Starting university or further education can be an exciting time, but for some it can also be a difficult and anxious transition.

We know that universities and colleges work hard to provide support to students who are struggling. That means that universities and colleges often have to handle sensitive personal information about them. And we are aware that, sometimes, universities and colleges are hesitant to share students’ personal data in an urgent or emergency situation, citing data protection as the problem. That should not be the case.

Put simply, university and college staff should do whatever is necessary and proportionate to protect someone’s life. Data protection law allows organisations to share personal data in an urgent or emergency situation, including to help them prevent loss of life or serious physical, emotional or mental harm.

The ICO’s approach has always been to be a pragmatic and proportionate regulator. That means the ICO does not seek to penalise organisations for acting in good faith and in the public interest in an urgent or emergency situation.