University storing coursework in plagiarism database

Short answer

There is no absolute right to have your coursework kept out of a plagiarism database, and there is no simple ban on long retention. But “indefinitely” is not usually lawful in the sense the word suggests. Under UK data protection law your work, insofar as it identifies you or is linked to you, is personal data, and the university must not keep it for longer than is necessary for the purposes for which it is processed. It can keep submissions for a long time to check future work for similarity, but it must be able to justify the retention period, tell you about it, and stop processing when there is no longer a legitimate need. Whether the specific retention is lawful depends on your university’s own policies, the wording you agreed to, and how your data is stored.

Why the university can store it at all

When you submit work through Turnitin or a similar service, the university normally acts as the data controller and the software provider as the data processor. Retaining a copy of submitted work in the database is central to how these tools function: newly submitted papers are compared against a stored corpus of earlier submissions to detect textual similarity. Checking future students’ work against the existing database is a legitimate purpose, and universities generally rely on this to justify retention.

Your acceptance of the university’s academic regulations, and usually a submission or enrolment agreement, typically authorises this use. Many institutions state expressly that submitting work permits its retention in the originality-checking database. Importantly, you normally retain copyright in your own original work; the university’s storage for similarity checking does not transfer ownership to it or to the software provider.

What UK data protection law actually requires

The relevant law is the UK GDPR and the Data Protection Act 2018. The points that matter here are the following principles.

Purpose limitation means the work can only be used for the purposes explained to you, which will normally be originality and academic-integrity checking, not unrelated commercial use.

Storage limitation, in Article 5(1)(e) UK GDPR, means personal data must be kept in a form that permits identification for no longer than is necessary for those purposes. This is the principle that bites on the word “indefinitely”. A blanket, permanent, never-reviewed retention with no justification would be difficult to defend. In practice providers and universities argue that a very long retention is necessary because a paper submitted years ago is still a valid comparison source for detecting later copying, and there is a reasonable argument for that. But the university should still have a defined retention schedule and a rationale, rather than keeping everything forever without thought.

Transparency, in Articles 13 and 14, means the university must tell you, usually in a privacy notice, what it collects, why, the legal basis, who processes it, whether it is transferred outside the UK, and how long it is kept or the criteria used to decide that. If your university has not made a retention period or the criteria reasonably available, that is itself a compliance gap you can raise.

International transfers matter because some providers store or process data outside the UK. The university must ensure an appropriate transfer safeguard is in place.

Your practical rights over stored work

You have several rights you can exercise, though none of them is unconditional.

You can make a subject access request to see what personal data the university holds about you, which can include confirming that your submissions are retained and on what basis.

You can ask for erasure under Article 17, sometimes called the right to be forgotten. This is not absolute. The university can refuse if it still has a lawful basis and a genuine need to retain the work, for example ongoing academic-integrity purposes or an unresolved misconduct issue. In practice many universities will remove a specific submission from the active comparison database on request, and some, such as Bristol, have a named administrator process to arrange removal via the provider. Whether removal is granted depends on the institution and the reason.

You can object to processing under Article 21 where the university relies on legitimate interests, and the university must then show compelling grounds to continue.

You can raise a rectification request if the stored data is inaccurate.

Where “indefinite” retention is most vulnerable to challenge

The retention is weakest, and most open to challenge, in these situations. If the university has no published retention schedule at all and simply keeps everything permanently with no review. If the privacy notice does not disclose the retention period or the criteria for deciding it. If your work is being kept long after you have graduated with no articulated ongoing purpose. If the data is being used for a purpose beyond originality checking, such as training a commercial product or being shared beyond what you were told. If your work contains special category data or a lot of identifying personal content that is not necessary for similarity comparison, since the university should minimise what it stores.

Conversely, if the university has a clear policy, a stated retention period or criteria, a transparent privacy notice, and stores the work purely as a comparison source, then long retention is likely to be lawful even if it feels open-ended to you.

An important distinction

There is a difference between the university keeping a copy in a database to compare against future work, which is generally defensible, and the software provider using or exploiting your work for its own commercial benefit beyond providing the service, which would need a clear basis and disclosure. Do not assume the former is unlawful simply because it is long-term. Equally, do not assume the retention is automatically fine just because you clicked to accept terms; the university still has to meet the data protection principles regardless of a tick-box consent.

Practical next steps

1. Read your university’s privacy notice for students and its Turnitin or academic-integrity policy. Look specifically for the stated retention period or the criteria used, the legal basis, and any removal process.

2. If the retention period or basis is not stated, or you want to know exactly what is held, submit a subject access request to the university’s data protection officer, and ask directly how long submissions are retained and why.

3. If you want a specific submission removed, ask the data protection officer or the Turnitin administrator in writing to erase it or remove it from the comparison database, and ask them to identify the lawful basis if they refuse. Be aware they can lawfully decline if there is a genuine ongoing purpose.

4. If you are unhappy with the response, use the university’s internal data protection complaint process first.

5. If that does not resolve it, you can complain to the Information Commissioner’s Office, which regulates data protection and can assess whether the retention and transparency comply with the UK GDPR.

Key missing facts

The precise position depends on which university and which system you are using, what your university’s published privacy notice and retention schedule say, exactly what you agreed to on enrolment or submission, whether you have graduated or are still enrolled, and whether the work is tied to any current or historic academic-integrity issue. If you tell me the institution and quote the relevant part of its privacy notice or Turnitin policy, I can give a more targeted assessment of whether its retention is defensible and what to ask for.