Inclusive Student Support Services Data Protection Notice

  • Effective date: 01/03/2023

Identity of the Data Controller

Inclusive Student Support Services (hereafter referred to as ISSS) consists of services provided by the Wellbeing Service, Disability Service and the Assessment Centre.

This privacy notice sets out how ISSS processes the personal information of people accessing its services and other support provision, including but not limited to Registry and Finance. It applies in addition to and does not replace the University’s general student privacy notice or the applicant data privacy statement.

This notice may be updated from time to time to ensure continued compliance with current legislation and to reflect best practice.

Swansea University is the data controller and is committed to protecting the rights of participants in line with the General Data Protection Regulation (GDPR). In order to carry out its functions and obligations in respect to a person’s study at the University, it is necessary for the University to collect, store, analyse and sometimes disclose personal data.

The University is registered as a Data Controller with the Information Commissioner's Office (ICO) to process personal data. Reg no Z6102454

Contact details of the Data Protection Officer

Swansea University has a Data Protection Officer who can be contacted through

We take the collection, storage and use of personal data very seriously. In this document, you will find an explanation of why we collect individual data for Inclusive Student Support Services (ISSS), how we process it and the steps we take to ensure data security at all stages.

What personal information do we collect?

The personal details we process will depend on the support with which you are engaged, but are likely to consist of:

  • Name
  • Contact details; address, phone number, email
  • Programme of study
  • Student Number
  • Demographic data such as age, gender, health related information
  • Dates that you have engaged with the service
  • The name and contact details of your General Practitioner (GP)
  • Details of request for support, including details of the risk you may present to yourself or other people
  • Details of any relevant disability, medical condition or other medical information including documentary evidence
  • Whether you are in receipt of Disabled Students Allowance, and if so, the reason it was awarded
  • Emergency contact details

What is our legal basis for processing your personal data?

The University needs to state on what legal basis we will process your data. This can depend on the reason that we need to process your data, and in relation to Student Support and Wellbeing. This can include, but is not limited to:

  1. Consent
  2. Performance of a Contract
  3. Legal Obligation
  4. Vital Interest
  5. Public Task
  6. Legitimate Interests

The University may also rely upon the following legal basis when processing your special category data:

  1. Explicit Consent
  2. Vital Interest
  3. Reasons of Substantial Public Interest
  4. Provision of health or social care
  5. Statistical and Research Purposes

Further details of these categories can be found in the general student data protection notice and the applicant data privacy statement.

We collect this information in a variety of ways. For example, data may be collected through your submission of forms (online or in paper format), emails, in person, telephone or online meetings, interviews or other assessments, via case management software or enquiry management systems including our Chat System. It might also be collected from third parties such as other students or staff.

Use of Your Data

The purposes and related legal basis under which the University may process your personal data are listed below. Given the complexity of the relationships a university has with its students, this list is not exhaustive:

Description of process and specific purpose of using or sharing data

Who receives data

Legal basis

Discussions of your support with your parents, guardian, spouse, emergency contact or carer

Parent, guardian, spouse, emergency contact or carer (as indicated by you).

Consent, Vital interests


Discussions of your support with your GP or healthcare practitioner

GP or healthcare practitioner.

Consent, Vital interests

Details provided in confidence regarding your engagement and emotional/psychological support with staff from your Faculty or other university services.

The level of sharing will be proportionate and necessary for the circumstance of the enquiry.

Relevant Faculty staff, Student Services, Residences, Security, Safeguarding staff etc

Consent, Vital interests

If you are on a professional registration course and make disclosures in which we believe you or the public’s vital interests are at stake.

Your Faculty, Occupational Health, Senior Management Team, Relevant university departments.

Vital interests

Legitimate Interests

Substantial Public Interest

To provide appropriate support via ISSS

Relevant University staff and third parties.

Performance of Contract

Legitimate Interest

Public task

Substantial Public Interest

Provision of health or social care


To consider and provide support for disability or health related adjustments. This may involve, but is not limited to, providing your Faculty and Exams Office with a Teaching and Learning adjustments proforma, supporting applications for adapted accommodation, implementing Personal Evacuation Emergency Plans, or anything else required to ensure an equal learning opportunity or compliance with the Equality Act 2010 etc.

Relevant University staff, e.g. Faculties, Exams office, Accommodation, Health and Safety Security, Residences, any staff responsible for issuing adjustments based on a medical condition, third parties.

Performance of Contract

Legal obligation

Public task

Substantial Public Interest

Provision of health or social care

To confirm to legitimate parties or services external to ISSS whether or not you are known to or engaging with services within ISSS, so that we may provide you with the necessary support. No details given in confidence will be disclosed. 

Relevant University staff, e.g. Faculty staff, Student Services, Security, Residences, third parties etc

Legitimate interests.

Vital interests.


Assessments, Screening results and/or former diagnostic assessments will be shared with Educational/Clinical Psychologists and Assessors who may be assessing you.

Educational/Clinical Psychologists/Assessment Centres

Performance of Contract

Legitimate interest

Provision of health or social care

Equipment order or training requests will be sent to Assistive Technology suppliers and non-medical helper companies so that they can deliver the equipment and/or provide the necessary training, or support. Your contact details and address (if equipment is to be delivered), funding body and reference number will be shared with the providers. 

Assistive Technology Providers.

Performance of Contract

Legitimate interest

If you have applied for or have been awarded DSA, funding claims will be made for any costs the University has incurred providing the agreed support.  The claims will include your name, DOB, student number, support type, funding body reference and type, date and amount of support provided. For applications we will additionally provide course details and funding body reference numbers.

Funding Body, University Finance Department, third party payroll and invoicing provider

Performance of Contract

Legitimate interest

Substantial Public Interest


For consideration of ‘fitness to practise’ or ‘fitness to study’ issues

Faculty, Academic services

Public Task

Performance of contract

Substantial Public Interest

Provision of health or social care

Internal and external auditing and statistical purposes. (See ‘Sharing your information’ for further details)

e.g. should we become aware of a diagnosed condition which has previously been undeclared, we are obligated to update your student record with the category of disability relevant to you.

Funding bodies, Higher Education Statistics Agency (HESA), Higher Education Funding Council for Wales (HEFCW), Academic Services, Planning and strategic projects unit etc

Legal obligation

Statistical and Research Purposes

Substantial Public Interest


From time-to-time, other activities that fall within the pursuit of the University’s legitimate business and do not infringe your rights and freedoms

Relevant University staff and third parties.

Legitimate interest


Relevant University staff e.g. admissions, residential services, Student Services.

Performance of Contract

Legitimate interest

Substantial Public Interest

Provision of health or social care

Who has access to your personal data?

All staff within ISSS and the staff within the relevant parts of the University whose services you are accessing will have access to your personal data, to provide support to you or to refer you to other services.

Sharing your information

Within the university

Your data will be shared with relevant University staff, e.g.Personal Tutors, Supervisors, CampusLife services, Faculty Experience and Information teams, Student Support Officers, Student Advisers, Coordinator(s) of Adjustments, Course Organisers, Course Secretaries, relevant teaching staff, Student Administration (exam support), library and student support assistants (including relevant self-employed staff or agencies providing support assistant work), data information and insight department and staff in order to provide you with the support you require.

Your personal data may also be shared with parties where the Processing is necessary to protect the vital interests of the Data Subject or another person.

Outside the university

Your data may also be shared with placement providers, funding bodies, Higher Education Statistics Agency (HESA), Higher Education Funding Council for Wales (HEFCW), assistive technology suppliers and educational/clinical psychologists if appropriate.

In exceptional circumstances, we may share your information with appropriate and responsible third parties including statutory agencies such as the police, healthcare and welfare services without informing you first. This will normally be for safeguarding purposes, including when someone is considered to be a risk to themselves or others.

Given the complexity of the relationships a university has with its students and the various support mechanisms required, this list is not exhaustive.

Any disclosures that the University makes will be in accordance with data protection law and your interests will always be considered.

How do we keep your information safe?

The systems used by ISSS to process your data are part of the University’s corporately-supported IT architecture and are protected by the University’s security measures. You can find out more by referring to the University's Student Privacy notice.

We use an external company, Jotform, as a data processor.  Jotform is used for all registration forms to access ISSS and allows us, as data controllers, to administer our services on the University's behalf.

Some processing and storage may be undertaken on the University’s behalf by an organisation contracted for that purpose. Organisations processing personal data on the University’s behalf will be bound by an obligation to process personal data in accordance with Data Protection legislation.

Only members of staff who need access to relevant parts or all of your information will be authorised to do so. Information about you in electronic form will be subject to security restrictions, while paper files will be stored in secure areas with controlled access.

Retention period

Inclusive Student Support Services will hold personal information in accordance with the University's records management procedure.

Any information concerning your disability/specific need/medical condition provided to ISSS will be held securely for 7 years and thereafter will be destroyed.

If you contacted ISSS prior to, or during, your application to the University, but did not enrol at Swansea University, your data will be kept for two years from the date of your contact with our Service. This information is held for use should you re-apply or defer enrolment.

What are your rights?

You have a right to access your personal information, to object to the processing of your personal information, to rectify, to erase, to restrict and to port your personal information. If you have any concerns about the use of data for these purposes or would like a copy of the data we hold about you, requests or objections should be made in writing to the University Data Protection Officer:-

University Data Protection Officer
Vice-Chancellor’s Office
Swansea University
Singleton Park

Visit the University's Data Protection webpage for more information about your individual rights.

Withdrawing Consent

Under the GDPR, individuals have the right to withdraw consent at any time. If for any reason you wish to withdraw your consent, we ask that you submit this request in writing to the relevant service(s) within ISSS. You will be asked to complete a Request to Withdraw Consent form so we can ensure that you have understood what is meant by withdrawing your consent and what will happen next.

Other requests or objections should be made in writing in the first instance and sent to: - University Compliance Officer (FOI / DP), Vice-Chancellor's Office, Swansea University, Singleton Park, Swansea, SA2 8PP E-mail:

How to make a complaint

If you are unhappy with the way in which your personal information has been processed you may in the first instance contact the University Data Protection Officer using the contact details above.

If you remain dissatisfied then you have the right to apply directly to the Information Commissioner for a decision. The Information Commissioner can be contacted at: 

Information Commissioner’s Office: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF