Skip to main content

HESA's processing of UCAS data

If you apply to enter higher education through UCAS and are:

a.  a placed applicant undergraduate student in the main UCAS system or an integrated master’s degree student in the main UCAS system
b.  a placed applicant undergraduate student in the UCAS Conservatoires (UC)
c.  a placed applicant student in UCAS Teacher Training (UTT)

UCAS will send some information it holds about you to us (Higher Education Statistics Agency Limited ('HESA')) to support our UK-wide public functions, to collect and disseminate higher education information.

Your UCAS data is used by HESA in order to quality assure, verify and query discrepancies between the information that has been provided by your higher education provider to HESA and that held by UCAS. This is to ensure that the data held by HESA as part of our statistical record is as accurate as we can make it.

Data shared with us by UCAS includes personal details about you such as your name, date of birth, gender, nationality, your prior qualifications and place of study, and your area of permanent residence. Information about your disability status, ethnicity, sexual orientation, or religion (classed as ‘Special Categories of Data’ under the GDPR) are also shared.

HESA retains a consolidated version of the UCAS data for 7 years after its creation as required for audit purposes and further validation of fixed databases. The UCAS data is deleted by HESA once it is no longer required.

For more information on how your statistical record will be used, HESA's use of personal data and your rights, please visit our Privacy Information.

Processing of your information shared by UCAS for this purpose is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in HESA as the Controller (see GDPR Article 6(1)(e)) and for statistical and research purposes (see GDPR Article 89). Processing of your special category information is necessary for statistical and research purposes in accordance with GDPR Article 89(1).