • educational institutions that the student has attended before joining the College
  • local authorities
  • the Department for Education (DfE)
  • the Education and Skills Funding (ESFA)
  • the Office for Students (OfS)
  • the Learner Records Service (LRS)
  • the National Careers Service
  • any other Government Agency where we are required to share your data
  • those organisations awarding the qualifications that we offer
  • parents / carers / guardians
  • employers that sponsor a student on a course of study
  • Agencies who are required to audit our student and financial records
  • Agencies who support the collection of unpaid / outstanding course fees

We will not share your personal information with any other third party.

Why we share student information

We do not share information about our students with anyone without consent unless the law and our policies allow us to do so.

We have found that academic success is closely linked to the involvement and support of parents, guardians and carers. For this reason, the College has a policy of sharing information in respect of academic progress and attendance with parents, carers and guardians of students below 18 years of age. For students aged below 18 at the start of their programme, but who turn 18 during the academic year, we will continue to share information with parents, carers and guardians for the duration of the academic year. For those aged 18 or over at the start of an academic year, information will only be shared where prior consent has been obtained. Likewise, we also have a policy of sharing the same information with employers that sponsor a student on a programme of study.

We share student data with the DfE, ESFA, OfS and other Government agencies, or partners of those organisations, on a statutory basis. This data sharing underpins college funding and educational attainment policy and monitoring.

Data collection requirements:

To understand what learner personal data is collected by the DfE, through the ESFA, and how it is handled, go to:


To find out more about the statutory data collection requirements placed on us by DfE and its agencies, go to:


Youth support services

Students aged 16+:

We will also share certain information about students aged 16+ with our local authority and / or provider of youth support services as they have responsibilities in relation to the education or training of 13-19 year olds under section 507B of the Education Act 1996.

This enables them to provide services as follows:

  • post-16 education and training providers
  • youth support services
  • careers advisers

For more information about services for young people, please visit your local authority website.

The National Pupil Database (NPD)

The NPD is owned and managed by the Department for Education and contains information about pupils and students in schools and colleges in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools and colleges, local authorities and awarding bodies.

We are required by law, to provide information about our students to the DfE as part of statutory data collections such as the Individualised Learner Record (ILR). Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013.

To find out more about the NPD, go to https://www.gov.uk/government/publications/national-pupil-database-user-guide-and-supporting-information.

The department may share information about our students from the NPD with third parties who promote the education or well-being of children in England by:

  • conducting research or analysis
  • producing statistics
  • providing information, advice or guidance

The Department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:

  • who is requesting the data
  • the purpose for which it is required
  • the level and sensitivity of data requested: and
  • the arrangements in place to store and handle the data

To be granted access to pupil and student information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

For more information about the department’s data sharing process, please visit: https://www.gov.uk/data-protection-how-we-collect-and-share-research-data

For information about which organisations the department has provided student information, (and for which project), please visit the following website: https://www.gov.uk/government/publications/national-pupil-database-requests-received

To contact DfE: https://www.gov.uk/contact-dfe

Requesting access to your personal data

Under data protection legislation, students and/or, if the student is under 18, parents, have the right to request access to student information that we hold. To make a request for your personal information, or be given access to your child’s educational record, contact SHAUN.MALLIN@GBMC.ac.uk

You also have the right to:

  • object to processing of personal data that is likely to cause, or is causing, damage or distress
  • prevent processing for the purpose of direct marketing
  • object to decisions being taken by automated means
  • in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
  • claim compensation for damages caused by a breach of the Data Protection regulations

If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/ or telephone: 0303 123 1113.


If you would like to discuss anything in this privacy notice, or if you would like this notice in another format, for example, audio, large print or braille, please contact: SHAUN.MALLIN@GBMC.ac.uk

Greater Brighton Metropolitan College
31 August 2020