HESA's processing of UCAS data

If you apply to enter higher education through UCAS and are:

a.  a placed applicant undergraduate student in the main UCAS system or an integrated master’s degree student in the main UCAS system
b.  a placed applicant undergraduate student in the UCAS Conservatoires (UC)
c.  a placed applicant student in UCAS Teacher Training (UTT)

UCAS will send some information it holds about you to us (Higher Education Statistics Agency Limited ('HESA')) to support our UK-wide public functions, to collect and disseminate higher education information.

Your UCAS data is used by HESA in order to quality assure, verify and query discrepancies between the information that has been provided by your higher education provider to HESA and that held by UCAS. This is to ensure that the data held by HESA as part of our statistical record is as accurate as we can make it.

Your UCAS data may be shared back with your higher education provider to assist with validation. Your UCAS data will only be shared with your higher education provider to resolve a discrepancy and is not made available as a matter of course. It is your higher education provider’s obligation to ensure they have provided you with privacy information that outlines their use of your UCAS data for these purposes.

Data shared with us by UCAS includes personal details about you such as your name, date of birth, gender, nationality, your prior qualifications and place of study, and your area of permanent residence. Information about your disability status, ethnicity, sexual orientation, or religion (classed as ‘Special Categories of Data’ under the UK GDPR) are also shared.

HESA retains a consolidated version of the UCAS data for 7 years after its creation as required for audit purposes and further validation of fixed databases. The UCAS data is deleted by HESA once it is no longer required.

For more information on how your statistical record will be used, HESA's use of personal data and your rights, please visit our Privacy Information.

Processing of your information shared by UCAS for this purpose is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in HESA (see GDPR Article 6(1)(e).

Processing of Special Categories of data is necessary for reasons of substantial public interest in accordance with the Equality Act (Article 9(2)(g), UK GDPR and paragraph 8, part 2, schedule 1, Data Protection Act 2018); and necessary for statistical and research purposes in accordance with Article 89(1) and research purposes based on the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, or the Digital Economy Act 2017 or equivalent subsequent legislation, or for other research purposes (Article 9(2)(j), UK GDPR, and paragraph 4, part 1, schedule 1, Data Protection Act 2018).