University publishing marks and identifiable data

Short answer

Your marks and results, when linked to your name or student number, are your personal data. Under the UK GDPR and the Data Protection Act 2018 a university can only publish or display them if it has a lawful basis and complies with the data protection principles, in particular transparency and fairness. In practice this means a university generally cannot publish identifiable results on an open noticeboard, website or anywhere third parties can see them who is you. It can lawfully disclose your results to you individually, and it may publish anonymised or pseudonymised lists in limited circumstances, but even a student number can be personal data if it can be traced back to you.

Why your results are personal data

Personal data is any information relating to an identified or identifiable living individual. Your name is obviously identifying. A student or candidate number is also personal data whenever the university (or anyone with access to a key or list) can link it back to you. So publishing results against a student number is not automatically safe just because your name is not shown. If the number can realistically be matched to you, the same data protection rules apply.

Examination marks and results are treated as personal data by universities and regulators, and disclosure of them is governed by the UK GDPR.

The lawful basis and fairness requirement

To publish or display your results a university needs a lawful basis under Article 6 UK GDPR. It also has to satisfy the first data protection principle: processing must be lawful, fair and transparent. Publishing identifiable academic performance to people who have no need to see it will usually fail the fairness test and is likely to breach the principles, because most students would not reasonably expect their individual results to be made visible to classmates, family or the general public.

If the university wanted to rely on your consent, that consent must be freely given, specific, informed and capable of being withdrawn. Consent buried in general enrolment terms, or where refusal would disadvantage you, is unlikely to be valid.

What a university can normally do

Disclose your results to you individually, for example through a secure student portal, by post to you, or in a sealed communication. This is the standard and expected route.

Publish genuinely anonymised results, where no individual can be identified directly or indirectly. True anonymisation is a high bar; if the data can be re-identified it is only pseudonymised and remains personal data.

Process results internally for legitimate administrative purposes, such as exam boards, academic appeals, references you have asked for, and reporting to regulators, provided access is limited to those who need it.

What a university normally cannot do

Post identifiable results lists on a public or departmental noticeboard where other students or visitors can see who scored what.

Publish results linked to your name or a traceable student number on a public website or the open internet.

Read out or confirm results over the telephone or to third parties without proper identity checks and a lawful basis.

Disclose your results to parents, employers or others without your authority, unless a specific legal basis applies.

University data protection guidance across the sector reflects this: results should be disclosed only to the student, any public lists must be in anonymised form, and results should never be published where third parties can identify individuals.

Points that can change the answer

The key missing facts are how the results were displayed, whether your name or number was visible, and who could see and re-identify you. A leaderboard using untraceable codes distributed privately to each student may be lawful; the same list on a public wall using student numbers that classmates can match to individuals is likely not.

Context matters too. Publication of prize lists, graduation classifications, or degree award announcements is sometimes done with the student’s knowledge or a clear published policy, and different considerations can apply to formal award ceremonies and public degree congregation lists. Professional qualifications and some regulated results also have their own publication conventions. What the university told you at enrolment, and what its own published data protection and assessment policies say, will be central.

There is also a difference between publishing results and giving you access to your own marks and scripts. You have a right of access to your own personal data by subject access request, though the timescale for exam marks can be extended until after results are officially announced, and there is a specific exemption covering exam scripts (your own answers) as distinct from marks and examiner comments.

Practical steps if you think results were published unlawfully

1. Gather evidence. Note exactly what was displayed, where, when, for how long, whether your name or student number appeared, and who could see it. Take screenshots or photographs and record witnesses.

2. Check the university’s data protection and assessment policies and privacy notice to see what it says about publishing results and whether it claimed a lawful basis.

3. Raise it with the university’s Data Protection Officer in writing. Every university must have one and must publish contact details. Ask on what lawful basis the data was published, ask for it to be removed or anonymised, and ask what steps have been taken. You can also make a subject access request to understand what has been processed.

4. Use the internal complaints procedure if you are not satisfied, keeping everything in writing.

5. Complain to the Information Commissioner’s Office if the university does not resolve it. The ICO can investigate and require corrective action. You would normally be expected to have raised it with the university first.

6. Consider whether you have suffered damage or distress. In principle the UK GDPR and Data Protection Act 2018 allow a claim for compensation for material or non-material damage caused by a breach, but this is a separate route, usually a last resort, and success and value depend heavily on what actually happened and what harm resulted.

Bottom line

A university cannot freely publish or display your marks and results against your name, and usually not against your student number either, unless it has a valid lawful basis and the publication is fair, transparent and limited to those entitled to see it. Individual disclosure to you and properly anonymised statistics are generally fine; open display of identifiable results to others generally is not. If it has happened, start with the university’s Data Protection Officer and escalate to the ICO if needed.