Data protection: Action and implications for providers
Student Collection Notice
It is vital that providers make our revised Student Collection Notice available to all students. The action here depends on how you typically direct your students to our notices:
- If you include a link to our site on your intranet/in your own fair processing notices, there’s no action. We have updated the information on our page. This is our recommended way of making our collection notices available as text of the notice may be updated during the collection year.
- Where you’ve copied the text of our old collection notice onto your own intranet/equivalent, you will need to update this with our new text.
- If you provide hard copies to students at enrolment and do not have an electronic copy, you will need to use our revised version from now on. You will also need to ensure all students who have already enrolled and are due to complete their studies with you from 1 August 2017 onwards have access to our revised collection notice. This is because we have added additional fair processing information that should be made available to them. This can be via a link to our website in an email.
Additional privacy notice(s)
The data protection information we have published applies to the agreed banks of Graduate Outcomes survey questions. These are the core survey questions and the optional banks of questions approved by the Graduate Outcomes governance process. If you have added your own bespoke questions to the survey, you will need to ensure that this is covered appropriately in your own privacy notice(s). HESA will not be Data Controller for the data generated by these additional questions.
Other uses of graduate contact details
Please note the data protection information we have published applies to your collection of contact details for the purposes of submitting them to HESA for the Graduate Outcomes survey. We appreciate that HE providers routinely collect and hold alumni contact details for a variety of other purposes. The lawful grounds for processing this information for these other purposes may differ from those which apply to processing for the Graduate Outcomes survey. It is for you to determine the basis for such processing and any actions required to achieve GDPR compliance.
Accuracy of contact details
HESA has published guidance on how to collect and maintain accurate contact details. HESA has also provided guidance on the creation of accurate contact details for submission to the Graduate Outcomes provider portal.