Data Sharing Register

This page explains why HESA has a Data Sharing Register (“the Register”) and what information is included in the Register. 

Purpose of the Register

Put shortly, the purpose of the Register is to provide further transparency about how HESA makes data available for research and statistical purposes.

HESA’s use of personal data is explained in its Collection Notices, i.e.:

• The Student Collection Notice (“the Student Notice”);
• The Graduate Outcomes Collection Notices (“the GO Notices”); and
• The Staff Collection Notice (“the Staff Notice”).

These Collection Notices are available at https://www.hesa.ac.uk/about/regulation/data-protection/notices.

The categories of recipients with which the Register is concerned (“Relevant Recipients”) are explained at Purpose 5 of the Student Notice and the GO Notices, and Purpose 4 of the Staff Notice and below.

HESA makes data available to Relevant Recipients for research purposes.

When HESA does this, it ensures that only the minimum amount of HESA information necessary for the specified research purpose is supplied.  HESA does not provide information that would enable individuals readily to be identified. For instance, it does not provide names, contact details, or unique identifiers.  

Additionally, HESA is mindful of the sensitivity of the data it holds, including special category data, and takes steps to ensure its use is both lawful and in accordance of the expectations of data subjects. It is important to note that sensitive data fields will not be supplied in custom data extracts unless this is:

• necessary for the statistical purpose of monitoring equality of opportunity and eliminating unlawful discrimination in accordance with the Equality Act 2010, or
• necessary for reasons of substantial public interest.

Data will be retained by the Relevant Recipient for the duration of its contract with HESA, which may be extended on a case by case basis.

If the supplied information is to be published then HESA requires that disclosure controls must be applied so as to ensure that individuals cannot be identified from the published material.  Either HESA's Rounding Methodology or an equivalent disclosure control must be used.

Given the restricted scope of the data that HESA provides to Relevant Recipients, it may well be that such data does not amount to personal data (as defined by the Data Protection Act 2018 and the GDPR).  Nevertheless, HESA takes a precautionary view and applies the same protection as it would apply for personal data.  This is because, despite the various controls applied by HESA, there may still be potential for a Relevant Recipient to identify individuals.

The Register gives further information about the disclosure of data to Relevant Recipients in certain cases. Whether a particular disclosure should be included in the Register is based on HESA’s assessment of:

• the likelihood that the combination of fields being shared could be used to identify an individual; and 
• the sensitivity of the specific fields being provided.  

Disclosure of data that is aggregated to a point that HESA is confident that no identification of individuals can take place is not included within the Register. 

Download the Register

Click the link below to download the latest version of the register in .xlsx format. This file is updated as and when new data supplies are added.

View the Data Sharing Register

Further information

For information about the sharing of HESA data linked to National Pupil Database (NPD) data and the Individualised Learner Record (ILR), please see DfE external data shares.

HESA is part of the Jisc Group. For information about the Jisc Group's processing activities, please see www.jisc.ac.uk/analytics/jisc-and-hesa-data-protection

HESA and Jisc also make data available through Heidi Plus. The HESA Access Policy permits the following categories of subscribers:

• Higher education funding and regulatory bodies
• Government departments, agencies and public bodies
• Higher education providers
• Not-for-profit higher education sector bodies

For further information about Heidi Plus, please see www.jisc.ac.uk/heidi-plus

For further information about data protection, including contact details for HESA's Data Protection Officer please see www.hesa.ac.uk/dataprot. If you have questions about how HESA information is used, please contact [email protected].