The collection, processing and retention of data for analytical purposes has become commonplace in modern business, and consequently the associated legal considerations and ethical implications have also grown in importance. Who really owns this information? Who is ultimately responsible for maintaining it? What are the privacy issues and obligations? What practices pose ethical challenges? This paper in the CETIS Analytics series covers legal, ethical and related management issues surrounding analytics in the context of teaching, learning and research and their underlying business processes. It is based on current UK law, set in the context of publicly funded Further and Higher Education and their mission. With a primary focus on personal data, it considers the rights and expectations of the data subjects (students, researchers, employees) and the responsibilities of institutions, above campus services, suppliers and funders.