Sharing student data with sponsor without consent

Short answer

It depends on why the data is being shared and what legal basis applies. Under the UK GDPR and the Data Protection Act 2018, sharing your attendance, marks or disciplinary record with a third party is “processing” of your personal data, so your university needs a lawful basis to do it. Crucially, that lawful basis does not always have to be your consent. In some situations the university can share without your consent because it has another lawful basis, and in some situations it can only share if you have consented. The right analysis turns on who the recipient is and why they want the information.

When the university can share without your separate consent

Consent is only one of six lawful bases under Article 6 UK GDPR. Universities routinely rely on other bases, so “without my consent” is not automatically the same as “unlawfully”.

Legal obligation and public task for immigration sponsorship. If you are a Student Route (formerly Tier 4) visa holder, your university is your visa sponsor and is required by the Home Office sponsor licence duties to monitor and report certain matters, including enrolment, withdrawal, and failure to attend or engage. Reporting this to UK Visas and Immigration is done to comply with a legal obligation and the university’s public task, not on the basis of your consent, and you cannot refuse it. This is the single most common situation where attendance and engagement data is shared with an outside body regardless of your wishes. You should have been told about this in the privacy notice you received at enrolment.

Contractual sponsorship (fees paid by an employer or funding body). If a third party is paying your tuition fees under a contractual sponsorship arrangement, universities generally take the view that limited data (often attendance, progress and results) can be shared because it is necessary for performance of, or connected to, that funding arrangement, and because you were told about it. Many universities nonetheless build a consent step into the sponsorship agreement itself, so in practice you often will have agreed to the disclosure when you accepted the funding. Imperial College, for example, treats a “sponsor” as someone with a contractual agreement to pay part or all of your fees, and only allows disclosure to other so-called sponsors with your consent or on another lawful basis such as legitimate interests.

Other lawful bases. Disclosure may also occur to comply with a court order, to prevent or detect crime or fraud, in cases of genuine risk to life or safety, or where a professional or statutory regulator (for example in medicine, nursing, teaching or law) has a legitimate right to fitness-to-practise information. These do not require your consent.

When your consent is normally required

For an ordinary employer or prospective employer, or anyone who is not your fees sponsor and has no independent legal right to the information, the default position is that the university should not disclose attendance, marks or disciplinary records without your consent. This is why reference requests and confirmation of results to employers are usually handled on the basis of consent, and why universities commonly ask you to authorise the release of a transcript or reference.

Disciplinary records are treated with particular caution. A disciplinary outcome is sensitive and reputationally significant, and universities generally will not disclose it to an outside employer without either your consent or a clear separate lawful basis, such as a regulator’s legitimate entitlement in a fitness-to-practise context. A bare request from an employer, without your authorisation, would not usually justify disclosure.

Parents and family are not sponsors in the data protection sense unless they hold a contractual fees agreement, and data generally cannot be shared with them without your consent.

The role of the privacy notice

The key document is the student privacy notice or data collection notice you were given at enrolment. Under Articles 13 and 14 UK GDPR the university must tell you, at the point it collects your data, what it will do with it, who it may share it with, and on what lawful basis. If the notice clearly states that attendance and results may be shared with a named category of sponsor or with UKVI, and identifies the lawful basis, then that sharing is lawful and is not defeated by the absence of a fresh consent from you. If the notice does not cover a particular disclosure, the university should not make it without going back to you or identifying another lawful basis first.

You should read your own university’s student privacy notice, its data protection policy, and any sponsorship agreement you signed, because the specific wording determines what has been authorised.

What this means for you in practice

The answer depends on facts you have not yet given, so identify which situation you are in.

1. Are you an international student on a Student visa? If so, attendance and engagement data will be reported to UKVI as a matter of legal obligation, and you cannot prevent that.

2. Is the “sponsor” paying your fees under a contract? If so, check whether the sponsorship agreement or privacy notice already authorises disclosure of attendance, progress or marks. It very often does.

3. Is the recipient an ordinary employer with no fees relationship and no regulatory entitlement? If so, the university should normally obtain your consent before disclosing marks or a disciplinary record, and you can decline.

4. Is a professional regulator involved? Fitness-to-practise disclosures can be lawful without consent.

If you think a disclosure was wrong

If you believe your data has already been shared without a lawful basis, you have several options, best taken in order.

1. Make a subject access request under Article 15 UK GDPR to find out exactly what was disclosed, to whom and when.

2. Ask the university’s data protection officer, in writing, to identify the lawful basis it relied on for the specific disclosure, referring to the relevant part of the student privacy notice.

3. If you are not satisfied, use the university’s internal complaints or data protection complaints procedure.

4. If still unresolved, you can complain to the Information Commissioner’s Office, which regulates data protection in England and Wales. In cases of genuine loss or distress caused by an unlawful disclosure, compensation is possible under the Data Protection Act 2018, though that is usually a last resort.

Key missing facts

To give you a definitive answer I would need to know whether you are on a Student visa, whether the recipient is paying your fees, whether you signed a sponsorship agreement, exactly what category of data was or would be shared, and what your university’s student privacy notice says about disclosures to sponsors and employers. The lawful basis, and therefore whether your consent is required, changes with each of these.