Processing of personal data

The purpose of Universityadmissions.se is to support the application process to, and provide information about, admission to higher education in Sweden.

Here at Universityadmissions.se, you create an account and submit personal information about yourself in order to apply for university studies in Sweden.

After you’ve submitted your application, we also ask for information regarding your previous studies. For most international students, this means submitting documentation of these studies; for those who've completed studies in Sweden, this information is uploaded into the admissions system automatically.

This information is used by the Swedish Council for Higher Education (UHR) and Swedish universities and university colleges (HEIs) you’ve applied to when we determine if you’re eligible for studies, and when we review your qualifications for admissions selection.

What is personal data?

Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data.

The law protects personal data regardless of the technology used for processing that data – it’s technology neutral and applies to both automated and manual processing, provided the data is organised in accordance with pre-defined criteria (for example alphabetical order). It also doesn’t matter how the data is stored – in an IT system, through video surveillance, or on paper. In all cases, personal data is subject to the protection requirements set out in the General Data Protection Regulation (GDPR).

UHR is the data controller

The Swedish Council for Higher Education (UHR) is a government agency tasked with providing support to the education sector through a number of various activities. One of our tasks is, on behalf of Sweden's higher education institutions (HEIs), to coordinate the process for admission to higher education. Their organisation number is 202100-6487.

Decisions regarding admission are made by the respective higher education institution. An electronically-produced notification of selection results serves as the HEIs' official decision. This decision is made in the admissions registry. 

UHR is the data controller responsible for the processing of personal data in the admissions register and is responsible for ensuring that your personal data is processed In accordance with:

  • GDPR, the General Data Protection Regulation (EU) 2016/679
  • the complementary Swedish legislation (2018:218)
  • Regulation (1993:1153) on the account of your studies, etc. at universities and colleges (called regulation below)
  • other appropriate personal data protection regulations

Purpose of the admissions registry

In accordance with regulation, UHR maintains an admissions registry and, in that registry, provides individual data for each student. The registry is maintained with the help of automated management.

The purpose of the registry is to assist HEIs in the admission of students. Data may also be used for:

  • information disclosure (read more below)
  • official statistics
  • research

Information is also used in order to implement UHR’s task as system administrator and can in exceptional cases be used in support, testing and user studies.

Admissions decisions are made by the respective higher education institution (HEI). A machine-generated notification of selection results represents the HEI’s decision. This type of decision is produced with information found in the admissions registry.

Purpose of the student registry

Every higher education institution maintains a student registry. The HEI is responsible for the personal data in the registry.

The purpose of the student registry is to ensure that applicant data regarding courses and programmes, completed studies, course and programme grades, and degrees is saved. This data can also be used for:

  • follow-up and evaluation
  • decisions regarding application and tuition fees
  • expulsion of tuition fee-paying students
  • administration within the HEI
  • purposes stated in paragraph 6 and 6a of the Swedish Data Protection Act
  • official statistics outlined in chapter 3 of the Swedish Data Protection Act
  • resource allocation
  • research.

Legal basis for processing personal data

There’s a legal basis for the processing of personal data if the processing is necessary in order to carry out a task of public interest and as part of the data protection officer’s exercise of authority (article 6.1 GDPR, General Data Protection Regulation and the Data Protection Act, 2 kap. 2 §). UHR and HEIs must also process Swedish personal identity numbers and coordination numbers because a secure identification is imperative (article 87 GDPR, General Data Protection Regulation and the Data Protection Act 3 kap. 10 §).

Who receives your personal data?

Admissions officers at UHR, admissions officers at HEIs, and even personnel working on behalf of UHR or HEIs work with your personal data.

If you’re offered a place, data regarding your qualifications, if you’re required to pay tuition fees and your application are transferred to the HEI where you’ve been accepted. Your personal data can also be transferred to:

  • the Swedish Board of Student Finance (CSN)
  • the Swedish Institute
  • Statistics Sweden (SCB)
  • the Swedish Security Service (Säkerhetspolisen)

Because your personal data is considered a public record as soon as it's submitted to UHR, all your data can be released. 

Everything you submit becomes a public record

Everything you submit to a public authority, such as UHR, becomes a public record which can be requested by the public and mass media. With this in mind, when you write to UHR or a higher education institution you should:

  • not write more than is necessary
  • avoid including sensitive information

If someone requests information about you, UHR will perform a confidentiality check to determine if the personal data should be marked confidential. We then decide to what extent the personal data can be disclosed.

Student data

In addition to the data you submit on Universityadmissions.se, the following data can be transferred from the HEI's student registry to the  admissions registry:

  • eligibility/entry requirements, selection criterion, obligation to pay application and tuition fees, payment of application and tuition fees, admission, participation in the course/programme and examinations, credits awarded, grades, credits transferred or other crediting activities, and degrees
  • qualifications used for meeting of entry requirements
  • qualifications and information used in selection
  • other information a student cites in connection with admission to a course/programme, with the exception of information a student submits as the basis for a decision regarding application or tuition fees.

Every student’s identity should be specified with their name and Swedish personal identity number. If the student doesn’t have a Swedish personal identity number, a unique number will instead be assigned to them.

Transfer of personal data to countries outside the EU/EEA

Personal data is not transferred to countries outside the EU/EEA.

Would you like a copy of your study records?

You have the right to, without cost, request and receive information on the personal data UHR registers and processes about you in their data registries.

Contact us in writing (by letter or email) and provide your name, Swedish personal identity number (if you have one), address, and telephone number.  

Would you like to change your data?

You also have the right to request a change to your personal data, such as:

  • correcting incorrect information
  • completing incomplete information

If you found an error in your personal data, you should contact us using the contact form at this website. Some information you can change yourself, for example:

  • email address
  • temporary address
  • telephone number

How long do we save your personal data?

As a public authority, UHR is required to follow The Archives Act. This means that public records registered at UHR must be retained. The deletion of public records requires regulatory support from the Swedish National Archives. Therefore, there is no automatic right to delete them.

UHR deletes student personal data from the admissions registry 10 years after the date of arrival.

Data regarding citizenship must be deleted as soon as the admissions registry has been uppdated with the student’s application and tuition fee status (whether or not they’re required to pay).

You can yourself delete individual courses and programmes from your application, or your entire application, between certain dates during the application period.

Data protection officer

If you have questions about how UHR processes your personal data, please contact our data protection officer at dataskyddsombud@uhr.se.

Contact the data protection officer at the HEI where you’ll be studying if you have questions or comments regarding how they manage your personal data.

Right to file a complaint with the regulatory authority

If you’re not satisfied with the way UHR or your HEI is managing your personal data, you have the right to contact The Swedish Authority for Privacy Protection ,the regulatory body for issues regarding data protection, with your complaint.

Last updated: 04 April 2023