University disclosing student data without consent

Short answer

Yes, in many circumstances your university can confirm basic details such as your degree, classification, dates of attendance or student status to an employer or another organisation without asking you first. Data protection law does not require your consent for every disclosure of your personal data. Consent is only one of several possible lawful bases, and universities frequently rely on other bases instead. That said, there are important limits on what they can disclose, to whom, and when, and consent remains the safest and most common route for one-off requests.

The legal framework

Confirming your details to a third party is “processing” of your personal data, so it is governed by the UK General Data Protection Regulation and the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025).

Under Article 6 of the UK GDPR, processing is only lawful if at least one lawful basis applies. The available bases include your consent, but also that the processing is necessary for a contract, to comply with a legal obligation, to protect vital interests, for a public task, or for the legitimate interests of the university or a third party (balanced against your rights and interests).

The key point is that consent is not the only route. A university does not automatically act unlawfully if it confirms your degree without asking you. It can rely, for example, on legitimate interests, particularly where confirming a qualification to a prospective employer serves both the employer’s legitimate interest in verifying a genuine candidate and, arguably, your own interest in progressing an application.

What this means in practice

Most universities take a cautious, layered approach.

For routine confirmation of a limited set of factual details, such as whether you attended, the dates, the degree awarded and its classification, many universities are prepared to confirm this without seeking fresh consent each time, relying on legitimate interests or their public task. Guidance from institutions such as the University of Manchester and Imperial College London reflects this: they treat consent as the default for ad hoc requests but recognise that a disclosure can be lawful on another basis, and they keep the disclosed data limited to period of study, marks or degree awarded and attendance record.

More detailed personal information, for example disciplinary records, health data, financial information, welfare matters or the content of your work, is treated very differently. Disclosing that kind of information without your consent would usually be excessive and hard to justify, and special category data (such as health) attracts additional protection under Article 9.

Many universities now route employer and agency verification requests through the national Higher Education Degree Datacheck service (Prospects Hedd). A Hedd check typically confirms only your name, qualification type, course name, year of award and classification. Some institutions require third parties to use this service rather than dealing with ad hoc requests directly.

The data minimisation limit

Even where a lawful basis exists, the university must comply with the data minimisation principle. It can only confirm what is relevant and necessary for the purpose of the request. Confirming “yes, this person graduated with a 2:1 in History in 2019” is very different from volunteering additional information about your conduct, attendance problems, fitness to practise, or personal circumstances. The broader or more sensitive the disclosure, the more likely the university needs your specific consent or a stronger justification.

Transparency and your right to object

Whatever lawful basis the university relies on, it must have told you about this kind of disclosure in its student privacy notice. Most universities set out in their privacy notice that they may confirm qualifications and attendance to employers, verification agencies and similar bodies. It is worth reading your own university’s student data privacy statement, which should explain what it discloses, to whom and on what lawful basis.

If the university relies on legitimate interests or public task rather than consent, you have the right under Article 21 to object to the processing. You can also make a subject access request to find out what has been disclosed and to whom.

Situations where the position differs

Where the request comes from a court order, the police, or a regulator exercising statutory powers, the university may be legally obliged or permitted to disclose without your consent, and sometimes without telling you.

Where you have signed a form as part of a job application, professional registration, or visa process authorising the employer or body to verify your qualifications, you have effectively already given consent, so the university confirming the details is unproblematic.

Where the disclosure would reveal sensitive information, or where you have specifically told the university not to confirm your details (for example due to safety concerns), the balance shifts strongly towards not disclosing without your express agreement.

Practical steps if you are concerned

1. Read your university’s student privacy notice to see what it says about disclosures to employers and verification services.

2. If you want to control disclosures, tell the university’s records office or data protection officer in writing that you wish to be asked before your details are confirmed, and explain any particular concern.

3. If you believe the university has disclosed more than the necessary factual details, or disclosed sensitive information without justification, complain in writing to the university’s data protection officer and ask what was disclosed, to whom, and on what lawful basis.

4. If you are not satisfied with the university’s response, you can complain to the Information Commissioner’s Office, which regulates data protection compliance.

What would change the answer

The outcome turns on exactly what the university confirmed, to whom, and why. Confirming a limited set of factual academic details to a bona fide employer or verification agency is usually lawful and does not require your consent. Disclosing sensitive, excessive or unnecessary information, or confirming details to someone with no legitimate reason to ask, is much more likely to breach the data protection principles. If you can say precisely what was disclosed and in what context, the position can be assessed more definitively.