Privacy Policy

Purpose

1. The purpose of this policy is to –
    
   
   • protect the University Community and Potential Members from misuse, unauthorised access and improper handling of data;
   • ensure compliance with the applicable Australian laws and Indian laws; and
   • uphold the rights of individuals to fair and transparent processing of their data.
2. This Policy is to be read in conjunction with the Information Governance Policy.
3. In this Policy —

Scope

1. This Policy applies to the entire University Community and Potential Members. It governs how the University collects, holds, uses, accesses, discloses, and manages Personal Information and Sensitive Information, and applies to all data under the University's control, regardless of format or location.

Definitions

Australian laws are the key legal instruments that are applicable to this policy, including but not limited to:

• Australian Privacy Act 1988 (Cth)
• Australian Privacy Principles (APPs)

Data refers to a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means, as defined in the DPDP Act.

Indian laws refer to the key legal instruments that this Policy needs to comply with, including not limited to:

• Digital Personal Data Protection Act (DPDP), 2023
• Information Technology Act, 2000
• Information Technology (amendment)Act, 2008

Personal Information refers to information or an opinion about an identified, or an individual who is reasonably identifiable, whether true or not and whether recorded in a material form or not. For the purposes of this Policy, Personal Information also includes “Personal Data” as defined under the DPDP Act, which means any data about an individual who is identifiable by or in relation to such data.

Potential Members refers to anyone not part of the University Community i.e. visitors to the University website.

Sensitive Information refers to information or an opinion about an individual’s racial or ethnic origin, political opinion, religious beliefs, association memberships, sexual orientation, criminal record or health, genetic or biometric information that is also Personal Information.

University refers to the UWA India entity.

University Community refers to all staff, students, contractors, honorary appointees, visiting academics, affiliates, and any other persons acting in an official capacity on behalf of the University.

Privacy Principles

1. The University collects Personal Information for legitimate purposes, including enrolment, teaching, research, University administration, service delivery, and legal compliance. This may include names, contact details, academic records, identification documents, and Sensitive Information.
2. The University is committed to safeguarding privacy and handling data responsibly, lawfully, and fairly.
3. Collection is limited to information necessary for University activities, using lawful and transparent means, and where possible, directly from individuals.
4. The University will not collect Sensitive Information unless it is with consent, or as permitted or required by law.
5. The University may use Personal Information for its primary purpose, or related secondary purposes reasonably expected by individuals, or as permitted by law.
6. Security safeguards protect all information from unauthorised access, loss or misuse, and access is restricted to authorised personnel only.
7. Individuals are provided with clear rights to access, correct, update, delete, and withdraw consent for their Personal Information, unless this impacts the privacy of others or is otherwise restricted by law.
8. The University will not sell or trade personal data under any circumstances.

Storage and Processing: India

1. Personal information stored or processed will be governed by the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable IT Rules.
2. The data will be collected and processed lawfully, with explicit consent where required.
3. University students have rights to access, correct, update, or delete their personal information and withdraw consent.
4. The data may be shared with service providers or authorities only as required by law.
5. Data transfers to Australia and other countries for legitimate and lawful purposes are permitted only where equivalent protection is ensured.

Storage and Processing: Australia

1. Personal information from students will be securely stored and processed in Australia where required.
2. Where data is stored in Australia, the University complies with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
3. The data stored in Australia is subject to strict privacy and security requirements.
4. The University ensures all overseas student data is handled lawfully, fairly, and transparently.
5. Cross-border transfers are permitted only where the recipient (UWA Australia) provides comparable protection to Indian standards.
6. Access to Indian students’ data is restricted to authorised staff and governed by robust security controls.
7. Individuals can request access to, or correction of, their data stored in Australia.
8. Data breach notifications will be made to affected individuals and relevant authorities in both Australia and India, as required.

Disclosure

1. Personal information may be disclosed to:
   ‍
   
   • University departments and staff in both India and Australia, as necessary for University operations;
   • government and regulatory bodies, as required under law;
   • emergency contacts or services in case of emergency;
   • law enforcement, if required or authorised by law; and
   • service providers, subject to contractual privacy and security obligations.

International Data Transfers

1. Where personal information is transferred between India and Australia or other countries, the University ensures privacy is protected in accordance with Indian laws and Australian laws.
2. Transfers are permitted only where there are appropriate safeguards in place.

Website Privacy and Cookies

1. The University’s website uses cookies and analytics to improve user experience. Logs of website activity are recorded and managed in accordance with this Policy and the University’s record-keeping obligations.
2. Cookie preferences can be managed through browser settings.
3. No personal information is disclosed to third parties through use of cookies except as otherwise allowed by this Policy.

Rights and Complaints

1. The University Community can exercise their rights under both the DPDP Act and Australian Privacy Act, including access, correction, deletion, and complaint mechanisms.
2. Individuals can request access to, or correction of, their data stored in India or Australia.
3. To exercise rights or lodge a privacy complaint, contact the University Privacy Officer at
4. Suspected privacy breaches will be investigated. Eligible data breaches will be notified to affected individuals and authorities in accordance with the processes required by Australian laws and Indian laws.
5. The UWA India IT Service Desk will manage any suspected breaches and escalate them as appropriate.
6. Failure to comply with this Policy may result in disciplinary action.

Policy Review

1. This Policy is reviewed regularly and updated as required by changes in law or university operations.