Privacy information

The Graduate Outcomes survey is a national survey capturing information about the activities and perspectives of graduates 15 months after they finish their studies. All graduates who complete a higher education course are asked to take part in the survey, in order to help current and future students gain an insight into career destinations and development. Your responses will also help your university or college to evaluate and improve their courses.

The survey is also of national significance as it allows policy makers, charities, journalists, researchers and others to understand the higher education sector and the state of the graduate labour market.

About this privacy notice

This notice sets out information about who processes your information, what they use it for, the legal bases for this processing, and your rights under data protection legislation. This notice is regularly reviewed and sometimes updated, for example when organisations change their name, or to clarify how your information is used. Updates may be made at any time and you will always find the most up to date version at www.graduateoutcomes.ac.uk/privacy-info.

How to read this privacy notice

Please click the headings for information. Each section has key information in bold text.

Further detail is provided in normal text.


Some sections also have information outlining the legal basis for processing under GDPR.


About the survey

What will I be asked about?

The survey asks you about what you’re doing 15 months after completing your course. It also asks some subjective questions about how you feel about your current situation and general wellbeing. The survey includes a set of core questions and your response won’t be used if you don’t answer all of these. Further banks of questions may be included at the request of your university or college and these will be clearly signposted.

The survey asks about what you were doing in a particular week (the census week) about 15 months after graduation, and which activity was most important to you (e.g. working, studying, caring, traveling). Further questions ask for more details depending on what you specified as the most important activity.

Some questions depend on the sort of course you completed, for example there are special questions for newly qualified teachers and postgraduate researchers.

If you were working during the census week the survey asks about your salary.

Some questions are designed to get the ‘graduate voice’ – giving you the chance to share your own assessment about the value of your course and the personal importance of what you’re doing now.

Other questions ask about your general wellbeing. These aren’t part of the core questions and you don’t have to share this information. Your HE provider won’t receive your answers to these questions in a way that identifies you (they will only get aggregated statistical information about the wellbeing questions).

What happens to my information if I quit the survey half way through?

If you start the survey but don’t complete it we’ll send you an email or text reminder or try to contact you by phone to complete it later. If you don’t want to finish the survey we will keep your answers if you completed the core questions or delete everything if you didn’t get that far.

Who carries out the Graduate Outcomes survey?

The survey is delivered by the Higher Education Statistics Agency Limited (“HESA”) to help universities and colleges (HE providers) fulfil their legal requirement to report on the outcomes of higher education to the higher education funding and regulatory bodies. The funding and regulatory bodies commission the Graduate Outcomes survey and require HESA and HE providers to work together to deliver the survey. HESA employs an organisation called IFF Research to undertake the Graduate Outcomes survey by phone.

Higher education providers are obliged by law to give information to funding and regulatory bodies in England, Wales, Scotland and Northern Ireland (see Purpose 2 below).

Some of this information is collected by HESA on behalf of these bodies (www.hesa.ac.uk/about).

In England, HESA is the Designated Data Body and will use the information collected from the survey for its statutory functions under section 64 and section 65 of the Higher Education and Research Act 2018 (http://www.legislation.gov.uk/ukpga/2017/29/contents/enacted).

In addition to its statutory functions, HESA also acts as an information hub of higher education data and statistics for research purposes. Details of HESA’s information sharing activities are set out in this notice.

HESA is a Controller of your information. HESA’s wholly-owned subsidiary company, HESA Services Limited, acts as a Processor to do work on behalf of HESA and on request for other organisations listed in Purpose 2 but may also act as a Controller. HESA is a registered charity and operates on a not-for-profit basis.

IFF Research is a Processor working on behalf of HESA to administer the Graduate Outcomes survey by phone.

How did HESA get my contact details?

Contact details for the Graduate Outcomes survey are provided by the higher education provider you attended.

HESA receives data about higher education students in the UK. The higher education provider you attended sent your contact details to HESA so that you can take part in the Graduate Outcomes survey as described in the HESA Student Collection Notice. Your contact details are only used by HESA and its data processors to conduct the Graduate Outcomes survey and copies are deleted by each organisation when they are no longer needed for the survey. We anticipate that this will be approximately 6 months after the last cohort of 2017/18 graduates has been surveyed to allow for any audit or re-survey that might be required by the funding and regulatory bodies. Your contact details are therefore likely to be deleted in June 2020.


Legal basis for processing your contact details information:
Processing of your contact details is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller (See GDPR Article 6(1)(e)) and for statistical and research purposes (See GDPR Article 89).

Can someone else answer the survey on my behalf?

Yes, if you don’t complete the online survey we’ll try to contact you by phone. If we can’t get hold of you, but the phone is answered by someone who knows you well we may ask them just the core questions about what you’re doing after graduation.

If someone else completes the survey on your behalf and you would rather provide your own answers, you can still complete the survey yourself and over-write the third party answers. Please contact [email protected] if you want to complete your own survey in place of a third-party response.

Will I be contacted for further surveys?

The funding and regulatory bodies listed in Purpose 3 below may undertake further research in the public interest into the outcomes of higher education including further surveys of graduates. If you are contacted about further surveys this contact will come from your higher education provider or from the organisation undertaking the research and will include further privacy information.


How your information is used, and who uses it

Purpose 1 - Your survey responses will be provided to your higher education provider

Your responses will be received by your HE provider who will only use the information for research and statistical purposes to help them improve the outcomes from their courses unless you give your permission for other uses via the survey.

Your HE provider will use your survey answers to research the outcomes of different courses and the effectiveness of career services. This research is used by HE providers to improve courses and services and to promote them to current and prospective students.

HE providers will receive regularly updated information from survey responses during the survey period. This includes coded information on industries and occupations of employed graduates. This information may only be processed for the purpose of monitoring the progress of the Graduate Outcomes survey.

The survey asks if you are happy to be contacted by your HE provider in relation to your survey answers. If you answer ‘No’ then your provider may only use your survey answers for research and statistical purposes and they won’t need to contact you with further privacy information. 

If you answer ‘Yes’ then your provider may contact you, in relation to any of the information you give in the survey. No new contact details are given to HE providers so if they do contact you they will use the contact information they already held before the survey. To update the contact details held by your provider please contact them directly.

Your HE provider will be a Controller of your information and will need to determine its own legal grounds for contacting you. If your provider does contact you they must give you further privacy information about how they will use your personal data. Contact from your provider might include marketing or fund-raising campaigns and your provider must give you opportunities to opt out of future contact if you change your mind.


Legal basis for processing your information for Purpose 1 – these cover use of personal data by both HESA and higher education providers:
Processing of your information for Purpose 1 is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller (see GDPR Article 6(1)(e)) and for statistical and research purposes (see GDPR Article 89).
Processing may also be necessary for the purposes of the legitimate interests pursued by your higher education provider except where such interests are overridden by your interests or fundamental rights and freedoms (see GDPR Article 6(1)(f)).
Processing of Special Categories of data is necessary for statistical and research purposes in accordance with Article 89(1) based on the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, or the Digital Economy Act 2017 (see GDPR Article 9(2)(j)).

Purpose 2 - Your responses are used by the HE funding and regulatory bodies who require HESA and your HE Provider to undertake this survey

Your survey responses are linked to data about when you were a student and these collectively make up “your HESA information". This information is used by HE funding and regulatory bodies who have used a legal or regulatory power to require your HE provider and/or HESA to undertake the survey and provide information to them. These bodies use the information to understand the outcomes from higher education and for their statutory and/or public functions including funding, regulation and policy-making purposes. Your individual answers won’t be used to make decisions about you.

Your survey answers will be linked to information held about you as a student, including information you gave when you enrolled, and details of the qualification you gained. More information about your HESA Student record can be found in the HESA Student Collection Notice. This information is shared by HESA with the HE funding and regulatory bodies who commissioned the survey and who have the power to collect information from HE providers. These bodies include:


Your HESA information will be shared with these organisations as part of a large dataset which contains similar information about other people who have followed higher education courses in the UK. These organisations are also Controllers of your HESA information. This means that they make their own decisions about how to use it, and this may include publishing statistics and sharing the information with third parties, such as other government or public bodies or other organisations of the type listed elsewhere in this collection notice. However, all uses of your HESA information will be within the purposes set out in this collection notice and covered by data sharing agreements with HESA. These organisations will not use the data for the purposes of identifying you as an individual or to take decisions about you. These organisations may retain HESA information indefinitely for statistical and research purposes.

All uses of HESA information must comply with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.


Legal basis for processing your information for Purpose 2 – these cover use of personal data by both HESA and public authority data controllers:
Processing of your HESA information for Purpose 2 is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller (see GDPR Article 6(1)(e)) and for statistical and research purposes (see GDPR Article 89).
Processing may also be necessary for compliance with a legal obligation to which the controller may be subject (see GDPR Article 6(1)(c)).
Processing of Special Categories of data is necessary for statistical and research purposes in accordance with Article 89(1) based on the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, or the Digital Economy Act 2017 (see GDPR Article 9(2)(j)).

Purpose 3 - Public authorities carrying out their public functions

HESA acts as an information hub to provide data and statistics on higher education. While the bodies described in Purpose 2 (above) have legal or regulatory power to require information from certain HE providers, other public authorities also use your HESA information for their statutory and/or public functions including funding, regulation and policy-making purposes. Your survey responses will not be used to make decisions about you.

Education statistics and data:

Outside of its Designated Data Body activities HESA also acts as an information hub to provide information on higher education. HESA shares your HESA information with public authorities who require it to carry out their statutory and/or public functions. This data sharing is carried out in the public interest or in the exercise of official authority vested in HESA and the public authorities. Your HESA information will be shared with these organisations as part of a large dataset which contains similar information about other people who have followed higher education courses in the UK.

These organisations are also Controllers of your HESA information. This means that they make their own decisions about how to use it, and this may include publishing statistics and sharing the information with third parties, such as other government or public bodies or other organisations of the type listed elsewhere in this collection notice. However, all uses that they make of your HESA information will be within the purposes set out in this collection notice and covered by data sharing agreements with HESA. These organisations will not use the data for the purposes of identifying you as an individual or to take decisions about you. These organisations may retain HESA information indefinitely for statistical and research purposes, or for fixed terms depending on the terms of their data sharing agreements with HESA. Such organisations may include:

HE funding and regulatory bodies (in respect of information not collected under their relevant power – for example the Office for Students have power to collect information from English providers, but also need information from providers in other parts of the UK):


Education departments in the devolved administrations:


Other bodies with public functions connected to education:


and any successor bodies. Further controllers may be added to the list from time to time – please see the online version of this notice at www.graduateoutcomes.ac.uk/privacy-info.

Other uses of named data:

Your HESA information may also be used by some organisations who are also Controllers who carry out statistical and research tasks in the public interest or in the exercise of official authority that are not connected with education. Such uses may include the following:


The above list of organisations who may receive your HESA information will be subject to change over time. For example, HESA is seeking to reduce the burden on higher education providers by encouraging other organisations who currently collect information about students direct from higher education providers to collect and receive information through HESA. The above list will be updated on the Graduate Outcomes website www.graduateoutcomes.ac.uk/privacy-info from time to time, and you will need to monitor this link yourself if you wish to be aware of changes.   


Legal basis for processing your information for Purpose 3 - these cover use of personal data by both HESA and public authority data controllers:
Processing of your HESA information for Purpose 3 is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller (see GDPR Article 6(1)(e)) and for statistical and research purposes (see GDPR Article 89).
Processing may also be necessary for compliance with a legal obligation to which the controller may be subject (see GDPR Article 6(1)(c)).
Processing of Special Categories of data is necessary for statistical and research purposes in accordance with Article 89(1) based on the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, or the Digital Economy Act 2017 (see GDPR Article 9(2)(j)).

Purpose 4 - Published statistics

HESA, your HE provider, and some of the public authorities listed in Purposes 2 and 3 publish statistics about the outcomes of higher education.

Part of HESA’s role is to produce and publish information about higher education in the public interest. This includes some National Statistics publications (www.statisticsauthority.gov.uk/national-statistician/types-of-official-statistics) and online business intelligence and research services.

Graduate Outcomes statistics will also be published by some of the public authorities listed in Purposes 2 and 3, for example to provide employment statistics to help prospective students choose which courses to study.

When producing this material for publication, HESA applies its disclosure control, the HESA Standard Rounding Methodology, to ensure that no Personal Data is included and that individuals cannot be identified from published material.

Processing within this Purpose 4 may also be carried out by HESA Services Limited, HESA's wholly-owned subsidiary company.


Legal basis for processing your information for Purpose 4 - these cover use of personal data by both HESA and public authority data controllers:
Processing of your HESA information for Purpose 4 is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller (see GDPR Article 6(1)(e)) and for statistical and research purposes (see GDPR Article 89).
Processing of Special Categories of personal data is necessary for statistical and research purposes in accordance with Article 89(1) based on the Equality Act 2010 and Section 75 of the Northern Ireland Act 1998 (see GDPR Article 9(2)(j)).

Purpose 5 - Equal opportunity, research, journalism and other processing for statistical and research purposes

HESA information is used for research into higher education and the student population. This research can be academic, commercial, journalistic or for personal reasons. HESA prohibits the identification of individual students by those carrying out this research and information is not shared on a named basis.

HESA and the other Controllers (see Purposes 2 and 3) may also supply information to third parties where there is a legitimate interest in doing so for statistical and research purposes. Examples of use for this purpose include:

  • Provision of information to students and prospective students
  • Equal opportunities monitoring
  • Research - this may be academic research, commercial research or other statistical research where this is in the public interest
  • Journalism - where the relevant publication would be in the public interest e.g. league tables


Users to whom information may be supplied for Purpose 5 include:

  • Higher education sector bodies
  • Higher education providers
  • Academic researchers and students
  • Commercial organisations (e.g. recruitment firms, housing providers, graduate employers)
  • Unions
  • Non-governmental organisations and charities
  • Local, regional and national government bodies
  • Journalists


Information supplied by HESA to third parties within Purpose 5 is supplied under contracts which require that individuals shall not be identified from the supplied information and this means that they also cannot use it to take decisions about you. A copy of HESA’s current agreement for the supply of information is available at www.hesa.ac.uk/services/custom/data/timescales-costs. Each agreement specifies the duration for which data may be processed. This is usually one year but may be longer if necessary for the specific research purpose. Each request for HESA information under Purpose 5 is assessed for its compliance with data protection legislation and its compatibility with this Collection Notice.

HESA ensures that only the minimum amount of HESA information necessary for the specified research purpose is supplied to users. If the supplied information is to be published, HESA's Rounding Methodology or an equivalent disclosure control must be applied to ensure that individuals cannot be identified from the published material and it does not constitute Personal Data.

HESA information may be linked to school and/or further education college information and supplied to researchers. A copy of the Agreement for the supply of linked data about pupils from schools in England is available at www.gov.uk/government/collections/national-pupil-database.

Processing within this Purpose 5 is carried out by HESA and by HESA Services Limited, HESA's wholly-owned subsidiary company. Other controllers (listed under Purpose 2 and 3 above) may also process data for this purpose where this is necessary to fulfil their public functions.


Legal basis for processing your information for Purpose 5 - these cover use of personal data by both HESA and third party recipients of data for statistical and research purposes: 
Processing of your HESA information for Purpose 5 is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller (see GDPR Article 6(1)(e)).
Processing may also be necessary for the purposes of the legitimate interests of HESA in disseminating higher education information, or the legitimate interests of third parties in undertaking research in the field of higher education (see GDPR Article 6(1)(f)).
In either case processing of your HESA information is necessary for statistical and research purposes in accordance with GDPR Article 89(1).
Processing of Special Categories of personal data is necessary for statistical and research purposes in accordance with Article 89(1) based on the duties in the Equality Act 2010 and Section 75 of the Northern Ireland Act 1998 (see GDPR Article 9(2)(j)).

How is my HESA information linked to other information?

HESA information is sometimes linked to other data sources to enable more detailed research and analysis.

As indicated above, where HESA and organisations covered by Purpose 2 and 3 use HESA information this may include linking named or pseudonymised HESA information to other information for research purposes. Examples include linking to:

  • National Student Survey data – to place the results of this survey in context
  • School and Further Education data – to research progression to higher education and employment
  • Student Loans Company data – to research the use of student finance
  • Qualification awarding bodies data – to research the value and outcomes of qualifications
  • Employment, tax, and benefits data – to research the earnings of graduates and to better understand the outcomes of education (guidance on the use of HESA records matched to tax, benefits and employment data is available at: www.gov.uk/government/publications/longitudinal-education-outcomes-study-how-we-use-and-share-data)
  • UCAS data – to research the full higher education process from applications to outcomes
  • If you were a medical student, your HESA information may be included in the UKMED research database (www.ukmed.ac.uk). The General Medical Council is the controller for this database used for researching doctors’ progression through their education and training.


Where HESA provides information from your HESA information to third parties under Purpose 5, the permitted uses of the information by a third party may include linking HESA information to other information held by the third party. Permission for such use is considered on a case by case basis. It is only given where the linking is for the purposes outlined in Purpose 5 and subject to the requirement not to carry out linking to identify individuals.


Your privacy rights

What are my rights?

Data protection legislation gives you rights over your personal data. These include rights to know what information is processed about you and how it is processed. These rights have to be met by HESA and any other organisation which takes decisions about how or why your information is processed.

You have the right to be informed about how your personal data is used. This Graduate Outcomes privacy notice is regularly reviewed to ensure that it accurately describes how your HESA information is used. This notice may be updated from time to time, for example when new legislation is enacted, or when new policies are implemented by the public authorities listed under Purposes 2 and 3. The most up to date version can always be found at www.graduateoutcomes.ac.uk/privacy-info.

For further information about data protection, including contact details for HESA and HESA Services’ Data Protection Officer please see www.hesa.ac.uk/dataprot. If you have questions about how your HESA information is used, please contact [email protected].

Under the GDPR, you have the right of access to your personal information and rights to rectify inaccurate information; restrict processing; and object to processing. These rights are limited in certain circumstances by the GDPR and the Data Protection Act 2018 where data is only processed for research or statistical purposes.

If you do not want to complete the survey there is no obligation to do so. If you don't want to be contacted at all for the survey please email [email protected].

If you think there is a problem with the way HESA is handling your data, you have the right to complain to the Information Commissioner's Office: ico.org.uk/.

Is my data held securely?

HESA takes information security extremely seriously and is committed to keeping your data secure. HESA is certified to information security standards and undertakes detailed monitoring of its systems. This includes logging IP addresses of users of the survey system.

HESA is certified to the ISO27001 international standard for information security management, and the UK Cyber Essentials PLUS standard for cyber security. The systems used to run the Graduate Outcomes survey are subject to penetration testing to identify and minimise vulnerabilities.

The online survey system logs the IP address, operating system and browser of each user for security and audit purposes and to improve the quality of the survey system.

Is my information transferred to other countries?

Your HESA information may be transferred to countries outside the European Union for the purposes described above.

Your HESA information will only be transferred to countries whose data protection laws have been assessed as adequate by the European Commission, or where adequate safeguards, such as the EU-US Privacy Shield, are in place to protect your HESA information. European Commission decisions on the adequacy of the protection of personal data in third countries are published here: ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm.