Click here to start your application. Apply now

Academic Handbook Data Protection

Privacy Notice for Applicants, Students and Alumni


  1. This privacy notice applies to registered students, learners, former students, alumni and applicants in any of the educational programs or services at Northeastern University London (the University). It explains how the University processes your personal data. This notice does not form part of any contract.
  2. The University may update its Privacy Notices at any time; please check back here regularly to review any changes.
  3. The University holds a range of personal data about you. Most of this data is supplied directly by the applicant or student, and some of which is received from third parties.
  4. Here are some examples of types of personal data the University holds:
    1. personal details such as name and title
    2. your contact details such as address, telephone number, email address
    3. country of nationality and domicile
    4. prior educational experience and attainment (with the University or with other schools)
    5. immigration information (such as passport details and language proficiency)
    6. health information (including any disabilities), information required to make reasonable adjustments 
    7.  equalities monitoring data, such as gender, religion, ethnicity, or sexual orientation that you provide to us
    8. materials submitted in support of your application, including essays, transcripts, references, or other supporting data
    9. financial information concerning the funding of your chosen course or program
  5. In addition, if you come to study at the University, data stored and processed by the University will likely include:
    1. academic performance including grades, tests or quizzes, essays, or other materials submitted as part of a course
    2. attendance and progression in a course or program
    3. if relevant, breaches of the University’s policies or applicable law, to include data about the investigation, adjudication, and resolution of any disciplinary proceeding or alleged violation of law. 
    4. financial aid, invoicing, banking and payment information
    5. information concerning any alleged or actual academic misconduct or your conduct generally 
    6. appearance, voice and distinguishing features through filming video and photograph
    7. emergency contact or next of kin information that you provide
    8. references on your academic performance
  6. The University may also collect, store and use information about your health, ethnicity or religion for the purposes of statutory reporting it is legally required to undertake in the European Economic Area, United Kingdom or United States (as well other jurisdictions which may be relevant).
  7. The University processes personal data of alumni and former students once they leave the University for the purpose of tracking employment and educational outcomes, as well as providing networking or additional educational opportunities to this community. Information relating to alumni and former students will also be used for the purpose of charitable solicitation and other development activities.

How Does the University Use This Information and Why?

  1. When you are an applicant, the University processes your personal data with the purpose of assessing your eligibility to be offered a place on an academic programme.
  2. If you accept a place on a programme and/or register as a student at the University, the University processes your personal data for the purposes of providing its academic programmes and its related services, including identifying any support you may need or request. 
  3. In general, this applies to personal data you provide to the University to process your application and, if enrolled, to monitor academic performance. Without that information, the University would be unable to provide you with your chosen academic programme and its related services.
  4. Some personal data is also required to fulfil the University’s legal obligations regarding immigration. For example, a failure to provide certain information would interfere with your application for a UKVI Student Route or Tier 4 visa.
  5. Some personal data is also required to fulfil the University’s legal obligations regarding reporting to regulatory bodies. A failure to provide that information could interfere with your application for student finance, or the University’s designation as a registered body.
  6. The University only processes data for specified purposes and when is justified in accordance with data protection law. The table below shows examples of personal data the University processes and the justification for doing so.
 Purpose Legal Basis and Justification
Assessing eligibility to undertake one of the University’s educational programmes Processing is necessary for the purposes of preparing to enter into a contract with the University
Provision of educational programmes and related services (including IT and library services)  Processing is necessary for performing a contract to provide your chosen educational programme. This may be a contract between you and the University or a contract between you and your sending institution. This is called contractual necessity
Assessment of academic progress and performance (including attendance) Contractual necessity
Administration of complaints, grievances and appeals related to allegations of violations of law or policy Contractual necessity
Immigration matters Necessary for the University to comply with its legal obligations concerning students or applicants who hold a Student Route or Tier 4 visa. 
Making reasonable adjustments for disabilities and providing relevant support to students or applicants with ill health Consent
Regulating the University’s community (including dealing with misconduct under the University’s procedures for academic and other misconduct) Contractual necessity and the University’s legitimate interest in maintaining academic and behavioural standards
Obtaining payment of fees Contractual necessity and the University’s legitimate interest in securing payment for the services it provides
Protecting the University’s property and assets and for providing for the health and safety of participants  Necessary for the University’s legitimate interest in safeguarding its people, property, and assets
Providing relevant IT and other facilities, for example, a virtual learning environment, as well as the development of new IT systems Contractual necessity and the University’s legitimate interest in providing a proper facilities to support the provision of educational programmes and related student services
Communicating with applicants and students Contractual necessity
Assisting applicants and students to obtain residential accommodation/housing Consent
Careers and LAUNCH Contact details, programme details and progression information where relevant to enable the opportunities offered to students by Careers and LAUNCH
Alumni relations Necessary for the University’s legitimate interests for marketing, fundraising and maintaining an alumni network
Audits or inspections carried out by internal or external audit professionals  Necessary for the University’s legitimate interests in maintaining internal controls, and/or preventing, detecting and investigating fraud
To provide references on request Contractual necessity or where consent has been given
For use in the University’s marketing materials and media to promote the University and its teaching, research and reputation The University’s legitimate interest to process your personal data for the purposes of marketing and promotion. If an individual’s personally identifying information is used then consent will be obtained
  1. There may be other processing in addition to the above, for example, when you access the University’s website which uses cookies, or when the University takes photos or video of our events and publishes them. This is done on the basis of our other policies, and the University will inform you about such processing at the time when the data is obtained. 
  2. Where the basis of processing your personal data is a contractual necessity, and you don’t provide the University with the personal data needed, the University may not be able to process your application or provide you with the programme for which you have applied. 
  3. A failure to provide immigration-related data may result in failure to obtain a Student Route or Tier 4 visa for those students who require it.

What Information Does the University Get From Third Parties?

  1. Sometimes the University receives your data from third parties. The following table lists what information the University may receive from them.
Data the University May Receive Source
Application data, which includes contact details, academic attainment, work experience, previous institution, contextual data and disability information UCAS
Your immigration status Home Office (UKVI), Foreign and Commonwealth Office
Transcripts (full details of educational programmes undertaken at another institution, and your attainment in these) Another institution and/or secondary schools
Medical, accessibility related and similar information, occupational health medical clearing (we only obtain this information from third parties if you give us consent to do so) Another institution, medical practitioners and/or family members
Your financial status Student Loans Company and/or family members
Details of any University associated complaint Officer of the Independent Adjudicator
Details of performance in other educational institutions or in relevant jobs Referees you have identified
Information relating to criminal convictions Disclosure and Barring Service
Accreditation information Relevant professional accrediting bodies
Any of the above information, in connection with the offerings or programs of Northeastern University Northeastern University
Google Analytics Google

With Whom Does the University Share Information?

  1. Sometimes the University may need to share your data. The following table gives examples of this kind of data sharing.
Recipients Data Which We May Share With Them
Northeastern University Contact details, immigration details, attendance, progression, education and attainment data, disability information (where necessary to provide adjustments or accommodations), disciplinary information (including investigations, adjudication, and determinations), financial information, data required by law in the European Economic Area, United Kingdom, or United States. 
University faculty Contact details, attendance, progression, education and attainment data. Where necessary for the provision of reasonable adjustments and/or of other support, and subject to your consent, health information
Professional staff Contact details, immigration details, attendance, progression, education and attainment data. Where necessary for the provision of reasonable adjustments and/or of other support, and subject to your consent, health information
University’s alumni team Contact details, attendance and progression information, financial information
Employment or study placement providers Your CV as well as any accessibility and assistance requirements and related information
Future employers Personal information relating to conduct, performance and academic achievement, where the University is asked for a reference
University league table compilers, for example, The Economist, Times, Guardian and organisations compiling graduate destination data Contact details and employment or further study destination data
Official bodies to which the University is obliged to report, for example HESA, ESFA, Jisc and the Office for Students, or their agents Information supplied as necessary to fulfil the University’s reporting obligations to these bodies. This may include relevant special category data
Advance HE is a member-led charity of and for the sector that works with partners across the globe to improve higher education for staff, students and society.  Advanced HE runs PRES and PTES national surveys designed to gather valuable feedback from postgraduate students about their learning and teaching experience. Participation in these surveys enables us to benchmark our performance, identify areas for improvement, and implement changes to enhance the quality of our postgraduate programs. To facilitate this, we will be sharing selected data, including special categories of personal data as defined under the UK GDPR, with Advanced HE.
External examiners Exam papers
UK Home Office Passport details, programme details and fees, and housing details
Senior Residents in Halls of Residence Student details
Housing providers Student details
Data processors (in other words third parties who process personal data on our behalf such as software providers) Application details, attendance records, other data necessary for providing specific educational services
Local Authority Contact details
Student Loans Company Contact details
Research partners Contact details, attendance and progression information
Regulatory and accrediting bodies, for example, SSU and SU Contact details, attendance and progression information
Funding bodies, scholarship and bursary providers Contact details, attendance and progression information
Government agencies, for example, HMRC (only upon request and where there is a legal basis for doing so) Contact details
Police (only upon request and where there is a legal basis for doing so) Information supplied as necessary to fulfil the University’s obligations with respect to fire prevention and detection of crime
Professional film-makers, photographers, design agencies, media suppliers, press Your appearance, voice and distinguishing features through film and photography. The University may disclose your name and educational information, subject to consent
Our professional advisors, such as our lawyers and accountants  Information supplied as necessary for the purposes of obtaining legal and/or financial advice 

Where in the World Is Your Personal Data Transferred to?

  1. Your personal data may be transferred to Northeastern University in the US for the purposes of providing educational or other support services, or for administration of the University and its programs. 
  2. Personal data may also be transferred offshore to third parties providing services to us or by those third parties themselves with our permission. 
  3. The list of third party providers is subject to change as the needs of the University change. A current list of these third parties is available upon request. 
  4. If any of our processing activities require your personal data to be transferred outside the United Kingdom, we will only make that transfer if:
    1. the country to which the personal data is to be transferred ensures an adequate level of protection for personal data;
    2. we have put in place appropriate safeguards to protect your personal data, such as an appropriate contract with the recipient;
    3. the transfer is necessary for one of the reasons specified in data protection legislation, such as the performance of a contract between us and you; or
    4. you explicitly consent to the transfer.
  5. You can contact us for more information about the safeguards we use to ensure that your personal information is adequately protected in these circumstances (including how to obtain copies of this information).

How Long Does the University Keep Your Data?

  1. The University must retain some staff and student personal data after they leave the University either because the law requires it or for other reasons, e.g. to provide transcripts and references or to keep tax records. Each type of data will be held for a set period, which is defined in the University’s Data Protection Policy.

What Are Your Rights in Relation to Your Data and How Can You Exercise Them?

  1. At any point while we are in possession of or processing your personal data, subject to certain conditions you have the following rights:
    1. Right of access – you have the right to request a copy of the information that we hold about you. It helps us to find your information if you provide us with the relevant details for the nature of your contact with us.
    2. Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
    3. Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
    4. Right to restriction of processing – where certain conditions apply you can ask us to restrict the processing of your data.
    5. Right of portability – you have the right to have the data we hold about you transferred to another organisation.
    6. Right to object – you have the right to object to certain types of processing such as direct marketing.
    7. Right to object to automated processing, including profiling – you also have the right not to be subject to the legal effects of automated processing or profiling.
    8. Right to data portability – you have the right to receive the personal data which you have provided to us and which is processed by us by automated means, in a structured, commonly-used machine readable format.
    9. Right of withdrawal of consent – where our processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. If you do decide to withdraw your consent we will stop processing your personal data for that purpose, unless there is another lawful basis we can rely on – in which case, we will let you know. Your withdrawal of your consent won’ t impact any of our processing up to that point.

The Data Protection Officer

  1. The University has appointed a Data Protection Officer.
    1. Their email address is:
    2. Their postal address is:

Data Protection Officer

Northeastern University London

Devon House

58 St Katharine’s Way



Questions and Complaints

  1. For more information on your rights, if you wish to exercise any right, for any questions, you may have or if you wish to make a complaint, please the Data Protection Officer.

Complaint to the Information Commissioner

  1. You have a right to complain to the Information Commissioner’s Office (ICO) about the way in which the University processes your personal data. You can make a complaint via the ICO website.

Version History

Title: Privacy Notice for Applicants, Students and Alumni

Approved by: Executive Committee

Location: Academic Handbook/ Policies and Procedures/ Data Protection

Version number Date approved Date published  Owner  Proposed next review date
23.2.0 April 2024 April 2024 Data Protection Officer September 2026
Version numbering system revised March 2023
1.1 January 2023 January 2023 Data Protection Officer September 2024
1.0 August 2021 August 2021 Data Protection Officer September 2023
Referenced documents Data Protection Policy.
External Reference Point(s) UK Quality Code Theme: Admissions, Recruitment and Widening Access; Information Commissioner’s Office (ICO); UKVI Tier 4 visa.