Purpose of Guidance                    

This guidance examines some of the key data protection issues relevant to students’ unions. In particular it looks at how students’ personal data can be shared between universities and students’ unions in compliance with the General Data Protection Regulation (GDPR). It is divided into the following sections: 

                   
  •                         
  •                             

      Brief overview of data protection law; 

                            
  •                        
  •                             

      Frequently asked questions on data sharing between universities and students’ unions; and 

                            
  •                        
  •                             

      Sample letter to universities explaining how personal data may be shared with students’ unions without breaching data protection law. 

                               

    This guidance has been developed by NUS and Bates Wells Braithwaite for use by students’ unions. It has been updated to reflect the planned replacement of the Data Protection Act 1998 (DPA) by the GDPR in the UK (from 25 May 2018). At the time of publication of this guidance [March 2017] the EU law on which the Privacy and Electronic Communications Regulations (PECR) are based is also under review, such that students’ unions should be aware that the law in this area is also expected to change. This law impacts, among other things, on the sending of direct marketing by email and text. 

                               

    Note that the GDPR is not yet in force such that students’ unions should continue to comply with the DPA until 25 May 2018. However, students’ unions should be aware of their responsibilities under the GDPR and take steps to prepare for its coming into force. 

                               

    The information in this guidance is necessarily of a general nature. It is believed to be correct at the time of publication. This guidance was prepared prior to the GDPR coming into force, and should be read in light of future guidance produced by the ICO to accompany the GDPR, and other legal developments. The guidance is not intended to be exhaustive or to provide legal advice in relation to any particular situations. It is important to remember that the circumstances of students’ unions vary from one union to the next, and specific advice should be sought for specific situations. 

                            
  •