Accessibility Skip to Global Navigation Skip to Local Navigation Skip to Content Skip to Search Skip to Site Map Menu

Privacy of student information

Trees flowering on campus

Purpose

The University collects and processes student personal information primarily for the purposes of considering applications for study, enrolling students, supporting students, and administering student records and courses of study.

Collection and processing of your personal information is necessary for us to carry out our core functions and activities as a university, to meet our obligations to our student body, and to comply with legislative and reporting requirements. These represent our lawful purposes and are the ‘legitimate interests’ we have in collecting and processing of your personal information. This Privacy Statement further describes how the University will collect, use, store and share personal information and explains your rights in relation to those activities.

In this statement, ‘student’ also includes prospective students who have engaged with the University.

Collection of personal information

The University will collect, use, store, and disclose personal information relating to students in accordance with the provisions of the Privacy Act 2020 and the Public Records Act 2005. Where practicable all such personal information is obtained directly from students, or from their nominated agents. Additionally, personal information may be obtained or verified through relevant government or education agencies, including the New Zealand National Student Index.

In some cases, collection of your personal information is required under New Zealand law, including through the Education and Training Act 2020.

Storage of personal information

Personal information will be stored on University files and databases and all practicable security measures will be maintained. A unique identifier will be assigned to each student, which will be used in conjunction with a secondary means of identification or password/PIN.

We are required under New Zealand law to retain certain information in accordance with the Public Records Act 2005.

Access to personal information

Staff members and other personnel within the University or within agencies under contract to the University will have access to students’ personal information for purposes relevant to normal University operations including but not limited to: student recruitment, marketing, admission, enrolment, study, academic progress, tuition fees and charges, establishing and maintaining academic and graduation records, assessment, academic agreements (exchange and study abroad partners, scholarship providers or sponsors, programme delivery partners), academic advice and support, student services, discipline, security and safety, Library and IT services, managing students’ association membership and records, managing records of graduates, and other alumni, and managing and improving the quality of services provided by the University.

Sharing of personal information

In order to conduct its proper business and as required under the Education and Training Act 2020 and other laws, regulations, and contractual agreements by which it is bound, the University may use the student’s personal information it holds and may disclose personal information to external agencies such as government departments, bodies responsible for course moderation and professional accreditation or membership, agencies for financial support and pastoral care, and university student and alumni associations.

Such agencies include, but are not limited to:

  • the Ministry of Education (information will be recorded on the National Student Index and used in an authorised information matching programme with the New Zealand Birth Register and may also be supplied to Statistics NZ)
  • the Ministry of Social Development (including Work and Income New Zealand and StudyLink)
  • the Inland Revenue Department
  • Te Puni Kōkiri
  • Immigration New Zealand (for students who are not New Zealand citizens)
  • Other education organisations for the verification of academic records
  • relevant professional bodies
  • course moderation or accreditation bodies
  • the Tertiary Education Commission
  • the Ministry of Trade and Enterprise
  • Education New Zealand

Information provided to external agencies is either student-specific (typically name, date of birth, current contact details and academic or graduation details) or cohort-specific (aggregated or statistical information that does not identify individuals).

The University may disclose limited personal information offshore for the purposes of assessment, marking, moderation or supervision. In such instances the University will take reasonable steps to ensure such information is subject to the safeguards afforded by the Privacy Act 2020 or equivalent safeguards. Where provision or disclosure of personal information is voluntary or falls outside the scope of personal information that the University is permitted to collect, store, use and disclose under the Privacy Act 2020, students will be advised and their consent will be obtained prior to the provision or disclosure of personal information.

Security of personal information

The University will take all reasonable steps to keep your personal information safe and secure, and to ensure that it is protected against loss or unauthorised access, modification, use or disclosure. In some instances, your personal information may be transferred, and held, by service providers in New Zealand and overseas (including for example, where it is stored using a cloud-based service). Where this occurs, the University will do everything reasonably within its power to ensure that the service provider also has reasonable security measures in place to protect your personal information.

The University will not transfer your personal information to a foreign person or entity (including an overseas-based service provider) unless:  

a) it reasonably believes that the foreign person or entity has obligations to protect your personal information in a way that is comparable to the protections afforded by the Privacy Act 2020; or 

b) you authorise the disclosure of your personal information after being expressly informed by the University that the foreign person or entity may not be required to protect your personal information in a way that, overall, provides comparable safeguards to those in the Privacy Act 2020; or  

c) it is not reasonably practicable in the circumstances for the University to comply with (a) and (b), and it believes on reasonable grounds that disclosure of the personal information is necessary as permitted under the Privacy Act 2020.

Your rights

The University will make personal information held about students available to them upon request and in accordance with the Privacy Act 2020. The Privacy Act 2020 describes the conditions under which some personal information may be withheld.

Students have the right to request correction of personal information held in accordance with the provisions of the Privacy Act 2020. If you would like to do this, please email the University Privacy Officer at registrar@otago.ac.nz.

If you are concerned your privacy has been breached by the University, you may make a complaint to the University Privacy Officer at registrar@otago.ac.nz. You also have the right to make a complaint to the Office of the Privacy Commissioner. You can contact the Office of the Privacy Commissioner at www.privacy.org.nz.

The University will notify you as soon as practicable if there is a privacy breach in relation to your personal information that the University reasonably believes has caused or is likely to cause you serious harm, unless one of the exceptions under the Privacy Act 2020 applies. The University will also notify the Privacy Commissioner as soon as practicable if there is such a breach.

The General Data Protection Regulation (GDPR)

The University will comply with the European Union General Data Protection Regulation (GDPR) when offering services to students or prospective students in the European Union (e.g. distance learning courses aimed at the European market).

In addition to the rights above, the GDPR gives you the right to:

  • withdraw consent, where consent is the legal basis for our processing of your personal information;
  • be forgotten, that is request your personal information be removed from systems that we use to process your personal information. However, under New Zealand law, we are required to retain certain information under the Public Records Act 2005;
  • request copies of your personal information in a structured, commonly used and machine-readable format and/or request us to transmit this information to another person (where this is technically feasible);
  • restrict our processing in certain ways;
  • object to certain processing activities by us; and
  • make a complaint to a supervisory authority.

This Privacy Statement operates in conjunction with any specific privacy statement or declaration made in connection with the collection by, or supply to, the University of individual items of information.