Privacy information

In July 2021, HESA took the decision to move to a single collection notice for graduates to cover all survey years. These notices are available both in English and Welsh.

HESA has made this change to make the notices more accessible and transparent to data subjects. The notices link to specific records across the Graduate Outcomes survey years. If you need any assistance in identifying which record your HESA information may be included in, please contact [email protected] for guidance.

This notice is regularly reviewed and sometimes updated, for example when organisations change their name, or to clarify how your information is used. Updates may be made at any time, and you will always find the most up to date version at www.graduateoutcomes.ac.uk/privacy-info.

Copies of the historic notices continue to be made available on our Historical Collection Notices page.

We welcome any feedback on these published notices.


The Graduate Outcomes survey is a UK-wide survey capturing information about the activities and perspectives of graduates 15 months after they finish their studies. All eligible graduates who complete a higher education course are asked to take part in the survey, in order to help current and future students gain an insight into career destinations and development. Your responses will also help your university or college to evaluate and improve their courses.

The survey is also of national significance as it allows policy makers, charities, journalists, researchers and others to understand the higher education sector and the state of the graduate labour market.

HESA processes information about UK and other nations’ data subjects, including EU data subjects. Accordingly, all uses of HESA information must comply with the General Data Protection Regulation (“GDPR”) (including UK and EU versions) and the Data Protection Act 2018 (“DPA”).

About this privacy notice

This notice sets out information about who processes your information, what they use it for, the legal bases for this processing, and your rights under data protection legislation.

Review and updates to this notice

This notice is regularly reviewed and sometimes updated, for example when organisations change their name, or to clarify how your information is used.

Updates may be made at any time, and you will always find the most up to date version at www.graduateoutcomes.ac.uk/privacy-info. Historic versions can be found at www.hesa.ac.uk/about/regulation/data-protection/notices/previous.

How to read this privacy notice

Please click the headings for information. Each section has key information in bold text.

Further detail is provided in normal text.

Third Party privacy Information

Throughout this privacy notice we will link to the privacy documentation of the organisations with whom we share your information.

We will hyperlink the relevant privacy notices throughout to enable you to see how each recipient organisation processes your information. To access an organisation’s privacy page, simply click on the name of the organisation within each section.

Position in relation to English FE Colleges

Graduates of English FE colleges will be asked to take part in the survey. However, in a few respects, their survey information may be treated differently from that of other graduates. Where this is the case, it is explained in this privacy notice. Please also see the temporary notice for graduates of English FE colleges at the bottom of this page.


About the survey

What will I be asked about?

The survey asks you about what you’re doing 15 months after completing your course. It also asks some subjective questions about how you feel about your current situation and general wellbeing.

The survey asks about what you were doing in a particular week (the census week) about 15 months after you completed a HE course, and which activity was most important to you (e.g. working, studying, caring, traveling). Further questions ask for more details depending on what you specified as the most important activity.

Additional banks of questions may be included at the request of your university or college and these will be clearly signposted.

Some questions depend on the sort of course you completed, for example there are special questions for newly qualified teachers and postgraduate researchers.

If you were working during the census week, the survey also asks about your salary.

Some questions are designed to get the ‘graduate voice’ – giving you the chance to share your own assessment about the value of your course and the personal importance of what you’re doing now.

Other questions ask about your general wellbeing. These aren’t part of the core questions and you don’t have to share this information. Your HE provider won’t receive your answers to these questions in a way that identifies you (they will only get summaries of responses overall for their graduates as a group, not individually).

Your survey responses are linked to data about when you were a student and these collectively make up “your HESA information".

A full list of data items that may be included in your HESA information is made available for each survey year below. If you need any assistance in identifying which records your HESA information may be included in, please contact [email protected] for guidance.

If you are a graduate who obtained a relevant higher education qualification during the reporting period and whose study was full-time or part-time (including sandwich students and those writing-up theses) who are notified to HESA or the relevant body, you will be surveyed based on the reporting periods in the table below.

Graduate Outcomes survey
Collection Year Reporting Period
2017/18 (C17072) 01 August 2015 to 31 July 2016
2018/19 (C18072) 01 August 2016 to 31 July 2017
2019/20 (C19072) 01 August 2017 to 31 July 2018
2020/21 (C20072) 01 August 2018 to 31 July 2019


The Reporting Period indicates the date on which you obtained your applicable qualification. The Collection Year indicates the survey year in which your HESA information is intended to be collected. For example, if you obtained your applicable qualification on 2 August 2018, you will be invited to take part in the survey in 2020/21.

HESA identifies eligible graduates ahead of each Collection Year from its Student and Student Alternative collections. The Student Collection Notice provides further information regarding the use of personal data for the purpose of Student and leaver surveys: https://www.hesa.ac.uk/about/regulation/data-protection/notices.

For further education colleges in England and Northern Ireland eligible graduates are identified by the Office for Students and Department for the Economy (Northern Ireland), respectively. For these graduates, HESA will also receive fields necessary for monitoring equality of opportunity and eliminating unlawful discrimination, including information about ethnicity and disability status. This special category data will only be processed internally by HESA for reasons outlined under Purpose 6 of this notice.

What happens to my information if I quit the survey part way through?

If you start the survey but don’t answer all the questions, we’ll send you email or text reminders or (if your permanent home address prior to starting your course was in the UK or EU) we’ll try to contact you by phone to complete it later.

The more questions you answer, the more useful your information will be. If you only answer some of the questions, we will still make use of this information. Depending on how many questions you have answered, we will use your information for some or all of the purposes set out below.

Who carries out the Graduate Outcomes survey?

The survey is delivered by the Higher Education Statistics Agency Limited (“HESA”) to help universities and colleges (HE providers) fulfil their legal requirement to report on the outcomes of higher education to the higher education funding and regulatory bodies. The funding and regulatory bodies commission the Graduate Outcomes survey and require HESA and HE providers to work together to deliver the survey. HESA employs an organisation called IFF Research to undertake the Graduate Outcomes survey by phone.

Higher education providers are required to give information to funding and regulatory bodies in England, Wales, Scotland and Northern Ireland (see Purpose 2 below).

Some of this information is collected by HESA on behalf of these bodies (www.hesa.ac.uk/about).

In England, HESA is the Designated Data Body and will use the information collected from the survey for its statutory functions under section 64 and section 65 of the Higher Education and Research Act 2018 (http://www.legislation.gov.uk/ukpga/2017/29/contents/enacted).

For more information on HESA’s role within the statutory frameworks of Wales, Scotland and Northern Ireland, please visit the HESA website: https://www.hesa.ac.uk/about/what-we-do/statutory-w-s-ni.

In addition to its statutory functions, HESA also acts as an information hub of higher education data and statistics for research purposes. Details of HESA’s information sharing activities are set out in this notice. HESA is a Controller of your information. HESA is a registered charity and operates on a not-for-profit basis.

IFF Research is a Processor working on behalf of HESA to administer the Graduate Outcomes survey by phone.

Sometimes an HE provider’s circumstances change so that it isn’t compulsory to survey their graduates. In this case, the HE provider and HESA might agree to continue with the Graduate Outcomes survey for the provider’s graduates where this is in the public interest.

How did HESA get my contact details?

Contact details for the Graduate Outcomes survey are provided by the higher education provider you attended.

HESA receives data about higher education students in the UK. The higher education provider you attended sent your contact details to HESA so that you can take part in the Graduate Outcomes survey as described in the HESA Student Collection Notice.

If you studied at a further education college in England your contact details were provided to HESA from the Education and Skills Funding Agency (ESFA) via the Office for Students (OfS) through the Individualised Learner Record (ILR). Further education colleges can also provide your contact details to HESA directly.

Your contact details are only used by HESA and its data Processors to conduct the Graduate Outcomes survey and copies are deleted by each organisation when they are no longer needed for the survey. We anticipate that this will be approximately 12 months after the last cohort of each year's graduates have been surveyed to allow for any audit or re-survey that might be required by the funding and regulatory bodies, or any additional analysis related to the quality of the contact details. For example, for those graduating in 2019/20, contact details are likely to be deleted in December 2022.


Legal basis for processing your contact details information:

Processing of your contact details is necessary for the performance of a task carried out in the public interest and in the exercise of official authority vested in HESA (See GDPR Article 6(1)(e)).

Can someone else answer the survey on my behalf?

Yes, if you don’t complete the online survey (and your permanent home address prior to starting your course was in the UK or EU), we’ll try to contact you by phone. If we can’t get hold of you, but the phone is answered by someone who knows you well we may ask them just the core questions about what you’re doing after graduation.

If someone else completes the survey on your behalf and you would rather provide your own answers, you can still complete the survey yourself and over-write the third-party answers. Please contact [email protected] if you wish to do so.

Please note, however, that if you are a graduate of an English FE college then we will not ask someone else to complete the survey on your own behalf.

Will I be contacted for further surveys?

The funding and regulatory bodies listed in Purpose 3 below may undertake further research in the public interest into the outcomes of higher education including further surveys of graduates. If you are contacted about further surveys this contact will come from your higher education provider or from the organisation undertaking the research and will include further privacy information.

You might also be contacted by HESA or one of our Processors as part of an audit to check that the Graduate Outcomes survey has been undertaken properly.


How your information is used and who uses it

Purpose 1 - Your survey responses will be provided to your higher education provider

Your responses will be received by your HE provider who will only use the information for research and statistical purposes to help them improve the outcomes from their courses unless you give your permission for other uses via the survey.

Your HE provider will use your survey answers to research the outcomes of different courses and the effectiveness of career services. This research is used by HE providers to improve courses and services and to promote them to current and prospective students.

If the HE provider you attended has merged with another since you graduated then communications from Graduate Outcomes may refer to the name and logo of the provider you attended not the new merged HE provider. The newly merged HE provider will still be interested in your answers, but your answers will only go to the new merged HE provider once HESA has received confirmation that graduates have been informed of the merger. Your answers will continue to be used for Purposes 2-4 set out below.

HE providers will receive regularly updated information from survey responses during the survey period. This includes coded information on industries and occupations of employed graduates. This information may only be processed for the purpose of monitoring the progress of the Graduate Outcomes survey.

The survey asks if you are happy to be contacted by your HE provider in relation to your survey answers. If you answer ‘No’ then your provider may only use your survey answers for research and statistical purposes and they won’t need to contact you with further privacy information. 

If you answer ‘Yes’ then your provider may contact you, in relation to any of the information you give in the survey. No new contact details are given to HE providers so if they do contact you, they will use the contact information they already held before the survey. To update the contact details held by your provider please contact them directly.

Your HE provider will be a Controller of your information and will need to determine its own legal grounds for contacting you. If your provider does contact you they must give you further privacy information about how they will use your personal data.


Legal basis for processing your information for Purpose 1:

Processing of your information is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in HESA (see GDPR Article 6(1)(e)).

Processing of Special Categories of data is necessary for statistical and research purposes in accordance with Article 89(1) based on the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, or the Digital Economy Act 2017 or equivalent subsequent legislation, or for other research purposes falling within GDPR Article 9(2)(j) and DPA Schedule 1 paragraph 4.

Purpose 2 - Your responses are used by the HE funding and regulatory bodies who require HESA and your HE Provider to undertake this survey

This information is used by HE funding and regulatory bodies who have used a legal or regulatory power to require your HE provider and/or HESA to undertake the survey and provide information to them. These bodies use the information to understand the outcomes from higher education and for their statutory and/or public functions including funding, regulation and policy-making purposes. Your individual answers won’t be used to make decisions about you.

Your survey answers will be linked to information held about you as a student, including information you gave when you enrolled, and details of the qualification you gained. More information about the HESA Student record can be found in the HESA Student Collection Notice and more information about the Individual Learner Record can be found in the ILR Privacy Notice. This information is shared by HESA with the HE funding and regulatory bodies who commissioned the survey and who have the power to collect information from HE providers. These bodies include:


Your HESA information will be shared with these organisations as part of a large dataset which contains similar information about other people who have followed higher education courses in the UK. These organisations are also Controllers of your HESA information. This means that they make their own decisions about how to use it, and this may include publishing statistics and sharing the information with third parties, such as other government or public bodies or other organisations of the type listed elsewhere in this collection notice. However, all uses of your HESA information will be within the purposes set out in this collection notice and covered by data sharing agreements with HESA. These organisations will not use the data for the purposes of identifying you as an individual or to take decisions about you. These organisations may retain HESA information indefinitely for statistical and research purposes.

All uses of HESA information must comply with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.


Legal basis for processing your information for Purpose 2:

Processing of your HESA information is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in HESA (see GDPR Article 6(1)(e)).

Processing of Special Categories of data is necessary for statistical and research purposes in accordance with Article 89(1) based on the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, or the Digital Economy Act 2017 or equivalent subsequent legislation, or for other research purposes falling within GDPR Article 9(2)(j) and DPA Schedule 1 paragraph 4.

Purpose 3 - Public authorities carrying out their public functions

HESA acts as an information hub to provide data and statistics on higher education. While the bodies described in Purpose 2 (above) have legal or regulatory power to require information from certain HE providers, other public authorities also use your HESA information for their statutory and/or public functions including funding, regulation and policy-making purposes. Your survey responses will not be used to make decisions about you.

Education statistics and data:

Outside of its Designated Data Body activities HESA also acts as an information hub to provide information on higher education. HESA shares your HESA information with public authorities who require it to carry out their statutory and/or public functions. This data sharing is carried out in the public interest or in the exercise of official authority vested in HESA and the public authorities. Your HESA information will be shared with these organisations as part of a large dataset which contains similar information about other people who have followed higher education courses in the UK.

These organisations are also Controllers of your HESA information. This means that they make their own decisions about how to use it, and this may include publishing statistics and sharing the information with third parties, such as other government or public bodies or other organisations of the type listed elsewhere in this collection notice. However, all uses that they make of your HESA information will be within the purposes set out in this collection notice and covered by data sharing agreements with HESA. These organisations will not use the data for the purposes of identifying you as an individual or to take decisions about you. These organisations may retain HESA information indefinitely for statistical and research purposes, or for fixed terms depending on the terms of their data sharing agreements with HESA. Such organisations may include:

HE funding and regulatory bodies (in respect of information not collected under their relevant power – for example the Office for Students have power to collect information from English providers, but also need information from providers in other parts of the UK):


Education departments in England and in the devolved administrations:


Other bodies with public functions connected to education:


and any successor bodies. Further Controllers may be added to the list from time to time – please see the online version of this notice at www.graduateoutcomes.ac.uk/privacy-info.

Other uses of named data:

Your HESA information may also be used by some organisations who are also Controllers who carry out statistical and research tasks in the public interest or in the exercise of official authority that are not connected with education. Such uses may include the following:


The above list of organisations who may receive your HESA information will be subject to change over time. The above list will be updated on the Graduate Outcomes website www.graduateoutcomes.ac.uk/privacy-info from time to time, and you will need to monitor this link yourself if you wish to be aware of changes.   


Legal basis for processing your information for Purpose 3:

Processing of your HESA information is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in HESA (see GDPR Article 6(1)(e)).

Processing of Special Categories of data is necessary for statistical and research purposes in accordance with Article 89(1) based on the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, or the Digital Economy Act 2017 (see GDPR Article 9(2)(j) and DPA Schedule 1 paragraph 4).

Purpose 4 - Published statistics

HESA, your HE provider, and some of the public authorities listed in Purposes 2 and 3 publish statistics about the outcomes of higher education.

Part of HESA’s role is to produce and publish information about higher education in the public interest. This includes some National Statistics publications (https://uksa.statisticsauthority.gov.uk/about-the-authority/uk-statistical-system/types-of-official-statistics/) and online business intelligence and research services.

Graduate Outcomes statistics will also be published by some of the public authorities listed in Purposes 2 and 3, for example to provide employment statistics to help prospective students choose which courses to study.

When producing this material for publication, HESA applies its disclosure control, the HESA Standard Rounding Methodology, to ensure that no Personal Data is included and that individuals cannot be identified from published material.


Legal basis for processing your information for Purpose 4:

Processing of your HESA information is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in HESA (see GDPR Article 6(1)(e)).

Processing of Special Categories of personal data is necessary for statistical and research purposes in accordance with Article 89(1) based on the Equality Act 2010 and Section 75 of the Northern Ireland Act 1998 (see GDPR Article 9(2)(j) and DPA Schedule 1 paragraph 4).

Purpose 5 - Equal opportunity, research, journalism and other processing for statistical and research purposes

HESA information is used for research into higher education and the student population. This research can be academic, commercial, journalistic or for personal reasons. HESA prohibits the identification of individual students by those carrying out this research and information is not shared on a named basis.

HESA and the other Controllers (see Purposes 2 and 3) may also supply information to third parties where there is a legitimate interest in doing so for statistical and research purposes. Examples of use for this purpose include:

  • Provision of information to students and prospective students
  • Equal opportunities monitoring
  • Research - this may be academic research, commercial research or other statistical research where this is in the public interest
  • Journalism - where the relevant publication would be in the public interest e.g. league tables
  • Creation and operation of analysis tools, for example, Heidi Plus


Users to whom information may be supplied for Purpose 5 include:

  • Higher education sector bodies
  • Higher education providers
  • Academic researchers and students
  • Commercial organisations (e.g. recruitment firms, housing providers, graduate employers)
  • Unions
  • Non-governmental organisations and charities
  • Local, regional and national government bodies
  • Journalists


Information supplied by HESA to third parties within Purpose 5 is supplied under contracts which require that individuals shall not be identified from the supplied information, and this means that they also cannot use it to take decisions about you.

A copy of HESA’s current agreement for the supply of tailored information is available at https://www.hesa.ac.uk/services/custom/data/timescales-costs. Each agreement specifies the duration for which data may be processed. This is usually one year but may be longer, if necessary, for the specific research purpose. Each request for tailored information under Purpose 5 is assessed for its compliance with data protection legislation and its compatibility with this Collection Notice. HESA ensures that only the minimum amount of HESA information necessary for the specified research purpose is supplied to users. If the supplied information is to be published HESA's Rounding Methodology or an equivalent disclosure control must be applied to ensure that individuals cannot be identified from the published material and it does not constitute Personal Data.

A copy of HESA’s current agreement for access to Heidi Plus is available here. Each agreement specifies the purpose for which the data may be processed.

Processing within this Purpose 5 is carried out by HESA and by HESA Services Limited, HESA's wholly-owned subsidiary company. Other Controllers (listed under Purpose 2 and 3 above) may also process data for this purpose where this is necessary to fulfil their public functions.


Legal basis for processing your information for Purpose 5:

Processing of your HESA information is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in HESA (see GDPR Article 6(1)(e)).

Processing may also be necessary for the purposes of the legitimate interests of HESA in disseminating higher education information, or the legitimate interests of third parties in undertaking research in the field of higher education (see GDPR Article 6(1)(f)).

Processing of Special Categories of personal data is necessary for statistical and research purposes in accordance with Article 89(1) based on the duties in the Equality Act 2010 and Section 75 of the Northern Ireland Act 1998 (see GDPR Article 9(2)(j) and DPA Schedule 1 paragraph 4).

Purpose 6 - Use by HESA to perform its role as Designated Data Body for England and its equivalent roles for the other countries of the United Kingdom

Your HESA information is processed by HESA to collect, compile, publish and share data in accordance with this notice. This processing will include processing for purposes such as analysis & research to: review and improve data quality; data accuracy; and the usefulness; context & richness of the data/analysis HESA produces. It will also be processed to analyse and research the outcomes from education.

HESA processes your HESA information as part of a larger statistical dataset for the above purposes to:

  • Monitor and promote survey performance based on student characteristics.
  • Create derived fields to enrich data utility and insights of HESA data.
  • Contextualise the use of HESA data.
  • Research and understand progression through higher education. This may include linking to your HESA information in the Student Record: https://www.hesa.ac.uk/about/regulation/data-protection/notices.
  • Quality assure data and to remove anomalies and improve data accuracy.
  • Research into data quality and the sector’s reliance on time series data.
  • To review how changes and improvements can be made to HESA’s processing including systems and software and the implications that this would have on the data it produces.

Legal basis for processing your information for Purpose 6:

Processing of your HESA information is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in HESA (See GDPR Article 6(1)(e)).

Processing of Special Categories of data is necessary for statistical and research purposes in accordance with GDPR Article 89(1) in accordance with the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, the Digital Economy Act 2017 or equivalent subsequent legislation, or for other research purposes falling within GDPR Article 9(2)(j) and DPA Schedule 1 paragraph 4.

Processing of Special Categories of data may also be necessary for reasons of substantial public interest in accordance with the Equality Act 2010 or equivalent subsequent legislation (See GDPR Article 9(2)(g) and DPA Schedule 1 paragraph 6).

Purpose 7 - Support for individuals in crisis

In exceptional circumstances, where HESA becomes aware that your survey responses indicate that there is a significant risk posed to you or others, we may contact your provider or request a support organisation to contact you.

We will only share what you tell us and take the above steps in the following circumstances:

  • If you indicate that you have taken steps to end your life or you appear to be at risk of being unable to keep yourself safe from suicide
  • We believe that you or someone else has been, or is, at risk of serious harm.


We take your confidentiality very seriously and will only consider speaking to someone else or arranging for you to be contacted in the circumtances set out above. Where those circumstances apply, even if you haven’t given your provider explicit consent to contact you, we may still ask them to arrange contact.


Legal basis for processing your information for Purpose 7:

Processing of your HESA information is necessary to protect your vital interests (see GDPR Article 6(1)(d)) or in order to meet HESA’s legitimate interest in protecting your safety and well-being (see GDPR Article 6(1)(f)).

Processing of Special Categories of personal data is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject (see Article GDPR Article 9(2)(g), and DPA Schedule 1 paragraph 18).

Purpose 8 – Graduates whose information is returned to HESA on a voluntary basis

If you were a student studying at a higher education provider which has elected to participate in the Graduate Outcomes survey on a voluntary basis, HESA will use this data for purposes 3 to 6. If this purpose applies in relation to your higher education provider, your provider should inform you of this.

Sometimes an HE provider’s circumstances change so that it isn’t compulsory for it to participate in the survey. In this case, the HE provider and HESA (following consultation with relevant Statutory Customers) might agree to continue to allow the return of data by the provider for their graduates where this is considered to be in the public interest. Should the status of the provider change so that it becomes compulsory to submit student data to HESA, this will be collected under Purpose 1.


Legal basis for processing your information for Purpose 8:

Processing of your HESA information is necessary for the performance of a task carried out in the public interest (see GDPR Article 6(1)(e)).

Processing of Special Categories of data is necessary for statistical and research purposes in accordance with GDPR Article 89(1) in accordance with the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, the Digital Economy Act 2017 or equivalent subsequent legislation, or for other research purposes falling within GDPR Article 9(2)(j) and DPA Schedule 1 paragraph 4.

Processing of Special Categories of data may also be necessary for reasons of substantial public interest in accordance with the Equality Act 2010 or equivalent subsequent legislation (see GDPR Article 9(2)(g) and DPA Schedule 1 paragraph 6).

How is my HESA information linked to other information?

HESA information is sometimes linked to other data sources to enable more detailed research and analysis.

As indicated above, where HESA and organisations covered by Purpose 2 and 3 use HESA information this may include linking named or pseudonymised HESA information to other information for research purposes. Examples include linking to:

  • National Student Survey data – to place the results of this survey in context
  • School and Further Education data – to research progression to higher education and employment
  • Student Loans Company data – to research the use of student finance
  • Qualification awarding bodies data – to research the value and outcomes of qualifications
  • Employment, tax, and benefits data – to research the earnings of graduates and to better understand the outcomes of education (guidance on the use of HESA records matched to tax, benefits and employment data is available at: www.gov.uk/government/publications/longitudinal-education-outcomes-study-how-we-use-and-share-data)
  • UCAS data – to research the full higher education process from applications to outcomes
  • If you were a medical student, your HESA information may be included in the UKMED research database (www.ukmed.ac.uk). The General Medical Council is the Controller for this database used for researching doctors’ progression through their education and training.


Where HESA provides information from your HESA information to third parties under Purpose 5, the permitted uses of the information by a third party may include linking HESA information to other information held by the third party. Permission for such use is considered on a case-by-case basis. It is only given where the linking is for the purposes outlined in Purpose 5 and subject to the requirement not to carry out linking to identify individuals.

Further information about recipients of your HESA information

HESA publishes a register containing information relating to the recipients to whom we disclose data for statistical purposes. The live register can be found here: https://www.hesa.ac.uk/about/regulation/data-protection/register.


Your privacy rights

What are my rights?

Data protection legislation gives you rights over your personal data. These include rights to know what information is processed about you and how it is processed. These rights have to be met by HESA and any other organisation which takes decisions about how or why your information is processed.

You have the right to be informed about how your personal data is used. This Graduate Outcomes privacy notice is regularly reviewed to ensure that it accurately describes how your HESA information is used. This notice may be updated from time to time, for example when new legislation is enacted, or when new policies are implemented by the public authorities listed under Purposes 2 and 3. The most up to date version can always be found at www.graduateoutcomes.ac.uk/privacy-info and historic versions can be found at www.hesa.ac.uk/about/regulation/data-protection/notices/previous.

For further information about data protection, including contact details for HESA and HESA Services’ Data Protection Officer please see www.hesa.ac.uk/dataprot. If you have questions about how your HESA information is used, please contact [email protected].

Under the GDPR, you have the right of access to your personal information. You also have: rights to rectify inaccurate information, restrict processing, or object to processing; and the right to be forgotten (i.e. to seek erasure of your personal data). These rights are limited in certain circumstances. HESA will be able to implement erasure requests if they are made before 1 January 2022 for the current survey year (i.e. for leavers from the 2019/20 academic year). From that date onwards, it will not be possible for HESA to implement erasure requests: HESA will rely on GDPR Article 17(3)(b) and (d), as a basis for refusing your request.

If you do not want to complete the survey there is no obligation to do so. If you don't want to be contacted at all for the survey please email [email protected].

The survey may request your consent for your provider to contact you regarding your survey responses. If you wish to withdraw this consent at any point please email [email protected].

If you think there is a problem with the way HESA is handling your data, you have the right to complain to the Information Commissioner's Office: https://ico.org.uk/.

Is my data held securely?

HESA takes information security extremely seriously and is committed to keeping your data secure. HESA is certified to information security standards and undertakes detailed monitoring of its systems. This includes logging IP addresses of users of the survey system.

HESA is certified to the ISO27001 international standard for information security management, and the UK Cyber Essentials PLUS standard for cyber security. The systems used to run the Graduate Outcomes survey are subject to penetration testing to identify and minimise vulnerabilities.

The online survey system logs the IP address, operating system and browser of each user for security and audit purposes and to improve the quality of the survey system.

Is my information transferred to other countries?

Your HESA information may be transferred to countries outside the United Kingdom for the purposes described above.

Your HESA information will only be transferred to countries whose data protection laws have been assessed as adequate, or where adequate safeguards, are in place to protect your HESA information.


 

Temporary notice for graduates of English FE colleges

HESA is in the process of entering into new agreements with English FE colleges. It is not yet clear when all the new agreements will come into effect.

Where a provider has not yet entered into a new agreement with HESA, HESA will be acting as Processor for the Office for Students (which will be the data Controller) rather than as a data Controller in its own right. This continues to be the case for the following providers and is applicable to the 2017/18 (C17072) collection year:

  • Hadlow College
  • West Kent and Ashford College


Once the new agreements are in effect, HESA will process contact and survey information for English FE colleges as data Controller in accordance with this privacy notice. In the interim, if you are a graduate of a provider listed above, please refer to the Privacy Information for graduates from English further education colleges.