Police enquiries, and similar agencies

Guidance for staff who receive an enquiry from the police or other agency requesting the University shares personal data about a student or staff membe

The Police or other agencies such as the Department for Work and Pensions (DWP) or HMRC may contact staff with requests to share information about identifiable living individuals.

Staff members should:

  • Not confirm or deny any information about any individual student on the spot. 
  • Confirm the enquirer is who they say they are. Beaware there are people  who will try to "blag" personal information about individuals.
  • Ask for the enquiry to be provided to the University in writing. If the enquiry comes from the Police they should provide a form citing Data Protection Act 2018 – Schedule 2, Part 1(2) counter signed by a senior officer (the form must have a wet signature). Please note, however, that this only applies while the investigation is still ongoing. If the police ask for somebody’s personal data with a warrant for an arrest and show you the required paperwork, then you must comply.
  • Note that this situation will likely only occur in out-of-hours times in Student Accommodation: if the Police do not have a counter signed Schedule 2, Part 1(2) form and claim urgency, you must insist that they fill in the the University's Emergency Form for the Disclosure of Personal Data and sign the form. A senior staff member will then decide whether to release the data or not. A paper copy of the Form should be available to all frontline staff members. In all situations, if the Police have no counter-signed Schedule 2, Part 1(2) form and cannot provide evidence for the urgency of the situation, then you should not comply with their request.

Emergency form for the disclosure of personal data: University log-in required

  • Direct the request to the Director or Head of Service responsible for the requested information.

Responsibilities for student data

These are the key staff who are responsible for decision making

Type of information Name of Director
Student or staff use of University computing equipment or login details Director of IT Infrastructure
Student or staff library use / borrowing history / library fines Director of Library User Services
Student’s status / centrally held academic records Academic Registrar
Datasets about groups of students Academic Registrar
Information held only by the student’s school Head of School
Student's Counselling service use Director of Student Counselling Service

The Director or Head of Service's responsibilities

The Director or Head of Service must:

  • decide whether to disclose the information

  • consider whether the student or staff member should be told about disclosure
  • make sure the request is answered in an appropriate way

Guidance for decision makers is available from Data Protection Officer (dpo@ed.ac.uk), who may involve Legal Services where appropriate.