Access to university welfare records

Overview

Your university disability, counselling and welfare records are personal data about you, and much of the information in them (health, mental health, disability, therapy notes) is “special category data” under the UK General Data Protection Regulation and the Data Protection Act 2018. Special category data attracts stronger protection and generally cannot be shared without a lawful basis and, in most cases, your consent. In addition, counselling and welfare records are usually held under a professional duty of confidentiality that is separate from and often stricter than data protection law.

The practical position is that these records are treated as confidential by default. They are not routinely shared with your academic department, your parents, or anyone else, and access by third parties normally requires either your consent, a legal obligation, or a genuine safeguarding justification.

Who can access them within the university

The staff who can see your records within the university are limited to those who need the information to provide the service to you. In practice this means the counsellors, disability advisers, mental health advisers, wellbeing officers and support staff working directly on your case, together with a small number of administrative staff who manage records. Access is generally controlled on a “need to know” basis.

Different services within a university often keep their records separate. Counselling records in particular are usually kept apart from your main student file and from disability and welfare records, and are subject to the tightest confidentiality. Many university counselling services will not release the counsellor’s session notes even to you in full, and certainly not to other departments, without explicit written consent or a court order.

Your academic tutors, lecturers and department do not automatically see the underlying medical or counselling detail. Where a disability adviser sets up reasonable adjustments or a support plan, the department is usually told only what it needs to implement the adjustments (for example that you are entitled to extra time in exams), not the underlying diagnosis or clinical detail, unless you agree to that being shared.

Sharing outside the university

The records are not shared with outside bodies unless one of a limited number of situations applies. Typical lawful grounds for external sharing are your explicit consent, a legal requirement, a court order, or a serious risk to life or safety.

External parties such as the NHS, your GP or a mental health team may be involved where the service is coordinating your care, but this is normally done with your knowledge and, where practicable, your consent. Sharing with your family, including parents, does not happen simply because they ask or because they pay your fees. If you are an adult, they have no automatic right to your records.

When records can be shared without your consent

There are recognised exceptions where confidentiality may be overridden. The most common are:

Risk of serious harm. If staff believe there is a serious and imminent risk to your life or safety, or to the safety of others, they may share relevant information with emergency services, medical professionals or a designated safeguarding contact. This is a well established exception in both confidentiality and data protection terms, but it is meant to be limited to what is necessary to manage the risk.

Legal obligation or court order. A court can order disclosure, and there are limited statutory situations (for example certain safeguarding or serious crime contexts) where the university may be required or permitted to share information.

Safeguarding of children or vulnerable adults. Where there is a safeguarding duty, information may be shared with the appropriate authorities.

Universities should still normally aim to tell you when they share information under these exceptions, unless doing so would increase the risk.

Your right to see your own records

You have a statutory right of access to the personal data the university holds about you. This is a subject access request under Article 15 of the UK GDPR. You can make it in writing (or often by email) to the service or the university’s data protection officer, you do not have to give a reason, and it is free in ordinary cases. The university must normally respond within one month, though this can be extended by up to two further months for complex or multiple requests.

There are limited exemptions to your right of access, and the most important one here concerns health, social work and counselling data. The university can withhold information where disclosing it to you would be likely to cause serious harm to your physical or mental health, or to that of another person. It can also redact information that would identify or breach the confidentiality of a third party (for example another student or a family member) unless that person consents or it is reasonable to disclose without consent.

Because of these exemptions, some counselling services will discuss your notes with you rather than simply handing over the raw clinical record, and may decline to release certain third party or clinically sensitive material. That is lawful where the exemption genuinely applies, but a blanket refusal to give you any of your own data is not, and you can challenge it.

Practical points and how to check

The precise rules depend on your specific university’s policies, so the most reliable source is your own institution’s student services confidentiality policy and privacy notice. These documents set out exactly which staff can see the records, how services share information between themselves, and the circumstances in which they will contact your GP, next of kin or emergency contact. It is worth reading them, because policies vary in detail, for example on whether counselling notes are ever shared internally and on what an emergency contact can be told.

If you want to control what happens to your information, you can:

1. Ask the service, at the outset, exactly who will see the information and in what circumstances they would break confidentiality.

2. Give or withhold specific written consent for information to be shared with your department, family, GP or funding body, and record clearly what you do and do not agree to.

3. Make a subject access request if you want to see what is held about you.

If something goes wrong

If you believe your records have been shared inappropriately, or you have been refused proper access to your own data, first raise it through the university’s complaints procedure and with its data protection officer. If you are not satisfied with the outcome, you can complain to the Information Commissioner’s Office, which regulates data protection and can investigate unlawful sharing or a mishandled subject access request. Where a counsellor has breached professional confidentiality, you may also be able to complain to the relevant professional body if the counsellor is accredited or registered. Separately, complaints about the overall handling of your case as a student can, once the internal process is exhausted, be taken to the Office of the Independent Adjudicator for Higher Education.

What would change the answer

The outcome in your situation may depend on facts you have not given. It matters which university you attend and what its policies say, whether the record is a counselling note as opposed to a disability support plan, whether there is any live safeguarding or risk concern, whether you are asking about internal sharing or disclosure to an outside body, and whether any third party’s information is bound up in your records. If you tell me your institution and the specific situation you are worried about, for example a department asking for your medical detail, a parent wanting access, or a refusal to give you your counselling notes, I can be more precise.