Skip to main content
Data Innovation » Graduate Outcomes » Information for providers » Data protection: Actions and implications for providers

Data protection: Action and implications for providers

HESA is now part of Jisc. Jisc is now the data controller of personal data previously controlled by HESA. Pages on the HESA website are being updated to reflect this change. Please see updated Privacy information.

Student Collection Notice

It is vital that providers make our revised Student Collection Notice available to all students. The action here depends on how you typically direct your students to our notices:

  • If you include a link to our website on your intranet/in your own fair processing notices, there is no action to take. We have updated the information on our page. This is our recommended way of making our Collection Notices available as text of the notice may be updated during the collection year.
  • Where you have copied the text of our old Collection Notice onto your own intranet/equivalent, you will need to update this with our new text.
  • If you provide hard copies to students at enrolment and do not have an electronic copy, you will need to use our revised version from now on. You will also need to ensure all students who have already enrolled and are due to complete their studies with you from 1 August 2017 onwards have access to our revised Collection Notice. This is because we have added additional fair processing information that should be made available to them. This can be via a link to our website in an email.

Northern Ireland Further Education Colleges (NIFECs)

NIFECs are required to include information on the Graduate Outcomes survey in your student fair processing notice. We have provided some initial guidance below on the data protection issues that will need to be covered:

Other uses of graduate contact details

Please note the data protection information we have published applies to your collection of contact details for the purposes of submitting them to HESA for the Graduate Outcomes survey. We appreciate that HE providers routinely collect and hold alumni contact details for a variety of other purposes. The lawful grounds for processing this information for these other purposes may differ from those which apply to processing for the Graduate Outcomes survey. It is for you to determine the basis for such processing and any actions required to achieve GDPR compliance.

Accuracy of contact details

HESA has published guidance on how to collect and maintain accurate contact details. HESA has also provided guidance on the creation of accurate contact details for submission to the Graduate Outcomes provider portal.

Further information about the use of Graduate Outcomes contact details