Collection notices (historical)

6 June 2022 to 9 June 2023

Student collection notice 2022-2023

Jisc is the body responsible for collecting and disseminating information about higher education in the UK and the designated data body for England (see www.hesa.ac.uk/about for more information). Jisc is a Controller of your information.

Reference to “your provider” refers to the higher education provider which you attend. This notice relates to information about you which will be collected by your provider and passed to Jisc and to other organisations as described below.

This notice is applicable to the 2022/23 academic year. It is also applicable to data collected in previous academic years and retained by Jisc. See Categories of information submitted to Jisc, including Special Categories of data, below, for more information about the categories of data that will be collected in 2022/23 and that have been collected by HESA in previous years and have been transferred to Jisc.

Review and updates to this Notice

This notice sets out information about Jisc and other Controllers of your data, how and why they process your data, the legal bases for this processing, and your rights under data protection legislation. This notice is regularly reviewed and updated, for example when organisations change their name, or to clarify how your information is used. Updates may be made at any time, and you will always find the most up to date version at www.hesa.ac.uk/fpn.

Third party privacy information

Throughout this privacy notice we will link to the privacy documentation of the organisations with whom we share your information.

We will hyperlink the relevant privacy notices throughout to enable you to see how each recipient organisation processes your information. To access an organisation’s privacy page, simply click on the name of the organisation within each section.

Submission of your information to Jisc
Data about you will be supplied to Jisc for the purposes set out below. All information is used in compliance with data protection legislation.

Every year your provider will send some of the information it holds about you to Jisc (“your HESA Information”). Jisc is an official source of data about UK higher education. Jisc is a registered charity and operates on a not-for-profit basis.

Your HESA Information is used for a variety of purposes by Jisc and by third parties as described below. Jisc may charge other organisations to whom it provides services and data. Uses of your HESA Information may include linking parts of it to other information, as described below. Information provided to Jisc is retained indefinitely for statistical research purposes. Your HESA Information will not be used to make automated decisions about you. The extent to which your HESA Information will be used for purposes 4-5 and 8 will vary.

Jisc processes information about UK and other nationals, including EU nationals. Accordingly, all uses of HESA Information must comply with the General Data Protection Regulation (“GDPR”) (including UK and EU versions) and the Data Protection Act 2018.

Processing of your personal data throughout the development of Data Futures
Jisc is developing a new system (the HDP) and a new data model for collecting student information through a development programme called Data Futures. More information about this programme of work can be found here: www.hesa.ac.uk/innovation/data-futures.

If your HESA Information is processed as part of this programme it will be used by Jisc and your provider to participate in a pilot of the new system and/or to check the accuracy of the new data model. Specifically, your HESA Information will be used by Jisc, your provider, and higher education funding and regulatory bodies participating in the Data Futures programme to:

evaluate the new data model; and
evaluate system functionality (including how the new system interacts with pilot participants’ systems and with existing legacy systems that process HESA information).

If your HESA Information is used as part of the Data Futures programme, then it will be deleted from that programme within 6 months of the end of the relevant testing phase.

In 2022/23 it is envisaged that the Data Futures programme will move from pilot phase to live collection via the HDP. Therefore, your HESA Information may also be processed via the HDP for live collection purposes and will be processed and retained pursuant to Purposes 1 and 2 below.

As the purpose of the Data Futures programme is to enable Jisc to have a platform suitable for the public functions of the higher education sector, the lawful bases for this processing can be found in Purpose 1 (below). Processing relating to migrating data held within the permanent records of HESA Information to the new Data Futures data model is carried out under Purpose 8.

Categories of information submitted to Jisc, including Special Categories of data
Jisc collects data about the personal characteristics of students and information about their studies and qualifications. This might include sensitive details about students’ personal lives used for equality and diversity monitoring.

Data submitted to Jisc by your provider includes details about the course you are studying, and any qualifications awarded to you during the academic year. It also includes personal data - such as your name and date of birth, your prior qualifications, and where you lived before and during your course.

Information about your health, disability status, ethnicity, sexual orientation, gender reassignment or religion are classed as ‘Special Categories of data’ under the GDPR. Any special category data supplied to Jisc by your provider as part of their submission will be included in your HESA Information.

This information is necessary for monitoring equality of opportunity and eliminating unlawful discrimination in accordance with the Equality Act 2010 and Section 75 of the Northern Ireland Act 1998 or equivalent subsequent legislation, or for other research purposes falling within GDPR Article 9(2)(j). This information will also be processed for statistics and statistical research.

Some other information is used to enable research into the provision of fair access to higher education, for example information as to whether you are a care leaver. If your provider is in England, your HESA Information may include details of any financial support you may receive from your higher education provider.

A full list of data items that may be included in your HESA Information for the 2022/23 academic year will be available from October 2022 here: https://codingmanual.hesa.ac.uk/22056/.

- Please note that not all data items are collected for all students.

If you were a student in a previous academic year, a full list of data items that may be included in your HESA Information can be found below. Please note that multiple academic years are likely to apply to your HESA Information depending on the length of your initial course(s) and of any further study.

If you need any assistance in identifying which records your HESA Information may be included in, please contact [email protected] for guidance.

Student Record	Student Alternative Record (formerly known as AP Student Record)	Initial Teacher Training Record (ITT)
21/22 20/21 19/20 18/19 17/18 16/17 15/16 14/15 13/14 12/13 11/12 10/11 09/10 08/09 07/08 06/07 05/06 04/05 03/04 02/03 01/02 00/01 99/00 98/99 97/98 96/97 95/96 94/95	21/22 20/21 19/20 18/19 17/18 16/17 15/16 14/15	21/22 20/21 19/20 18/19 17/18 16/17 15/16 14/15 13/14 12/13 11/12 10/11 09/10 08/09

In addition to the above, The Universities and Colleges Admissions Service (‘UCAS’) will send some information it holds about you to us to support our UK-wide public functions, to collect and disseminate higher education information.

It may be necessary to share data we receive from UCAS with your higher education provider to assist with validation and additional quality assurance steps, including for the Data Futures programme.

For more information on uses of your UCAS data see https://www.hesa.ac.uk/about/regulation/data-protection/ucas-data.

Purpose 1 – Named data used for public functions by the HE funding and regulatory bodies
Your HESA Information is used by HE funding and regulatory bodies (who request Jisc to collect it) for their statutory and/or public functions including funding, regulation and policy-making purposes. Your information is provided by reference to your name, but your information will not be used to make decisions about you, except as described in Purpose 3 below.

Jisc shares your HESA Information with the HE funding and regulatory body(s) who request Jisc to collect it and require it to carry out their statutory and/or public functions. This data sharing is carried out in the public interest or in the exercise of official authority vested in Jisc and the funding and regulatory bodies. Jisc has been appointed as the designated data body for England under the Higher Education and Research Act 2017. The HE funding and regulatory bodies are:

England - Office for Students (who take into account what would be helpful to collect for sharing with UK Research and Innovation and the Secretary of State)
Wales - Higher Education Funding Council for Wales
Scotland - Scottish Funding Council
Northern Ireland - Department for the Economy

Your HESA Information will be shared with these organisations as part of a large dataset which contains similar information about other people who have followed higher education courses in the UK. These organisations are also Controllers of your HESA Information. This means that they make their own decisions about how to use it, and this may include publishing statistics, carrying out quality assurance, and sharing the information with third parties, such as other government or public bodies or other organisations of the type listed elsewhere in this collection notice. However, all uses of your HESA Information are within the purposes set out in this collection notice and covered by data sharing agreements with Jisc.

These organisations may retain HESA Information indefinitely for statistical and research purposes.

Legal basis for processing your information for Purpose 1

Processing of your HESA Information is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Jisc (see GDPR Article 6(1)(e)).

Processing of Special Categories of data is necessary for reasons of substantial public interest in accordance with the Equality Act (Article 9(2)(g), UK GDPR and paragraph 8, part 2, schedule 1, Data Protection Act 2018); and necessary for statistical and research purposes in accordance with Article 89(1) and research purposes based on the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, or the Digital Economy Act 2017 or equivalent subsequent legislation, or for other research purposes (Article 9(2)(j), UK GDPR, and paragraph 4, part 1, schedule 1, Data Protection Act 2018).

Purpose 2 – Named data used for public functions by public authorities
Jisc acts as an information hub to provide data and statistics on higher education. While the bodies described in Purpose 1 (above) have legal or regulatory power to require information from certain higher education providers, other public authorities also use your HESA Information for their statutory and/or public functions including funding, regulation and policy-making purposes.

Education statistics and data

Jisc also acts as an information hub to provide information on higher education. In England, this is undertaken outside of Jisc’s designated data body activities. Jisc shares your HESA Information with public authorities who require it to carry out their statutory and/or public functions. This data sharing is carried out in the public interest or in the exercise of official authority vested in Jisc and the public authorities. Your HESA Information will be shared with these organisations as part of a large dataset which contains similar information about other people who have followed higher education courses in the UK.

These organisations become Controllers upon receipt of your HESA Information. This means that they make their own decisions about how to use it, and this may include publishing statistics and sharing the information with third parties, such as other government or public bodies or other organisations of the type listed elsewhere in this collection notice. However, all uses that they make of your HESA Information will be within the purposes set out in this collection notice and covered by data sharing agreements with Jisc. These organisations will not use the data for the purposes of distinguishing your individual record or to take decisions about you, except as described in Purpose 3 below. These organisations may retain HESA Information indefinitely for statistical and research purposes, or for fixed terms depending on the terms of their data sharing agreements with Jisc.

The HE funding and regulatory bodies who receive information not collected under their relevant power, but who need it for their functions, are:

Office for Students (for example, the OfS have power to collect information from providers in England, but also need information about providers in other parts of the UK for their public function)
Higher Education Funding Council for Wales
Scottish Funding Council
Department for the Economy (NI)

Education departments in England and the devolved administrations:

Other bodies with public functions connected to education:

Department for Business, Energy and Industrial Strategy
UK Research and Innovation (UKRI) (and Research England)
Teaching Regulation Agency
National Health Service bodies and organisations working with them e.g. Health Education England, Department of Health and Social Care and NHS Education Scotland
General Medical Council
UCAS
Office for National Statistics

and any successor bodies. Further Controllers may be added to the list from time to time – please see the online version of this notice at www.hesa.ac.uk/fpn.

Other uses of named data
Your HESA Information may also be used by some organisations who are also Controllers who carry out statistical and research tasks in the public interest or in the exercise of official authority that are not connected with education. Such uses may include the following:

Production of statistics in relation to the population of the UK and for statistical research, undertaken by the Office for National Statistics. Further information can be found on the ONS website.
Production of statistics and statistical research undertaken by National Records of Scotland and the Northern Ireland Statistics and Research Agency.
Monitoring of public expenditure by the National Audit Office.

The above list of organisations who may receive your HESA Information will be subject to change over time. For example, Jisc is seeking to reduce the burden on higher education providers by encouraging other organisations who currently collect information about students direct from higher education providers to collect and receive information through Jisc. The above list will be updated from time to time and can be found at www.hesa.ac.uk/fpn. You will need to monitor this link yourself if you wish to be aware of changes.

Legal basis for processing your information for Purpose 2

Processing of your HESA Information is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Jisc (See GDPR Article 6(1)(e)).

Processing of Special Categories of data is necessary for reasons of substantial public interest in accordance with the Equality Act (Article 9(2)(g), UK GDPR and paragraph 8, part 2, schedule 1, Data Protection Act 2018); and necessary for statistical and research purposes in accordance with Article 89(1) and research purposes based on the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, or the Digital Economy Act 2017 or equivalent subsequent legislation, or for other research purposes (Article 9(2)(j), UK GDPR, and paragraph 4, part 1, schedule 1, Data Protection Act 2018).

Purpose 3 - Administrative uses
Your named data may be processed by Jisc for administrative purposes or by public authorities for the detection or prosecution of fraud. The uses of your HESA Information by public authorities may result in decisions being made about you.

Jisc Administrative Uses

HUSID look-up service – If you have been included in the Student record in previous years, your current higher education provider may use the HESA look-up service to validate your student identifier (referred to as your HUSID). More information on this service can be found here: https://www.hesa.ac.uk/support/tools-and-downloads/husid. Please note that HESA is now part of Jisc. Jisc is the controller of the HUSID look up service processing.

Changing provider during your higher education studies – If during your study with a higher education provider, you transfer to another higher education provider or your course is delivered in collaboration with another higher education provider, it may be necessary for Jisc to share information about you with your new provider to ensure you are correctly included in their relevant data submission to Jisc. Jisc may also be required to inform your previous provider that you are now studying elsewhere.

External Administrative Uses

In the exercise of their official authority, it may be necessary for the UK higher education funding and regulatory bodies listed in Purposes 1 and 2 to use your HESA Information which is passed to them for Purposes 1 and 2 to identify you and take decisions about you as an individual for the following purposes only:

Medical Qualification checking – It may be necessary for the GMC to use your HESA Information which is passed to them for Purpose 2 to identify you for the purpose of checking your Advanced Knowledge Test qualification.

Fraud detection and prevention - Your HESA Information may be used to audit claims to public funding and student finance, and to detect and prevent fraud. This may include sharing your Information with other Controllers (for example the Student Loans Company, Pearson Education).

Previous study - If your higher education provider is in England: The Office for Students may share your previous education records with this provider, including HESA Information submitted by other higher education providers, to determine the nature of any prior higher education study, including your current qualifications. This may be used to make decisions about the fees you are required to pay, the support available to you or the availability of a place for you to study with a higher education provider. The Office for Students may also share the fact you are studying with a new provider with your previous provider.

For these purposes your HESA Information may be held separately by the OfS (in addition to being held within datasets for Purpose 1) and retained for as long as necessary for the purposes of detection or prosecution of fraud and any associated legal or audit purposes.

Legal basis for processing your information for Purpose 3
Processing of your HESA Information is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Jisc (See GDPR Article 6(1)(e)).

Purpose 4 - Publications
Jisc publishes statistics about students in higher education.

Part of Jisc’s role is to produce and publish information about higher education in the public interest. This includes Official and National Statistics publications (https://uksa.statisticsauthority.gov.uk/about-the-authority/uk-statistical-system/types-of-official-statistics/) and online business intelligence and research services.

When producing this material for publication, Jisc applies a disclosure control, the HESA Standard Rounding Methodology, to ensure that no Personal Data is included and that individuals cannot be identified from published material.

Legal basis for processing your information for Purpose 4

Processing of your HESA Information is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Jisc (See GDPR Article 6(1)(e)).

Processing of Special Categories of data is necessary for reasons of substantial public interest in accordance with the Equality Act (Article 9(2)(g), UK GDPR and paragraph 8, part 2, schedule 1, Data Protection Act 2018); and necessary for statistical and research purposes in accordance with Article 89(1) and research purposes based on the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, or the Digital Economy Act 2017 or equivalent subsequent legislation, or for other research purposes (Article 9(2)(j), UK GDPR, and paragraph 4, part 1, schedule 1, Data Protection Act 2018).

Purpose 5 - Equal opportunity, research, journalism and other processing for statistical and research purposes
HESA Information is used for research into higher education and the student population. This research can be academic, commercial, journalistic or for personal reasons. Jisc prohibits the identification of individual students by those carrying out this research and information is not shared on a named basis with the exception of the processing undertaken by DfE (below).

Jisc and the other Controllers (see Purposes 1 & 2) may also supply information to third parties where there is a legitimate interest in doing so for statistical and research purposes. Examples of use for this purpose include:

Provision of information to students and prospective students
Equal opportunities monitoring
Research - This may be academic research, commercial research or other statistical research where this is in the public interest
Journalism - Where the relevant publication would be in the public interest e.g. league tables
Creation and operation of analysis tools, for example, Heidi Plus

Users to whom information may be supplied for Purpose 5 include:

Higher education sector bodies
Higher education providers
Academic researchers and students
Commercial organisations (e.g. recruitment firms, housing providers, graduate employers)
Unions
Non-governmental organisations and charities
Local, regional and national government bodies
Journalists

Information supplied by Jisc to third parties within Purpose 5 is supplied under contracts which require that individuals shall not be identified from the supplied information, and this means that they also cannot use it to make decisions about you.

A copy of Jisc’s current agreement for the supply of tailored information is available at www.hesa.ac.uk/services/custom/data/timescales-costs. Each agreement specifies the duration for which data may be processed. This is usually one year but may be longer, if necessary, for the specific research purpose. Each request for HESA Information under Purpose 5 is assessed for its compliance with data protection legislation and its compatibility with this collection notice. Jisc ensures that only the minimum amount of HESA Information necessary for the specified research purpose is supplied to users. If the supplied information is to be published the HESA Rounding Methodology or an equivalent disclosure control must be applied to ensure that individuals cannot be identified from the published material. This means that the rounded data does not constitute Personal Data.

A copy of Jisc’s current agreement for access to Heidi Plus is available here. Each agreement specifies the purpose for which the data may be processed.

DfE Data Sharing Service

If you are a student at a provider in England, HESA Information may be linked to school and/or further education college information and supplied or linked to researchers' data through the Office for National Statistics Secure Research Service ('ONS SRS'). In some cases, HESA Information may be shared with researchers directly following this linking activity. This onward sharing to researchers is provided by the DfE Data Sharing Service. DfE are the Controller of the data processed as part of the provision of this service. Copies of the ‘Agreement for the Supply of Linked Data’ and of the ‘Agreement for Making Linked Data available in ONS SRS’ can be requested from [email protected].

DfE Longitudinal Education Outcomes (LEO)

Your HESA Information may be linked to school, college, employment, tax and benefits data by the DfE and may be supplied to researchers by the DfE through the Office for National Statistics Secure Research Service. More information is available from https://www.gov.uk/government/publications/longitudinal-education-outcomes-study-how-we-use-and-share-data.

Other Controllers (listed under Purpose 1 above) may also process data for this purpose where this is necessary to fulfil their public functions.

Legal basis for processing your information for Purpose 5

Processing of your HESA Information is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Jisc (See GDPR Article 6(1)(e)).

Processing may also be necessary for the purposes of the legitimate interests of Jisc in disseminating higher education information, or the legitimate interests of third parties in undertaking research in the field of higher education (See GDPR Article 6(1)(f)).

Processing of Special Categories of data is necessary for reasons of substantial public interest in accordance with the Equality Act (Article 9(2)(g), UK GDPR and paragraph 8, part 2, schedule 1, Data Protection Act 2018); and necessary for statistical and research purposes in accordance with Article 89(1) and research purposes based on the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, or the Digital Economy Act 2017 or equivalent subsequent legislation, or for other research purposes (Article 9(2)(j), UK GDPR, and paragraph 4, part 1, schedule 1, Data Protection Act 2018).

Purpose 6 - Students on Primary Medical Qualification courses only
If you are a student studying for a Primary Medical Qualification (PMQ) Jisc will collect additional data about you at the request of the General Medical Council (GMC), who will use it for the purposes set out below. Jisc will initially be undertaking this collection as Processor. Should Jisc become a Controller of this data, Jisc may also use this data for purposes 2 to 5 and 8.

The GMC is a body with statutory responsibilities for the education, training, and regulation of medical practitioners in the UK. These responsibilities are set out in the Medical Act 1983.

The GMC will use data for the purposes of:

Promoting, maintaining and improving high standards of medical education and training in the UK.
Undertaking research that will allow the GMC to co-ordinate policy across all stages of medical education, including selection to medical school, undergraduate education, postgraduate education, and medical practice. This research is only possible with high quality measures of school performance. More information about how GMC use your data in research projects can be found here: https://www.ukmed.ac.uk/faq#for_doctors_and_medical_students.
The GMC will not use the data collected by Jisc to make decisions about individual students or doctors.

Legal basis for processing your information for Purpose 6

Legal basis for processing your information for Purpose 6 is determined by GMC as controller. More information about how the GMC uses personal data, and its lawful basis for doing so, can be found here https://www.gmc-uk.org/privacy-and-cookies.

Purpose 7 - Students whose information is returned to Jisc on a voluntary basis
If you are a student studying at a higher education provider which has elected to return your data on a voluntary basis Jisc will use this data for purposes 2 to 5 and 8. If this purpose applies in relation to your higher education provider, your provider should inform you of this.

Sometimes an HE provider’s circumstances change so that it isn’t compulsory for it to submit student data to Jisc. In this case, the HE provider and Jisc (following consultation with relevant Statutory Customers) might agree to continue to allow the return of data by the provider for their students where this is considered to be in the public interest. Should the status of the provider change so that it becomes compulsory to submit student data to Jisc, this will be collected under Purpose 1.

Legal basis for processing your information for Purpose 7

Processing of your HESA Information is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Jisc (see GDPR Article 6(1)(e)).

Processing of Special Categories of data is necessary for reasons of substantial public interest in accordance with the Equality Act (Article 9(2)(g), UK GDPR and paragraph 8, part 2, schedule 1, Data Protection Act 2018); and necessary for statistical and research purposes in accordance with Article 89(1) and research purposes based on the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, or the Digital Economy Act 2017 or equivalent subsequent legislation, or for other research purposes (Article 9(2)(j), UK GDPR, and paragraph 4, part 1, schedule 1, Data Protection Act 2018).

Purpose 8 - Use by Jisc to perform its role as designated data body for England and its equivalent roles for the other countries of the United Kingdom
Your HESA Information is processed by Jisc to collect, compile, publish and share data in accordance with this notice. This processing will include processing for purposes such as analysis & research to: review and improve data quality; data accuracy; and the usefulness, context & richness of the data/analysis Jisc produces. It will also be processed to analyse and research the outcomes from education.

Jisc processes your HESA Information as part of a larger statistical dataset for the above purposes to:

Create derived fields to enrich data utility and insights of Jisc data.
Contextualise the use of Jisc data.
Research and understand progression through higher education. This may include linking to survey responses provided in the future as part of the Graduate Outcomes survey: https://www.graduateoutcomes.ac.uk/ and to other datasets for example college data.
Quality assure data and to remove anomalies and improve data accuracy. This may include processing personal data in the context of providing bespoke training to higher education providers to provide analysis and improve data quality.
Research into data quality and the sector’s reliance on time series data.
Check it against information submitted to UCAS to improve data accuracy.
Check it against information submitted to National Student Survey (NSS) to improve data accuracy.
To review how changes and improvements can be made to Jisc’s processing including systems and software and the implications that this would have on the data it produces.

Legal basis for processing your information for Purpose 8

Processing of your HESA Information is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Jisc (See GDPR Article 6(1)(e)).

Processing of Special Categories of data is necessary for reasons of substantial public interest in accordance with the Equality Act (Article 9(2)(g), UK GDPR and paragraph 8, part 2, schedule 1, Data Protection Act 2018); and necessary for statistical and research purposes in accordance with Article 89(1) and research purposes based on the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, or the Digital Economy Act 2017 or equivalent subsequent legislation, or for other research purposes (Article 9(2)(j), UK GDPR, and paragraph 4, part 1, schedule 1, Data Protection Act 2018).

Linking of your HESA Information to other information
HESA Information is sometimes linked to other data sources to enable more detailed research and analysis.

As indicated above, where Jisc and organisations covered by Purposes 1 & 2 use HESA Information this may include linking named or pseudonymised HESA Information to other information for research and data validation purposes. Examples include linking to:

National Student Survey data – to place the results of this survey in context.
School and Further Education data – to research progression to higher education.
Student Loans Company data – to research the use of student finance and to create/validate fields relating to socioeconomic disadvantage.
Student Awards Agency Scotland data - The creation/validity of data fields relating to socioeconomic disadvantage.
Qualification awarding bodies data – to research the value and outcomes of qualifications.
Employment, tax, and benefits data – to research the earnings of graduates and to better understand the outcomes of education (Guidance on the use of HESA records matched to tax, benefits and employment data is available at: www.gov.uk/government/publications/longitudinal-education-outcomes-study-how-we- use-and-share-data).
UCAS data – to understand entry rates to higher education.
UCAS and Higher Education Career Services Unit (HECSU) data – to deliver an information service to support students and prospective students make informed and effective study and career choices.

Medical students - If you are a medical student your HESA Information may be included in the UKMED research database (www.ukmed.ac.uk). The General Medical Council is the Controller for this database used for researching doctors’ progression through their education and training.

Widening Participation Programmes - If you have participated in programmes designed to widen participation in higher education, your HESA Information may be linked to data held by these programmes for research purposes. This may include Higher Education Access Tracker (HEAT), East Midlands Widening Participation Research and Evaluation Partnership (EMWPREP) and Aimhigher West Midlands (AHWM).

Destinations information for schools and colleges – If you attended a school or college in England or Wales linked data may be disclosed by organisations covered by Purposes 1 & 2 to the last school or college you attended (or its successor body) and to Ofsted or Estyn in the exercise of their official authority to enable them to assess the outcomes of secondary education.

Where Jisc provides information from your HESA Information to third parties under Purpose 5, the permitted processing of the information by a third party may include linking HESA Information to other information held by the third party. Permission is considered on a case-by-case basis. It is only given where the linking is for the purposes outlined in Purpose 5 and subject to the requirement not to carry out linking to identify individuals.

The Initial Teacher Training record (“ITT”)
Information about teacher training students in England is submitted to the Department for Education (DfE) and the Teaching Regulation Agency (TRA) via Jisc.

If you are on an ITT course at a higher education provider in England, Jisc will collect additional information about you and provide this to the DfE and TRA. ITT courses are those that lead to Qualified Teacher Status (QTS) or Early Years Teacher Status (EYTS).

The TRA is an executive agency of the DfE and for the purposes of the GDPR, DfE and Jisc are separate Controllers of the ITT record.

DfE will process your personal data in the exercise of its official authority, namely the funding, administration and monitoring of ITT schemes in England. DfE will use your data to establish a record on the Database of Trainee Teachers and Providers (DTTP) and register your course details and subsequent completion.

TRA will process your personal data in the exercise of its official authority, namely the award of QTS and EYTS and the maintenance of the list of teachers in England. TRA will use your data to establish a record on the database of teachers and allocate to you a teacher reference number (TRN). TRA will contact you to provide confirmation of your TRN and any subsequent award of QTS and as part of your statutory induction year.

DfE and TRA may share personal data with your provider, and where the law allows it, or there is a legal requirement for sharing to take place, its partners and contractors for this purpose and may link it to other sources of information about you. Partners include employers of teachers, teacher employment agencies, Ofsted, Capita Teachers’ Pensions and other executive agencies of the DfE.

Legal basis for processing your HESA Information for ITT purposes

Processing of your HESA Information is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Jisc (See GDPR Article 6(1)(e)).

Processing of Special Categories of data is necessary for reasons of substantial public interest in accordance with the Equality Act (Article 9(2)(g), UK GDPR and paragraph 8, part 2, schedule 1, Data Protection Act 2018); and necessary for statistical and research purposes in accordance with Article 89(1) and research purposes based on the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, or the Digital Economy Act 2017 or equivalent subsequent legislation, or for other research purposes (Article 9(2)(j), UK GDPR, and paragraph 4, part 1, schedule 1, Data Protection Act 2018).

Student and leaver surveys
You may be asked to provide information about your experience as a student and your activities after you graduate as part of national surveys.

Your contact details may be passed to survey contractors to carry out the National Student Survey (NSS), other surveys of students’ views about their study, and surveys of student finances, on behalf of some of the organisations listed under Purposes 1 & 2 above.

Your provider will hold your contact details after you graduate in order for you to be contacted to complete the Graduate Outcomes survey. Your contact details will be passed to Jisc and the organisation(s) contracted by Jisc to assist it to undertake the Graduate Outcomes survey. Jisc’s contractors will only use your contact details for the survey and will delete them when the survey is closed. Jisc may hold your contact details for further Graduate Outcomes surveys or administration of the survey data where these are in the public interest. Your responses to the Graduate Outcomes survey will be made available to your provider, and your provider may choose to add additional questions to the survey for their own use.

Further privacy and data protection information will be provided if you are contacted for any of these surveys. The privacy information for Graduate Outcomes is available on the Graduate Outcomes website. You might also be contacted as part of an audit to check that a survey has been undertaken properly.

Legal basis for processing your information to conduct national surveys

Processing of your information to conduct the student and graduate surveys is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Jisc (See GDPR Article 6(1)(e)).

Processing of Special Categories of data is necessary for reasons of substantial public interest in accordance with the Equality Act (Article 9(2)(g), UK GDPR and paragraph 8, part 2, schedule 1, Data Protection Act 2018); and necessary for statistical and research purposes in accordance with Article 89(1) and research purposes based on the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, or the Digital Economy Act 2017 or equivalent subsequent legislation, or for other research purposes (Article 9(2)(j), UK GDPR, and paragraph 4, part 1, schedule 1, Data Protection Act 2018).

Further information about recipients of your HESA Information

Jisc publishes a register containing information relating to the recipients to whom we disclose data for statistical purposes. The live register can be found here: https://www.hesa.ac.uk/about/regulation/data-protection/register.

Your rights
Data protection legislation gives you rights over your personal data. These include rights to know what information is processed about you and how it is processed. These rights have to be met by Jisc and any other organisation which takes decisions about how or why your information is processed.

You have the right to be informed about how your personal data is used. This Student collection notice is regularly reviewed to ensure that it accurately describes how your HESA Information is used. This notice may be updated from time to time, for example when new legislation is enacted, or when new policies are implemented by the public authorities listed under Purposes 1 & 2. The most up to date version can always be found at www.hesa.ac.uk/fpn.

For further information about data protection, including contact details for Jisc’s Data Protection Officer please see www.hesa.ac.uk/dataprot. If you have questions about how your HESA Information is used, please contact [email protected].

Under the GDPR you have the right of access to your personal information and the right to rectify inaccurate information; the right to erasure; restrict processing; and object to processing. These rights are limited in certain circumstances. If you think there is a problem with the way Jisc is handling your data, you have the right to complain to the Information Commissioner's Office: ico.org.uk/.

Data transfers to other countries
Your HESA Information may be transferred to countries outside the UK and the European Union for the purposes described above.

Your HESA Information will only be transferred to countries whose data protection laws have been assessed as adequate, or where adequate safeguards (in almost all cases, standard data protection clauses), are in place to protect your HESA Information. To obtain a copy of these safeguards or if you have any questions about how your HESA Information is used, please contact [email protected].

8 July 2021 to 6 June 2022

Student collection notice 2021-2022

HESA_Student_Collection_Notice_2021-22.pdf
Hysbysiad_Casglu_i_Fyfyrwyr_HESA_2021-22.pdf

The Higher Education Statistics Agency Limited (HESA) is the body responsible for collecting and disseminating information about higher education in the UK and the designated data body for England (see www.hesa.ac.uk/about for more information). HESA is a Controller of your information.

Reference to “your provider” refers to the higher education provider which you attend. This notice relates to information about you which will be collected by your provider and passed to HESA and to other organisations as described below.

This notice is applicable to the 2021/22 academic year. It is also applicable to data collected in previous academic years and retained by HESA. See Categories of information submitted to HESA, including Special Categories of data, below, for more information about the categories of data that will be collected in 2021/22 and that have been collected in previous years.

Review and Updates to this Notice

This notice sets out information about HESA and other Controllers of your data, how and why they process your data, the legal bases for this processing, and your rights under data protection legislation. This notice is regularly reviewed and updated, for example when organisations change their name, or to clarify how your information is used. Updates may be made at any time and you will always find the most up to date version at www.hesa.ac.uk/fpn.

Submission of your information to HESA

Data about you will be supplied to HESA for the purposes set out below. All information is used in compliance with data protection legislation.

Every year your provider will send some of the information it holds about you to HESA (“your HESA information”). HESA is an official source of data about UK higher education. HESA is a registered charity and operates on a not-for-profit basis.

Your HESA information is used for a variety of purposes by HESA and by third parties as described below. HESA may charge other organisations to whom it provides services and data. Uses of your HESA information may include linking parts of it to other information, as described below. Some information provided to HESA is retained indefinitely for statistical research purposes. Your HESA information will not be used to make automated decisions about you. The extent to which your HESA information will be used for purposes 4-5 and 8 will vary.

HESA processes information about UK and other nationals, including EU nationals. Accordingly, all uses of HESA information must comply with the General Data Protection Regulation (“GDPR”) (including UK and EU versions) and the Data Protection Act 2018.

HESA is developing a new system and a new data model for collecting student information through a programme called Data Futures. More information about this programme of work can be found here: www.hesa.ac.uk/innovation/data-futures. If your HESA information is processed as part of this programme it will be used by HESA and your provider to participate in a pilot of the new system and/or to check the accuracy of the new data model. Specifically, your HESA information will be used by HESA, your provider, and higher education funding and regulatory bodies participating in the Data Futures programme:

in order to evaluate the new data model, the data to be used within and produced by the new system; and
in order to evaluate system functionality (including how the new system interacts with pilot participants’ systems and with HESA’s existing legacy systems).

If your HESA information is used as part of the Data Futures programme, then it will be deleted from that programme within 6 months of the end of the relevant testing phase.

As the purpose of the Data Futures programme is to enable HESA to have a platform suitable for the public functions of the higher education sector, the lawful bases for this processing can be found in Purpose 1 (below). Processing relating to migrating data held within HESA’s permanent records to the new Data Futures data model is carried out under Purpose 8.

Categories of information submitted to HESA, including special categories of data

HESA collects data about the personal characteristics of students and information about their studies and qualifications. This might include sensitive details about students’ personal lives used for equality and diversity monitoring.

Data submitted to HESA by your provider includes details about the course you are studying, and any qualifications awarded to you during the academic year. It also includes details about you - such as your name and date of birth, your prior qualifications, and where you lived before and during your course.

Information about your health, disability status, ethnicity, sexual orientation, gender reassignment or religion are classed as ‘Special Categories of data’ under the GDPR. If your provider discloses this information to HESA, it will be included in your HESA information. This information is necessary for monitoring equality of opportunity and eliminating unlawful discrimination in accordance with the Equality Act 2010 and Section 75 of the Northern Ireland Act 1998 or equivalent subsequent legislation, or for other research purposes falling within GDPR Article 9(2)(j). This information will also be processed for statistics and statistical research. Your information will not be used to make decisions about you.

Some other information is used to enable research into the provision of fair access to higher education, for example information as to whether you are a care leaver. If your provider is in England your HESA information may include details of any financial support, you may receive from your higher education provider.

A full list of data items that may be included in your HESA information for the 2021/22 academic year will be available from October 2021 here: www.hesa.ac.uk/collection/c21051/.

- Please note that not all data items are collected for all students.

If you were a student in a previous academic year, a full list of data items that may be included in your HESA information can be found below. Please note that multiple academic years are likely to apply to your HESA information depending on the length of your initial course(s) and of any further study.

If you need any assistance in identifying which records your HESA information may be included in, please contact [email protected] for guidance.

Student Record	Student Alternative Record (formerly known as AP Student Record)	Initial Teacher Training Record (ITT)
Student 20/21 Student 19/20 Student 18/19 Student 17/18 Student 16/17 Student 15/16 Student 14/15 Student 13/14 Student 12/13 Student 11/12 Student 10/11 Student 09/10 Student 08/09 Student 07/08 Student 06/07 Student 05/06 Student 04/05 Student 03/04 Student 02/03 Student 01/02 Student 00/01 Student 99/00 Student 98/99 Student 97/98 Student 96/97 Student 95/96 Student 94/95	AP Student 20/21 AP Student 19/20 AP Student 18/19 AP Student 17/18 AP student 16/17 AP student 15/16 AP student 14/15	ITT 21/22 ITT 20/21 ITT 19/20 ITT 18/19 ITT 17/18 ITT 16/17 ITT 15/16 ITT 14/15 ITT 13/14 ITT 12/13 ITT 11/12 ITT 10/11 ITT 09/10 ITT 08/09

Purpose 1 – Named data used for public functions by the HE funding and regulatory bodies

Your HESA information is used by HE funding and regulatory bodies (who request HESA to collect it) for their statutory and/or public functions including funding, regulation and policy-making purposes. Your information is provided by reference to your name, but your information will not be used to make decisions about you.

HESA shares your HESA information with the HE funding and regulatory body(s) who request HESA to collect it and require it to carry out their statutory and/or public functions. This data sharing is carried out in the public interest or in the exercise of official authority vested in HESA and the funding and regulatory bodies. HESA has been appointed as the designated data body for England under the Higher Education and Research Act 2017. The HE funding and regulatory bodies are:

England - Office for Students (who take into account what would be helpful to collect for sharing with UK Research and Innovation and the Secretary of State)
Wales - Higher Education Funding Council for Wales
Scotland - Scottish Funding Council
Northern Ireland - Department for the Economy

Your HESA information will be shared with these organisations as part of a large dataset which contains similar information about other people who have followed higher education courses in the UK. These organisations are also Controllers of your HESA information. This means that they make their own decisions about how to use it, and this may include publishing statistics and sharing the information with third parties, such as other government or public bodies or other organisations of the type listed elsewhere in this collection notice. However, all uses of your HESA information will be within the purposes set out in this collection notice and covered by data sharing agreements with HESA.

These organisations will not use the data for the purposes of identifying you as an individual or to take decisions about you. These organisations may retain HESA information indefinitely for statistical and research purposes.

Legal basis for processing your information for Purpose 1

Legal basis for processing your information for Purpose 1 – these cover use of personal data by both HESA and the HE funding and regulatory bodies as data Controllers:

Processing of your HESA information for Purpose 1 is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller (see GDPR Article 6(1)(e)) and for statistical and research purposes (see GDPR Article 89).

Processing may also be necessary for compliance with a legal obligation to which the Controller may be subject (see GDPR Article 6(1)(c)).

Processing of Special Categories of data is necessary for statistical and research purposes in accordance with GDPR Article 89(1) in accordance with the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, the Digital Economy Act 2017 or equivalent subsequent legislation, or for other research purposes falling within GDPR Article 9(2)(j).

Processing of Special Categories of data may also be necessary for reasons of substantial public interest in accordance with the Equality Act 2010 or equivalent subsequent legislation (see GDPR Article 9(2)(g)).

Purpose 2 - Named data used for public functions by public authorities

HESA acts as an information hub to provide data and statistics on higher education. While the bodies described in Purpose 1 (above) have legal or regulatory power to require information from certain higher education providers, other public authorities also use your HESA information for their statutory and/or public functions including funding, regulation and policy-making purposes.

Education statistics and data

HESA also acts as an information hub to provide information on higher education. In England, this is undertaken outside of HESA’s designated data body activities. HESA shares your HESA information with public authorities who require it to carry out their statutory and/or public functions. This data sharing is carried out in the public interest or in the exercise of official authority vested in HESA and the public authorities. Your HESA information will be shared with these organisations as part of a large dataset which contains similar information about other people who have followed higher education courses in the UK.

These organisations are also Controllers of your HESA information. This means that they make their own decisions about how to use it, and this may include publishing statistics and sharing the information with third parties, such as other government or public bodies or other organisations of the type listed elsewhere in this collection notice. However, all uses that they make of your HESA information will be within the purposes set out in this collection notice and covered by data sharing agreements with HESA. These organisations will not use the data for the purposes of identifying you as an individual or to take decisions about you, except as described in Purpose 3 below. These organisations may retain HESA information indefinitely for statistical and research purposes, or for fixed terms depending on the terms of their data sharing agreements with HESA.

The HE funding and regulatory bodies who receive information not collected under their relevant power, but who need it for their functions, are:

Office for Students (for example, the OfS have power to collect information from providers in England, but also need information about providers in other parts of the UK for their public function)
Higher Education Funding Council for Wales
Scottish Funding Council
Department for the Economy

Education departments in England and the devolved administrations:

Other bodies with public functions connected to education:

Department for Business, Energy and Industrial Strategy
UK Research and Innovation
Teaching Regulation Agency
National Health Service bodies and organisations working with them e.g. Health Education England and Department of Health and Social Care
General Medical Council
UCAS

and any successor bodies. Further Controllers may be added to the list from time to time – please see the online version of this notice at www.hesa.ac.uk/fpn.

Other uses of named data
Your HESA information may also be used by some organisations who are also Controllers who carry out statistical and research tasks in the public interest or in the exercise of official authority that are not connected with education. Such uses may include the following:

Production of statistics in relation to the population of the UK and for statistical research, undertaken by the Office for National Statistics. Further information can be found on the ONS website.
Production of statistics and statistical research undertaken by National Records of Scotland and the Northern Ireland Statistics and Research Agency.
Monitoring of public expenditure by the National Audit Office.

The above list of organisations who may receive your HESA information will be subject to change over time. For example, HESA is seeking to reduce the burden on higher education providers by encouraging other organisations who currently collect information about students direct from higher education providers to collect and receive information through HESA. The above list will be updated on the HESA website at www.hesa.ac.uk/fpn from time to time, and you will need to monitor this link yourself if you wish to be aware of changes.

Legal basis for processing your information for Purpose 2

Processing of your HESA information for Purpose 2 is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller (See GDPR Article 6(1)(e)) and for statistical and research purposes (See GDPR Article 89).

Processing of Special Categories of data is necessary for statistical and research purposes in accordance with GDPR Article 89(1) in accordance with the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, the Digital Economy Act 2017 or equivalent subsequent legislation, or for other research purposes falling within GDPR Article 9(2)(j).

Processing of Special Categories of data may also be necessary for reasons of substantial public interest in accordance with the Equality Act 2010 or equivalent subsequent legislation (see GDPR Article 9(2)(g)).

Purpose 3 - Administrative uses

Your named data may be processed by HESA for administrative purposes or by public authorities for the detection or prosecution of fraud. The uses of your HESA information by public authorities may result in decisions being made about you.

HESA Administrative Uses

HUSID look-up service – If you have been included in the Student record in previous years, your current higher education provider may use HESA’s look-up service to validate your student identifier (referred to as your HUSID). More information on HESA’s look-up service can be found here: https://www.hesa.ac.uk/support/tools-and-downloads/husid.

Changing provider during your higher education studies – If during your study with a higher education provider, you transfer to another higher education provider or your course is delivered in collaboration with another higher education provider, it may be necessary for HESA to share information about you with your new provider to ensure you are correctly included in their relevant data submission to HESA. HESA may also be required to inform your previous provider that you are now studying elsewhere.

External Administrative Uses

In the exercise of their official authority it may be necessary for the UK higher education funding and regulatory bodies listed in Purposes 1 and 2 to use your HESA information which is passed to them for Purposes 1 and 2 to identify you and take decisions about you as an individual for the following purposes only:

Fraud detection and prevention - Your HESA information may be used to audit claims to public funding and student finance, and to detect and prevent fraud. This may include sharing your information with other Controllers (for example the Student Loans Company, Pearson Education).

Previous study - If your higher education provider is in England: The Office for Students may share your previous education records with this provider, including HESA information submitted by other higher education provider, to determine the nature of any prior higher education study, including your current qualifications. This may be used to make decisions about the fees you are required to pay, the support available to you or the availability of a place for you to study with a higher education provider. The Office for Students may also share the fact you are studying with a new provider with your previous provider.

For these purposes your HESA information may be held separately (in addition to being held within data sets for Purpose 1) and retained for as long as necessary for the purposes of detection or prosecution of fraud and any associated legal or audit purposes.

Legal basis for processing your information for Purpose 3
Processing of your HESA information for Purpose 3 is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller (See GDPR Article 6(1)(e)).

Purpose 4 - HESA publications

HESA publishes statistics about students in higher education.

Part of HESA’s role is to produce and publish information about higher education in the public interest. This includes Official and National Statistics publications (https://uksa.statisticsauthority.gov.uk/about-the-authority/uk-statistical-system/types-of-official-statistics/) and online business intelligence and research services.

When producing this material for publication, HESA applies its disclosure control, the HESA Standard Rounding Methodology, to ensure that no Personal Data is included and that individuals cannot be identified from published material.

Legal basis for processing your information for Purpose 4

Processing of your HESA information for Purpose 4 is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller (See GDPR Article 6(1)(e)) and for statistical and research purposes (See GDPR Article 89).

Processing of Special Categories of personal data is necessary for statistical and research purposes in accordance with Article 89(1) based on the Equality Act 2010 and Section 75 of the Northern Ireland Act 1998 (See GDPR Article 9(2)(j)).

Purpose 5 - Equal opportunity, research, journalism and other processing for statistical and research purposes

HESA information is used for research into higher education and the student population. This research can be academic, commercial, journalistic or for personal reasons. HESA prohibits the identification of individual students by those carrying out this research and information is not shared on a named basis.

HESA and the other Controllers (see Purposes 1 & 2) may also supply information to third parties where there is a legitimate interest in doing so for statistical and research purposes. Examples of use for this purpose include:

Provision of information to students and prospective students
Equal opportunities monitoring
Research - This may be academic research, commercial research or other statistical research where this is in the public interest
Journalism - Where the relevant publication would be in the public interest e.g. league tables
Creation and operation of analysis tools, for example, Heidi Plus

Users to whom information may be supplied for Purpose 5 include:

Higher education sector bodies including Jisc
Higher education providers
Academic researchers and students
Commercial organisations (e.g. recruitment firms, housing providers, graduate employers)
Unions
Non-governmental organisations and charities
Local, regional and national government bodies
Journalists

Information supplied by HESA to third parties within Purpose 5 is supplied under contracts which require that individuals shall not be identified from the supplied information and this means that they also cannot use it to make decisions about you.

A copy of HESA’s current agreement for the supply of tailored information is available at www.hesa.ac.uk/services/custom/data/timescales-costs. Each agreement specifies the duration for which data may be processed. This is usually one year but may be longer, if necessary, for the specific research purpose. Each request for HESA information under Purpose 5 is assessed for its compliance with data protection legislation and its compatibility with this collection notice. HESA ensures that only the minimum amount of HESA information necessary for the specified research purpose is supplied to users. If the supplied information is to be published HESA's Rounding Methodology or an equivalent disclosure control must be applied to ensure that individuals cannot be identified from the published material and it does not constitute Personal Data.

A copy of HESA’s current agreement for access to Heidi Plus is available here. Each agreement specifies the purpose for which the data may be processed.

If you are a student at a provider in England, HESA information may be linked to school and/or further education college information and supplied to researchers either through direct supply to the researcher’s organisation or through the Office for National Statistics Secure Research Service. This onward sharing to researchers is provided by the DfE Data Sharing Service. Copies of the ‘Agreement for the Supply of Linked Data’ and of the ‘Agreement for Making Linked Data available in ONS SRS’ can be requested from [email protected].

Your HESA information may be linked to school, college, employment, tax and benefits data by the Department for Education and may be supplied to researchers by the Department for Education through the Office for National Statistics Secure Research Service. More information is available from https://www.gov.uk/government/publications/longitudinal-education-outcomes-study-how-we-use-and-share-data.

Processing within this Purpose 5 is carried out by HESA. Other Controllers (listed under Purpose 1 above) may also process data for this purpose where this is necessary to fulfil their public functions.

Legal basis for processing your information for Purpose 5

Processing of your HESA information for Purpose 5 is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller (See GDPR Article 6(1)(e)).

Processing may also be necessary for the purposes of the legitimate interests of HESA in disseminating higher education information, or the legitimate interests of third parties in undertaking research in the field of higher education (See GDPR Article 6(1)(f)).

In either case processing of your HESA information is necessary for statistical and research purposes in accordance with GDPR Article 89(1).

Processing of Special Categories of personal data is necessary for statistical and research purposes in accordance with Article 89(1) based on the duties in the Equality Act 2010 and Section 75 of the Northern Ireland Act 1998 (See GDPR Article 9(2)(j)).

Purpose 6 - Students on Primary Medical Qualification courses only

If you are a student studying for a Primary Medical Qualification (PMQ) HESA will collect additional data about you at the request of the General Medical Council (GMC), who will use it for the purposes set out below. HESA will initially be undertaking this collection as processor. Should HESA become a Controller of this data, HESA may also use this data for purposes 2 to 5 and 8.

The GMC is a body with statutory responsibilities for the education, training, and regulation of medical practitioners in the UK. These responsibilities are set out in the Medical Act 1983. More information about how the GMC uses personal data can be found here https://www.gmc-uk.org/privacy-and-cookies.

The GMC will use data for the purposes of:

Promoting, maintaining and improving high standards of medical education and training in the UK.
Undertaking research that will allow the GMC to co-ordinate policy across all stages of medical education, including selection to medical school, undergraduate education, postgraduate education, and medical practice. This research is only possible with high quality measures of school performance. More information about how GMC use your data in research projects can be found here: www.ukmed.ac.uk/faq#for_medical_students.
The GMC will not use the data collected by HESA to make decisions about individual students or doctors.

Legal basis for processing your information for Purpose 6

Legal basis for processing your information for Purpose 6 – these cover use of personal data by both HESA and GMC as data Controllers:

Processing of your HESA information for Purpose 6 is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller (see GDPR Article 6(1)(e)) and for statistical and research purposes (see GDPR Article 89).

Processing of Special Categories of data is necessary for statistical and research purposes in accordance with GDPR Article 89(1) in accordance with the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, the Digital Economy Act 2017 or equivalent subsequent legislation, or for other research purposes falling within GDPR Article 9(2)(j).

Purpose 7 - Students whose information is returned to HESA on a voluntary basis

If you are a student studying at a higher educaton provider which has elected to return your data on a voluntary basis HESA will use this data for purposes 2 to 5 and 8. If this purpose applies in relation to your higher education provider, your provider should inform you of this.

Sometimes an HE provider’s circumstances change so that it isn’t compulsory for it to submit student data to HESA. In this case, the HE provider and HESA (following consultation with relevant Statutory Customers) might agree to continue to allow the return of data by the provider for their students where this is considered to be in the public interest. Should the status of the provider change so that it becomes compulsory to submit student data to HESA, this will be collected under Purpose 1.

Legal basis for processing your information for Purpose 7

Legal basis for processing your information for Purpose 7 – these cover use of personal data by both HESA and the organisations who receive the data under Purpose 2:

Processing of your HESA information for Purpose 7 is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller (see GDPR Article 6(1)(e)) and for statistical and research purposes (see GDPR Article 89).

Processing of Special Categories of data is necessary for statistical and research purposes in accordance with GDPR Article 89(1) in accordance with the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, the Digital Economy Act 2017 or equivalent subsequent legislation, or for other research purposes falling within GDPR Article 9(2)(j).

Processing of Special Categories of data may also be necessary for reasons of substantial public interest in accordance with the Equality Act 2010 or equivalent subsequent legislation (see GDPR Article 9(2)(g)).

Purpose 8 - Use by HESA to perform its role as designated data body for England and its equivalent roles for the other countries of the United Kingdom

Your HESA information is processed by HESA to collect, compile, publish and share data in accordance with this notice. This processing will include processing for purposes such as analysis & research to: review and improve data quality; data accuracy; and the usefulness; context & richness of the data/analysis HESA produces. It will also be processed to analyse and research the outcomes from education.

HESA processes your HESA information as part of a larger statistical dataset for the above purposes to:

Create derived fields to enrich data utility and insights of HESA data.
Contextualise the use of HESA data.
Research and understand progression through higher education. This may include linking to survey responses provided in the future as part of the Graduate Outcomes survey: https://www.graduateoutcomes.ac.uk/ and to other datasets for example college data.
Quality assure data and to remove anomalies and improve data accuracy. This may include processing personal data in the context of providing bespoke training to higher education providers to provide analysis and improve data quality.
Research into data quality and the sector’s reliance on time series data.
Migrate data to the new Data Futures data model for use in the new HESA Data Platform which will help improve the accuracy of the data that will be collected by HESA. For more information about this work, see: https://www.hesa.ac.uk/innovation/data-futures/beta-phase.
Check it against information submitted to UCAS to improve data accuracy. For more information see https://www.hesa.ac.uk/about/regulation/data-protection/ucas-data.
To review how changes and improvements can be made to HESA’s processing including systems and software and the implications that this would have on the data it produces.

Legal basis for processing your information for Purpose 8

Processing of your HESA information for Purpose 8 is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller (See GDPR Article 6(1)(e)) and for statistical and research purposes (See GDPR Article 89).

Processing of Special Categories of data is necessary for statistical and research purposes in accordance with GDPR Article 89(1) in accordance with the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, the Digital Economy Act 2017 or equivalent subsequent legislation, or for other research purposes falling within GDPR Article 9(2)(j).

Processing of Special Categories of data may also be necessary for reasons of substantial public interest in accordance with the Equality Act 2010 or equivalent subsequent legislation (see GDPR Article 9(2)(g)).

Linking of your HESA information to other information

HESA information is sometimes linked to other data sources to enable more detailed research and analysis.

As indicated above, where HESA and organisations covered by Purposes 1 & 2 use HESA information this may include linking named or pseudonymised HESA information to other information for research purposes. Examples include linking to:

National Student Survey data – to place the results of this survey in context.
School and Further Education data – to research progression to higher education.
Student Loans Company data – to research the use of student finance.
Qualification awarding bodies data – to research the value and outcomes of qualifications.
Employment, tax, and benefits data – to research the earnings of graduates and to better understand the outcomes of education (Guidance on the use of HESA records matched to tax, benefits and employment data is available at: www.gov.uk/government/publications/longitudinal-education-outcomes-study-how-we- use-and-share-data).
UCAS data – to understand entry rates to higher education.
UCAS and Higher Education Career Services Unit (HECSU) data – to deliver an information service to support students and prospective students make informed and effective study and career choices.

Medical students - If you are a medical student your HESA information may be included in the UKMED research database (www.ukmed.ac.uk). The General Medical Council is the Controller for this database used for researching doctors’ progression through their education and training.

Widening Participation Programmes - If you have participated in programmes designed to widen participation in higher education, your HESA information may be linked to data held by these programmes for research purposes. This may include Higher Education Access Tracker (HEAT) and the East Midlands Widening Participation Research and Evaluation Partnership (EMWPREP).

Destinations information for schools and colleges – If you attended a school or college in England or Wales linked data may be disclosed by organisations covered by Purposes 1 & 2 to the last school or college you attended (or its successor body) and to Ofsted or Estyn in the exercise of their official authority to enable them to assess the outcomes of secondary education.

Where HESA provides information from your HESA information to third parties under Purpose 5, the permitted processing of the information by a third party may include linking HESA information to other information held by the third party. Permission is considered on a case-by-case basis. It is only given where the linking is for the purposes outlined in Purpose 5 and subject to the requirement not to carry out linking to identify individuals.

The HESA Initial Teacher Training record (“ITT”)

Information about teacher training students in England is submitted to the Department for Education (DfE) and the Teaching Regulation Agency (TRA) via HESA.

If you are on an ITT course at a higher education provider in England, HESA will collect additional information about you and provide this to the DfE and TRA. ITT courses are those that lead to Qualified Teacher Status (QTS) or Early Years Teacher Status (EYTS).

The TRA is an executive agency of the Department for Education (DfE) and for the purposes of the GDPR, DfE and HESA are separate Controllers of the ITT record.

DfE will process your personal data in exercise of its official authority, namely the funding, administration and monitoring of ITT schemes in England. DfE will use your data to establish a record on the Database of Trainee Teachers and Providers (DTTP) and register your course details and subsequent completion.

TRA will process your personal data in the exercise of its official authority, namely the award of QTS and EYTS and the maintenance of the list of teachers in England. TRA will use your data to establish a record on the database of teachers and allocate to you a teacher reference number (TRN). TRA will contact you to provide confirmation of your TRN and any subsequent award of QTS and as part of your statutory induction year.

DfE and TRA may share personal data with your provider, and where the law allows it or there is a legal requirement for sharing to take place, its partners and contractors for this purpose and may link it to other sources of information about you. Partners include employers of teachers, teacher employment agencies, Ofsted, Capita Teachers’ Pensions and other executive agencies of the DfE.

Student and leaver surveys

You may be asked to provide information about your experience as a student and your activities after you graduate as part of national surveys.

Your contact details may be passed to survey contractors to carry out the National Student Survey (NSS), other surveys of students’ views about their study, and surveys of student finances, on behalf of some of the organisations listed under Purposes 1 & 2 above.

After you graduate you may be contacted and asked to complete one or more surveys into the outcomes of higher education and your activities after graduation. These surveys are used to create statistics to meet the public interest in the outcomes of higher education. Information from third parties (such as your parent, or your provider if you’re in further study) might be used to complete sections of the surveys if you can’t be contacted. The surveys may be undertaken by your provider or by an organisation contracted for that purpose.

Your provider will hold your contact details after you graduate in order for you to be contacted to complete the Graduate Outcomes survey. Your contact details will be passed to HESA and the organisation(s) contracted by HESA to assist it to undertake the Graduate Outcomes survey. HESA’s contractors will only use your contact details for the survey and will delete them when the survey is closed. HESA may hold your contact details for further Graduate Outcomes surveys where these are in the public interest. Your responses to the Graduate Outcomes survey will be made available to your provider, and your provider may choose to add additional questions to the survey for their own use.

Further privacy and data protection information will be provided if you are contacted for any of these surveys. The privacy information for Graduate Outcomes is available on the Graduate Outcomes website. You might also be contacted as part of an audit to check that a survey has been undertaken properly.

Legal basis for processing your information to conduct national surveys

Processing of your information to conduct the student and graduate surveys is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller (See GDPR Article 6(1)(e)) and for statistical and research purposes (See GDPR Article 89).

Further information about recipients of your HESA information

HESA publishes a register containing information relating to the recipients to whom we disclose data for statistical purposes. The live register can be found here: https://www.hesa.ac.uk/about/regulation/data-protection/register.

Your rights

Data protection legislation gives you rights over your personal data. These include rights to know what information is processed about you and how it is processed. These rights have to be met by HESA and any other organisation which takes decisions about how or why your information is processed.

You have the right to be informed about how your personal data is used. This Student collection notice is regularly reviewed to ensure that it accurately describes how your HESA information is used. This notice may be updated from time to time, for example when new legislation is enacted, or when new policies are implemented by the public authorities listed under Purposes 1 & 2. The most up to date version can always be found at www.hesa.ac.uk/fpn.

For further information about data protection, including contact details for HESA’s Data Protection Officer please see www.hesa.ac.uk/dataprot. If you have questions about how your HESA information is used, please contact [email protected].

Under the GDPR you have the right of access to your personal information and the right to rectify inaccurate information; the right to erasure; restrict processing; and object to processing. These rights are limited in certain circumstances by exemptions contained in the GDPR and the Data Protection Act 2018, where data is only processed for research or statistical purposes. If you think there is a problem with the way HESA is handling your data, you have the right to complain to the Information Commissioner's Office: ico.org.uk/.

Data transfers to other countries

Your HESA information may be transferred to countries outside the UK and the European Union for the purposes described above.

Your HESA information will only be transferred to countries whose data protection laws have been assessed as adequate, or where adequate safeguards, are in place to protect your HESA information.

15 July 2020 to 8 July 2021

Student collection notice 2020-2021

HESA_Student_Collection_Notice_2020-21.pdf
Hysbysiad_Casglu_i_Fyfyrwyr_HESA_2020-21.pdf

The Higher Education Statistics Agency Limited (HESA) is the body responsible for collecting and disseminating information about higher education in the UK and the Designated Data Body for England (see www.hesa.ac.uk/about for more information). HESA is a Controller of your information.

Reference to "your provider" refers to the Higher Education Provider which you attend. This notice relates to information about you which will be collected by your provider and passed to HESA and to other organisations as described below.

Review and Updates to this Notice

This notice sets out information about HESA and other Controllers of your data, how and why they process your data, the legal bases for this processing, and your rights under data protection legislation. This notice is regularly reviewed and updated, for example when organisations change their name, or to clarify how your information is used. Updates may be made at any time and you will always find the most up to date version at www.hesa.ac.uk/fpn.

Submission of your information to HESA

Data about you will be supplied to HESA for the purposes set out below. All information is used in compliance with data protection legislation.

Every year your provider will send some of the information it holds about you to HESA (“your HESA information”). HESA is the official source of data about UK universities, higher education colleges, alternative Higher Education Providers, and recognised higher education courses taught at further education institutions in Wales. HESA is a registered charity and operates on a not-for-profit basis.

Your HESA information is used for a variety of purposes by HESA and by third parties as described below. HESA may charge other organisations to whom it provides services and data. Uses of your HESA information may include linking parts of it to other information, as described below. Some information provided to HESA is retained indefinitely for statistical research purposes. Your HESA information will not be used to make automated decisions about you. The extent to which your HESA information will be used for purposes 4-5 will vary.

All uses of HESA information must comply with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

HESA is developing a new system for collecting student information called the HESA Data Platform. More information about this programme of work can be found here: www.hesa.ac.uk/innovation/data-futures. If personal data about you is sent to HESA as part of any pilot of the new HESA Data Platform, it will only be used by HESA, your provider, and higher education funding and regulatory bodies to evaluate system functionality and will be deleted at the end of the Data Platform development programme. As the development of the platform is to enable HESA to have a platform suitable for the public functions of the higher education sector, the lawful bases for this processing can be found in Purpose 1 (below).

Categories of information submitted to HESA, including special categories of data

HESA collects data about the personal characteristics of students and information about their studies and qualifications. This might include sensitive details about students’ personal lives used for equality and diversity monitoring.

Data submitted to HESA by your provider includes details about the course you are studying and any qualifications awarded to you during the academic year. It also includes personal details about you such as your name and date of birth, your prior qualifications, and where you lived before and during your course.

Information about your disability status, ethnicity, sexual orientation, gender reassignment or religion is classed as ‘Special Categories of data’ under the GDPR. If your provider discloses this information to HESA it will be included in your HESA information. This information is necessary for monitoring equality of opportunity and eliminating unlawful discrimination in accordance with the Equality Act 2010 and Section 75 of the Northern Ireland Act 1998 or equivalent subsequent legislation, or for other research purposes falling within GDPR Article 9(2)(j). This information will also be processed for statistics and statistical research where this is necessary and in the public interest. Your sensitive information will not be used to make decisions about you.

Some other information is used to enable research into the provision of fair access to higher education, for example information as to whether you are a care leaver. If your provider is in England your HESA information may include details of any financial support you may receive from your Higher Education Provider.

A full list of data items that may be included in your HESA information for the 2020/21 academic year will be available from October 2020 here: www.hesa.ac.uk/collection/c20051/. Please note that not all data items are collected for all students.

Purpose 1 – Named data used for public functions by the HE funding and regulatory bodies

Your HESA information is used by HE funding and regulatory bodies (who request HESA to collect it) for their statutory and/or public functions including funding, regulation and policy-making purposes. Your information is provided by reference to your name, but your information will not be used to make decisions about you.

HESA shares your HESA information with the HE funding and regulatory body(s) who request HESA to collect it and require it to carry out their statutory and/or public functions. This data sharing is carried out in the public interest or in the exercise of official authority vested in HESA and the funding and regulatory bodies. HESA has been appointed as the designated data body for England under the Higher Education and Research Act 2017. The HE funding and regulatory bodies are:

England - Office for Students (who take into account what would be helpful to collect for sharing with UK Research and Innovation and the Secretary of State)
Wales - Higher Education Funding Council for Wales
Scotland - Scottish Funding Council
Northern Ireland - Department for the Economy