Information note for users intending to enrol in a Post-Graduate Programme

Information notice addressing anyone who provides their personal data for the purposes of enrolling in a study programme at the University of Bologna.

The Alma Mater Studiorum – Università di Bologna is updating its privacy policies pursuant to the new EU Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data.

In the next few days this privacy policy will be brought up to date.

In the meantime, the current privacy policy is supplemented by the information published on the Privacy Policy Update pursuant to the EU General Data Protection Regulation (2016/679)" webpage (in Italian).


The following information note fulfils the requirements laid down in Italian Legislative Decree (D.Lgs.) no. 196/03 (the Privacy Act) which, pursuant to art. 13 requires that concerned parties be informed concerning the processing of their personal data.

Purposes of processing and methods used

The data you have provided at the time of enrolment in your study programme or any time during your university career is collected and used within the limits set by law and the regulations, or is processed for institutional purposes. Please note that data processing complies with the general principles of transparency, correctness and non-excessive use laid down in art. 11 of the Privacy Act and that the data will be processed exclusively for the purposes of institutional activities and/or for the purposes laid down in D.R. 271/2009.
The University may also process your personal data for statistical and scientific purposes, also to facilitate the analysis and improvement of all activities and services relating to teaching, research and the right to study.
The University may use third parties (management bodies) to manage funds or for the organisation of Post-Graduate programmes and teaching activities. These management bodies may cooperate directly with the University in the performance of some activities which imply access to your personal data, including:
a) access to the list of registered students;
b) execution of pre-selection exams;
c) drafting of exam records;
d) drafting of ranking lists;
e) management of programme attendance;
f) drafting of exam records.
Sensitive data (concerning health) is provided by the interested party requesting specific support or services during the performance of the test or for institutional purposes laid down by the laws applicable to your study programme.
Please note that your data is processed with or without the use of electronic systems; in the latter case, such computer systems comply with the provisions of Annex B of the Privacy Act, and are equipped with suitable safety measures to prevent the loss, unlawful and improper use of your data or unauthorised access.

Nature of the data

The provision of your personal data is mandatory. If you refuse to do so, the university will not be able to carry out the operations necessary to establish relations between the student and the University. Your refusal will also make it impossible for the university to manage the administrative and teaching activities related to your student career, required to fulfil all legal requirements.

Processing parties

The Data Controller is the University of Bologna, via Zamboni, 33 – 40126 Bologna.
The “Data managers” are the directors of the administrative, technical, teaching and scientific offices which process your data (the list of directors is available on the website
The management body is the "External data manager" for data provided by the University for the activities they are responsible for.
The list of administrators of centralised university systems (e.g.: Studenti Online, Almaesami, etc..) is available from CeSIA and may be provided at the request of the interested party, by writing to

Data flows

Your personal data is processed by the departments and employees of the university exclusively for institutional purposes and in line with statutory provisions and other applicable regulations. Solely for such purposes, your data may also be notified to:
a) M.I.U.R. (Ministry of Universities and Research) for the performance of all statutory functions;
b) C.U.N. (National University Council) for the performance of its statutory institutional functions;
c) Certifying bodies, during the control of the affidavits produced for the purposes of DPR no. 445/2000;
d) Regional Management Bodies (with administrative and management autonomy established pursuant to Italian law on. 390/91 concerning university study law), national and foreign University and academic institutes, for the fulfilment of functions promoting international mobility of students and for the management of transfers;
e) Foreign Universities and Academic bodies, as part of the agreements involving the establishment of joint, dual or multiple qualifications;
f) national or foreign private parties, at their specific request, to confirm the presence of any qualifications or requirements in order to facilitate guidance, learning and employment pursuant to art. 96 of D.Lgs. 196/03;
g) local authorities, for the purposes of funding for specific categories of students;
h) The Attorney General, Ministry of Foreign Affairs, the Police, Embassies, State Prosecutors, concerning residence permits and the recognition of special statuses;
i) the Region, other accredited or authorised public and private operators and other potential employers, for the purposes of careers guidance and entry into the world of work (pursuant to Italian law 30/2003, on the labour market reform and subsequent implementations);
j) Insurance bodies and INAIL, for the management of insurance and accidents;
k) public or private bodies (Foundations, Associations, businesses, etc..) to assess, acknowledge and allocate economic benefits;
l) other public or private parties to which the University outsources its own services or with which agreements exist;
m) the judicial authorities (C.P. and C.P.P.);
n) University staff for research activities aiming to analyse the potential improvement of services, in a form that does not allow the direct identification of the interested party;
o) public or private bodies (Foundations, Associations, businesses, etc..) for the management of the University's institutional activities, such as the delivery of services linked to Post-Graduate programmes (pursuant to art. 4 of D.R. 271/2009, the General University Statute, and other regulations in force);
p) the parties listed in art. 16 and following of D.R. 271/2009.

Rights of the interested party

Pursuant to Article 7 of D. Lgs. 196/2003, at any time it is possible to obtain information from the data processors concerning the processing of your data, the methods and purposes of the processing and the applied logic, as well as:
1) the confirmation of the existence of the data and relative communication as well as their origin;
2) the details of the data controller and data processors and any parties or categories of parties to whom the data may be disclosed or who may have access to the data in their capacity as data processor or appointed party;
3) the updating, correction and/or integration of your personal data;
4) the deletion, transformation into an anonymous form or suspension of any data processed in breach of the law;
5) the confirmation that the operations referred to in points 3) and 4) have been notified to those to whom the data was disclosed or transmitted, except in those cases in which such notification is impossible or requires the use of means which are manifestly disproportionate to the protected right;
6) to oppose: the processing of your data, even where this is pertinent to the purposes for which the data was collected, on legitimate grounds; the processing of your data for commercial purposes or for the purposes of market research.
You may exercise these rights by writing to the Data Manager or to