It is vital that the University handles student information in accordance with the ANU Privacy Policy and the Privacy Act 1988.

This ensures that we meet students’ expectations for protecting their personal information.

Student information must only be used for the purpose it was collected.

When collecting student information, it is important to have a privacy notice that clearly states why the information is being collected and how it will be used, ensuring students’ consent.

Guidance and templates for privacy notices are available online.

The start of a new academic year brings new opportunities to engage with commencing and returning students. If you are creating and updating mailing lists, please ensure they apply the appropriate privacy practices.

The University utilises student mailing lists for communicating with specific student cohorts about their enrolment, academic progress, University services, fees, etc. Using personal information for these purposes is permitted under the ANU Privacy Policy.

Colleges and Divisions may want to contact students for other reasons, e.g. on-campus events, extracurricular activities, or careers. To communicate with students about these opportunities, mailing lists may be created and must be managed on an opt-in/sign-up basis.

For example, students could sign up via a webpage, when registering for or attending events, or via University publications. However students sign up, it should include a privacy notice outlining how their information will be used.

Key principles for managing student mailing lists

For content essential for program administration, no additional consent is required. 

For content not related to program administration: 

Orientation Week (O-Week) provides students with many wonderful events across campus. If you are planning event, please view the privacy advice for events management guide on the ANU privacy site. Dealing with privacy is an important part of the events management process. This guide explains how to effectively manage privacy as part of your event.

Topics include: 

• Taking registrations for your event 

• Inviting speakers for your event

• Introduction to the event

• Obtaining permission to use attendees’ information

These principles apply for both in-person and online events. When planning to hold events online, please ensure that you are using systems and software that are approved by the University, for security purposes.

By thinking about privacy when planning your event, you can ensure that your event runs smoothly and the way you use information or recordings is appropriate.

Proper storage of students’ personal information is vital to protect it from improper use or loss. Student personal information must only be stored on University devices and must be stored with appropriate security measures in place.

Important things to consider are: 

• Where is the information stored? 

• Who can access the information? 

• When should the information be deleted? 

Information must be stored on approved University devices, in the appropriate place. For example, University records must be stored in the ERMS. Business documents must be stored in approved University systems such as shared drives, SharePoint, or OneDrive. 

When storing information, it is important to consider who has access to the information. Only staff who require access for their role should be able to view personal information. For example, you may need to place additional rules on Shared Drives or SharePoint sites, to ensure access is appropriately restricted. 

Personal information should only be stored for as long as it is required. If there is no valid business need for keeping the information, it should be destroyed, unless the University is required to keep it as a University record. When University records are uploaded to the ERMS, the system will determine the appropriate retention period. For more advice, please contact University Records.