Each section has key information in bold text.

Further detail is provided in normal text.

Throughout this privacy notice we will link to the privacy documentation of the organisations with whom we share your information.

We will hyperlink the relevant privacy notices throughout to enable you to see how each recipient organisation processes your information. To access an organisation’s privacy page, simply click on the name of the organisation within each section.

Graduates of English Further Education (FE) colleges will be asked to take part in the survey. However, in a few respects their survey information may be treated differently from that of other graduates. Where this is the case, it is explained in this privacy notice.

The survey asks you about what you’re doing 15 months after completing your course. It also asks some subjective questions about how you feel about your current situation and general wellbeing.

The survey asks about what you were doing in a particular week (the census week) about 15 months after you completed a Higher Education (HE) course, and which activity was most important to you (e.g. working, studying, caring, traveling). Further questions ask for more details depending on what you specified as the most important activity.

Additional banks of questions may be included at the request of your university or college (‘higher education’ or ‘HE’ provider) and these will be clearly signposted.

Some questions depend on the type of course you completed, for example there are special questions for newly qualified teachers and postgraduate researchers.

If you were working during the census week, the survey also asks about your salary.

Some questions are designed to elicit the ‘graduate voice’ – giving you the chance to share your own assessment about the value of your course and the personal importance of what you’re doing now.

Other questions ask about your general wellbeing. These aren’t part of the core questions and you don’t have to share this information. Your HE provider won’t receive your answers to these questions in a way that identifies you (they will only get summaries of responses overall for their graduates as a group, not individually). Your answers will be provided to the public authorities in a way that identifies you, in line Purpose 2 of this privacy notice. 

Your survey responses are linked to data about when you were a student and these collectively make up “your HESA Information". Jisc is the controller of your HESA Information.

A full list of data items that may be included in your HESA Information is made available for each survey year below. If you need any assistance in identifying which records your HESA information may be included in, please contact [email protected] for guidance.

If you are a graduate who obtained a relevant HE qualification during the reporting period and whose study was full-time or part-time (including sandwich students and those writing-up theses) who are notified to Jisc or the relevant body, you will be surveyed based on the reporting periods in the table below.

The Reporting Period indicates the date on which you obtained your applicable qualification. The Collection Year indicates the survey year in which your ‘HESA Information’ is intended to be collected. For example, if you obtained your applicable qualification between 1 August 2023 to 31 July 2024, you will be invited to take part in the survey between December 2024 to November 2025.

Jisc identifies eligible graduates ahead of each Collection Year from the Student and Student Alternative collections. The Student Collection Notice provides further information regarding the use of personal data for the purpose of student and leaver surveys: https://www.hesa.ac.uk/about/regulation/data-protection/notices.

For further education colleges in England and Northern Ireland eligible graduates are identified by the Office for Students and Department for the Economy (Northern Ireland), respectively. For these graduates, Jisc will also receive fields necessary for monitoring equality of opportunity and eliminating unlawful discrimination, including information about ethnicity and disability status. This Special Category data will only be processed internally by Jisc for reasons outlined under Purpose 6 of this notice.

If you start the survey but don’t answer all the questions, we’ll send you email or text reminders or (if your permanent home address prior to starting your course was in the UK or EU) we’ll try to contact you by phone to complete it later.

The more questions you answer, the more useful your information will be. If you only answer some of the questions, we will still make use of this information. Depending on how many questions you have answered, we will use your information for some or all of the purposes set out below.

The survey is delivered by Jisc to help HE providers fulfil their legal requirement to report on the outcomes of HE to the funding and regulatory bodies. The funding and regulatory bodies commission the Graduate Outcomes survey and require Jisc and HE providers to work together to deliver the survey. Jisc employs an organisation called IFF Research to undertake the Graduate Outcomes survey by phone.

Jisc also works with a number of third party suppliers to deliver the survey. These are available at the link here: Our suppliers | HESA.

HE providers are required to give information to funding and regulatory bodies in England, Wales, Scotland and Northern Ireland (see Purpose 2 below).

Some of this information is collected by Jisc on behalf of these bodies (www.hesa.ac.uk/about).

In England, Jisc is the Designated Data Body and will use the information collected from the survey for its statutory functions under section 64 and section 65 of the Higher Education and Research Act 2018 (http://www.legislation.gov.uk/ukpga/2017/29/contents/enacted).

For more information on Jisc’s role within the statutory frameworks of Wales, Scotland and Northern Ireland, please visit the HESA website: https://www.hesa.ac.uk/about/what-we-do/statutory-w-s-ni.

In addition to its statutory functions, Jisc also acts as an information hub of HE data and statistics for research purposes. Details of Jisc’s information sharing activities are set out in this notice.

Sometimes an HE provider’s circumstances change so that it isn’t compulsory to survey their graduates. In this case, the HE provider and Jisc might agree to continue with the Graduate Outcomes survey for the provider’s graduates where this is in the public interest.

Contact details for the Graduate Outcomes survey are provided by the HE provider you attended.

Jisc receives data about HE students in the UK. Your HE provider sent us your contact details so that you can take part in the Graduate Outcomes survey as described in the Student Collection Notice.

Prior to 4 October 2022 your contact details were provided to HESA. HESA transferred these contact details to Jisc when both entities merged in October 2022.

If you studied at a further education college in England your contact details were provided to Jisc from the Education and Skills Funding Agency (ESFA) via the Office for Students (OfS) through the Individualised Learner Record (ILR). Further education colleges can also provide your contact details to Jisc directly.

If you received a loan or grant from the Student Loans Company (SLC), they may also have provided us with your contact details so that we can compare these with those received from your higher education provider or further education college and ensure we are using the most accurate information to send you the Graduate Outcomes survey.

Your contact details are only used by Jisc and its data Processors to conduct the Graduate Outcomes survey and copies are deleted by each organisation when they are no longer needed for the survey. We anticipate that this will be approximately 12 months after the last cohort of each year's graduates have been surveyed to allow for any audit or re-survey that might be required by the funding and regulatory bodies, or any additional analysis related to the quality of the contact details. For example, for those graduating in 2023/24, contact details are likely to be deleted in December 2026.

Legal basis for processing your contact details information:

Processing of your contact details is necessary for the performance of a task carried out in the public interest and in the exercise of official authority vested in Jisc (See GDPR Article 6(1)(e)).

Yes, if you don’t complete the online survey (and your permanent home address prior to starting your course was in the UK or EU), we’ll try to contact you by phone. If we can’t get hold of you, but the phone is answered by someone who knows you well we may ask them just the core questions about what you’re doing after graduation.

If someone else completes the survey on your behalf and you would rather provide your own answers, you can still complete the survey yourself and over-write the third-party answers. Please contact [email protected] if you wish to do so.

Please note, however, that if you are a graduate of an English FE college then we will not ask someone else to complete the survey on your own behalf.

The funding and regulatory bodies listed in Purpose 3 below may undertake further research in the public interest into the outcomes of HE including further surveys of graduates. If you are contacted about further surveys this contact will come from your HE provider or from the organisation undertaking the research and will include further privacy information.

You might also be contacted by Jisc or one of our Processors as part of an audit to check that the Graduate Outcomes survey has been undertaken properly.

Your responses will be received by your HE provider who will only use the information for research and statistical purposes to help them improve the outcomes from their courses unless you give your permission for other uses via the survey.

Your HE provider will use your survey answers to research the outcomes of different courses and the effectiveness of career services. This research is used by HE providers to improve courses and services and to promote them to current and prospective students.

If the HE provider you attended has merged with another since you graduated then communications from Graduate Outcomes may refer to the name and logo of the provider you attended not the new merged HE provider. The newly merged HE provider will still be interested in your answers, but your answers will only go to the new merged HE provider once Jisc has received confirmation that graduates have been informed of the merger. Your answers will continue to be used for Purposes 2-4 set out below.

HE providers will receive regularly updated information from survey responses during the survey period. This includes coded information on industries and occupations of employed graduates. This information may only be processed for the purpose of monitoring the progress of the Graduate Outcomes survey.

The survey asks if you are happy to be contacted by your HE provider in relation to your survey answers. If you answer ‘No’ then your provider may only use your survey answers for research and statistical purposes and they won’t need to contact you with further privacy information.

If you answer ‘Yes’ then your provider may contact you, in relation to any of the information you give in the survey. No new contact details are given to HE providers so if they do contact you, they will use the contact information they already held before the survey. To update the contact details held by your provider please contact them directly.

Your HE provider will be a Controller of your information and will need to determine its own legal grounds for contacting you. If your provider does contact you they must give you further privacy information about how they will use your personal data.

Legal basis for processing your information for Purpose 1:

Processing of your information is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Jisc (see GDPR Article 6(1)(e)).

Processing of Special Categories of data is necessary for statistical and research purposes in accordance with Article 89(1) based on the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, or the Digital Economy Act 2017 or equivalent subsequent legislation, or for other research purposes falling within GDPR Article 9(2)(j) and DPA Schedule 1 paragraph 4.

This information is used by HE funding and regulatory bodies who have used a legal or regulatory power to require your HE provider and/or Jisc to undertake the survey and provide information to them. These bodies use the information to understand the outcomes from HE and for their statutory and/or public functions including funding, regulation and policy-making purposes. Your survey responses will not be used to make decisions about you.

Your survey answers will be linked to information held about you as a student, including information you gave when you enrolled, and details of the qualification you gained. More information about the Student record can be found in the Student Collection Notice and more information about the Individual Learner Record can be found in the ILR Privacy Notice. This information is shared by Jisc with the HE funding and regulatory bodies who commissioned the survey and who have the power to collect information from HE providers. These bodies include:

•    England - Office for Students
•    Wales - Medr (Commission for Tertiary Education and Research)
•    Scotland - Scottish Funding Council
•    Northern Ireland - Department for the Economy

Your HESA Information will be shared with these organisations as part of a large dataset which contains similar information about other people who have followed HE courses in the UK. These organisations are also Controllers of your HESA Information. This means that they make their own decisions about how to use it, and this may include publishing statistics and sharing the information with third parties, such as other government or public bodies or other organisations of the type listed elsewhere in this collection notice. However, all uses of your HESA Information will be within the purposes set out in this collection notice and covered by data sharing agreements with Jisc. These organisations will not use the data for the purposes of identifying you as an individual or to take decisions about you. These organisations may retain HESA Information indefinitely for statistical and research purposes.

All uses of HESA Information must comply with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

Legal basis for processing your information for Purpose 2:

Processing of your HESA Information is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Jisc (see GDPR Article 6(1)(e)).

Processing of Special Categories of data is necessary for statistical and research purposes in accordance with Article 89(1) based on the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, or the Digital Economy Act 2017 or equivalent subsequent legislation, or for other research purposes falling within GDPR Article 9(2)(j) and DPA Schedule 1 paragraph 4.

Jisc acts as an information hub to provide data and statistics on HE. While the bodies described in Purpose 2 (above) have legal or regulatory power to require information from certain HE providers, other public authorities also use your HESA Information for their statutory and/or public functions including funding, regulation and policy-making purposes. Your survey responses will not be used to make decisions about you.

Education statistics and data:

Outside of its Designated Data Body activities Jisc also acts as an information hub to provide information on HE. Jisc shares your HESA Information with public authorities who require it to carry out their statutory and/or public functions. This data sharing is carried out in the public interest or in the exercise of official authority vested in Jisc and the public authorities. Your HESA Information will be shared with these organisations as part of a large dataset which contains similar information about other people who have followed HE courses in the UK.

These organisations are also Controllers of your HESA Information. This means that they make their own decisions about how to use it, and this may include publishing statistics and sharing the information with third parties, such as other government or public bodies or other organisations of the type listed elsewhere in this collection notice. However, all uses that they make of your HESA Information will be within the purposes set out in this collection notice and covered by data sharing agreements with Jisc. These organisations will not use the data for the purposes of identifying you as an individual or to take decisions about you. These organisations may retain HESA Information indefinitely for statistical and research purposes, or for fixed terms depending on the terms of their data sharing agreements with Jisc. Such organisations may include:

HE funding and regulatory bodies (in respect of information not collected under their relevant power – for example the Office for Students have power to collect information from English providers, but also need information from providers in other parts of the UK):

• Office for Students
• Medr (Commission for Tertiary Education and Research)
• Scottish Funding Council
• Department for the Economy

Education departments in England and in the devolved administrations:

• Department for Education
• Welsh Government
• Scottish Government
• Department for Business, Energy and Industrial Strategy

Other bodies with public functions connected to education:

• UK Research and Innovation
• Teaching Regulation Agency
• National Health Service bodies and organisations working with them e.g. Department of Health and Social Care and Health Education England
• General Medical Council

and any successor bodies. Further Controllers may be added to the list from time to time – please see the online version of this notice at www.graduateoutcomes.ac.uk/privacy-info.

Other uses of named data:

Your HESA Information may also be used by some organisations who are also Controllers who carry out statistical and research tasks in the public interest or in the exercise of official authority that are not connected with education. Such uses may include the following:

• Production of statistics in relation to the population of the UK and for statistical research, undertaken by the Office for National Statistics. Further information can be found on the ONS website
• Production of statistics and statistical research undertaken by National Records of Scotland and the Northern Ireland Statistics and Research Agency
• Monitoring of public expenditure by the National Audit Office
• Student Loans Company

The above list of organisations who may receive your HESA Information will be subject to change over time. The above list will be updated on the Graduate Outcomes website www.graduateoutcomes.ac.uk/privacy-info from time to time, and you will need to monitor this link yourself if you wish to be aware of changes.

Legal basis for processing your information for Purpose 3:

Processing of your HESA Information is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Jisc (see GDPR Article 6(1)(e)).

Processing of Special Categories of data is necessary for statistical and research purposes in accordance with Article 89(1) based on the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, or the Digital Economy Act 2017 (see GDPR Article 9(2)(j) and DPA Schedule 1 paragraph 4).

Jisc, your HE provider, and some of the public authorities listed in Purposes 2 and 3 publish statistics about the outcomes of HE.

Part of Jisc’s role is to produce and publish information about HE in the public interest. This includes some National Statistics publications (https://uksa.statisticsauthority.gov.uk/about-the-authority/uk-statistical-system/types-of-official-statistics/) and online business intelligence and research services.

Graduate Outcomes statistics will also be published by some of the public authorities listed in Purposes 2 and 3, for example to provide employment statistics to help prospective students choose which courses to study.

When producing this material for publication, Jisc applies a disclosure control, the HESA Standard Rounding Methodology, to ensure that no personal data is included and that individuals cannot be identified from published material.

Legal basis for processing your information for Purpose 4:

Processing of your HESA Information is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Jisc (see GDPR Article 6(1)(e)).

Processing of Special Categories of personal data is necessary for statistical and research purposes in accordance with Article 89(1) based on the Equality Act 2010 and Section 75 of the Northern Ireland Act 1998 (see GDPR Article 9(2)(j) and DPA Schedule 1 paragraph 4).

HESA Information is used for research into HE and the student population. This research can be academic, commercial, journalistic or for personal reasons. Jisc prohibits the identification of individual students by those carrying out this research and information is not shared on a named basis.

Jisc and the other Controllers (see Purposes 2 and 3) may also supply information to third parties including Jisc Services Limited where there is a legitimate interest in doing so for statistical and research purposes. Examples of use for this purpose include:

• Provision of information to students and prospective students
• Equal opportunities monitoring
• Research - this may be academic research, commercial research or other statistical research where this is in the public interest
• Journalism - where the relevant publication would be in the public interest e.g. league tables
• Creation and operation of analysis tools, for example, Heidi Plus

Users to whom information may be supplied for Purpose 5 include:

• HE sector bodies
• HE providers
• Academic researchers and students
• Commercial organisations (e.g. recruitment firms, housing providers, graduate employers)
• Unions
• Non-governmental organisations and charities
• Local, regional and national government bodies
• Journalists

Information supplied by Jisc to third parties within Purpose 5 is supplied under contracts which require that individuals shall not be identified from the supplied information, and this means that they also cannot use it to take decisions about you.

Each Jisc agreement for the supply of tailored information specifies the duration for which data may be processed. This is usually one year but may be longer, if necessary, for the specific research purpose. Each request for tailored information under Purpose 5 is assessed for its compliance with data protection legislation and its compatibility with this Collection Notice. Jisc ensures that only the minimum amount of HESA Information necessary for the specified research purpose is supplied to users. If the supplied information is to be published the HESA Rounding Methodology or an equivalent disclosure control must be applied to ensure that individuals cannot be identified from the published material and it does not constitute personal data.

Each Jisc agreement for access to Heidi Plus specifies the purpose for which the data may be processed.

Processing within this Purpose 5 is carried out by Jisc and Jisc Services Limited. Other Controllers (listed under Purpose 2 and 3 above) may also process data for this purpose where this is necessary to fulfil their public functions.

Legal basis for processing your information for Purpose 5:

Processing of your HESA Information is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Jisc (see GDPR Article 6(1)(e)).

Processing may also be necessary for the purposes of the legitimate interests of Jisc in disseminating HE information, or the legitimate interests of third parties in undertaking research in the field of HE (see GDPR Article 6(1)(f)).

Processing of Special Categories of personal data is necessary for statistical and research purposes in accordance with Article 89(1) based on the duties in the Equality Act 2010 and Section 75 of the Northern Ireland Act 1998 (see GDPR Article 9(2)(j) and DPA Schedule 1 paragraph 4).

Your HESA Information is processed by Jisc to collect, compile, publish and share data in accordance with this notice. This processing will include processing for purposes such as analysis & research to review and improve data quality, data accuracy and the usefulness, context & richness of the data/analysis Jisc produces. It will also be processed to analyse and research the outcomes from education.

Jisc processes your HESA Information as part of a larger statistical dataset for the above purposes to:

• Monitor and promote survey performance based on student characteristics
• Create derived fields to enrich data utility and insights of ‘HESA’ data
• Contextualise the use of ‘HESA’ data
• Research and understand progression through HE. This may include linking to your HESA Information in the Student Record: https://www.hesa.ac.uk/about/regulation/data-protection/notices
• Quality assure data and to remove anomalies and improve data accuracy
• Research into data quality and the sector’s reliance on time series data
• To review how changes and improvements can be made to Jisc’s processing including systems and software and the implications that this would have on the data it produces

Legal basis for processing your information for Purpose 6:

Processing of your HESA Information is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Jisc (See GDPR Article 6(1)(e)).

Processing of Special Categories of data is necessary for statistical and research purposes in accordance with GDPR Article 89(1) in accordance with the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, the Digital Economy Act 2017 or equivalent subsequent legislation, or for other research purposes falling within GDPR Article 9(2)(j) and DPA Schedule 1 paragraph 4.

Processing of Special Categories of data may also be necessary for reasons of substantial public interest in accordance with the Equality Act 2010 or equivalent subsequent legislation (See GDPR Article 9(2)(g) and DPA Schedule 1 paragraph 6).

In exceptional circumstances, where Jisc becomes aware that your survey responses indicate that there is a significant risk posed to you or others, we may contact your provider or request a support organisation to contact you.

We will only share what you tell us and take the above steps in the following circumstances:

• If you indicate that you have taken steps to end your life or you appear to be at risk of being unable to keep yourself safe from suicide
• We believe that you or someone else has been, or is, at risk of serious harm

We take your confidentiality very seriously and will only consider speaking to someone else or arranging for you to be contacted in the circumstances set out above. Where those circumstances apply, even if you haven’t given your provider explicit consent to contact you, we may still ask them to arrange contact.

Legal basis for processing your information for Purpose 7:

Processing of your HESA Information is necessary to protect your vital interests (see GDPR Article 6(1)(d)) or in order to meet Jisc’s legitimate interest in protecting your safety and well- being (see GDPR Article 6(1)(f)).

Processing of Special Categories of personal data is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject (see Article GDPR Article 9(2)(g), and DPA Schedule 1 paragraph 18).

If you were a student studying at a HE provider which has elected to participate in the Graduate Outcomes survey on a voluntary basis, Jisc will use this data for purposes 3 to 6. If this purpose applies in relation to your HE provider, your provider should inform you of this.

Sometimes an HE provider’s circumstances change so that it isn’t compulsory for it to participate in the survey. In this case, the HE provider and Jisc (following consultation with relevant Statutory Customers) might agree to continue to allow the return of data by the provider for their graduates where this is considered to be in the public interest. Should the status of the provider change so that it becomes compulsory to submit student data to Jisc, this will be collected under Purpose 1.

Legal basis for processing your information for Purpose 8:

Processing of your HESA Information is necessary for the performance of a task carried out in the public interest (see GDPR Article 6(1)(e)).

Processing of Special Categories of data is necessary for statistical and research purposes in accordance with GDPR Article 89(1) in accordance with the duties in the Equality Act 2010, Section 75 of the Northern Ireland Act 1998, the Digital Economy Act 2017 or equivalent subsequent legislation, or for other research purposes falling within GDPR Article 9(2)(j) and DPA Schedule 1 paragraph 4.

Processing of Special Categories of data may also be necessary for reasons of substantial public interest in accordance with the Equality Act 2010 or equivalent subsequent legislation (see GDPR Article 9(2)(g) and DPA Schedule 1 paragraph 6).

If you post publicly on social media (Twitter, Facebook, LinkedIn, Instagram) that you completed the Graduate Outcomes survey, Jisc may contact you to use this material to encourage fellow graduates to complete the survey.

Jisc will respond to your social media post and ask you to get in touch with Jisc if you’d like to participate in encouraging fellow graduates to complete the Graduate Outcomes survey. This may be a screenshot of your social media post, a quote from your social media post, or a quote or short video that you provide to Jisc. These materials may be used in survey invitation emails, newsletters, on the Jisc website, or on Jisc social media channels.

Legal basis for processing your information for Purpose 9:

Processing of your HESA Information in order to meet Jisc’s legitimate interest in collecting comprehensive Graduate Outcomes survey results (see GDPR Article 6(1)(f)).

HESA Information is sometimes linked to other data sources to enable more detailed research and analysis.

As indicated above, where Jisc and organisations covered by Purpose 2 and 3 use HESA Information this may include linking named or pseudonymised HESA Information to other information for research purposes. Examples include linking to:

• National Student Survey data – to place the results of this survey in context
• School and Further Education data – to research progression to HE and employment
• Student Loans Company data – to research the use of student finance
• Qualification awarding bodies data – to research the value and outcomes of qualifications
• Employment, tax, and benefits data – to research the earnings of graduates and to better understand the outcomes of education (guidance on the use of HESA records matched to tax, benefits and employment data is available at: www.gov.uk/government/publications/longitudinal-education-outcomes-study-how-we-use-and-share-data)
• UCAS data – to research the full HE process from applications to outcomes
• If you were a medical student, your HESA Information may be included in the UKMED research database (www.ukmed.ac.uk). The General Medical Council is the Controller for this database used for researching doctors’ progression through their education and training

Where Jisc provides information from your HESA Information to third parties under Purpose 5, the permitted uses of the information by a third party may include linking HESA Information to other information held by the third party. Permission for such use is considered on a case-by- case basis. It is only given where the linking is for the purposes outlined in Purpose 5 and subject to the requirement not to carry out linking to identify individuals.

Jisc publishes a register containing information relating to the recipients to whom we disclose data for statistical purposes. The live register can be found here: https://www.hesa.ac.uk/about/regulation/data-protection/register.

Data protection legislation gives you rights over your personal data. These include rights to know what information is processed about you and how it is processed. These rights have to be met by Jisc and any other organisation which takes decisions about how or why your information is processed.

You have the right to be informed about how your personal data is used. This Graduate Outcomes privacy notice is regularly reviewed to ensure that it accurately describes how your HESA Information is used. This notice may be updated from time to time, for example when new legislation is enacted, or when new policies are implemented by the public authorities listed under Purposes 2 and 3. The most up to date version can always be found at www.graduateoutcomes.ac.uk/privacy-info, and historic versions can be found at www.hesa.ac.uk/about/regulation/data-protection/notices/previous.

For further information about data protection, including contact details for Jisc’s Data Protection Officer please see www.hesa.ac.uk/dataprot. If you have questions about how your HESA Information is used, please contact [email protected].

Under the GDPR, you have the right of access to your personal information. You also have: rights to rectify inaccurate information, restrict processing, or object to processing; and the right to be forgotten (i.e. to seek erasure of your personal data). These rights are limited in certain circumstances. Jisc will be able to implement erasure requests if they are made before 1 January 2025 for the current survey year (i.e. for leavers from the 2022/23 academic year). From that date onwards, it will not be possible for Jisc to implement erasure requests: Jisc will rely on GDPR Article 17(3)(b) and (d), as a basis for refusing your request.

If you do not want to complete the survey, there is no obligation to do so. If you don't want to be contacted at all for the survey please email [email protected].

The survey may request your consent for your provider to contact you regarding your survey responses. If you wish to withdraw this consent at any point please email [email protected].

If you think there is a problem with the way Jisc is handling your data, you have the right to complain to the Information Commissioner's Office: https://ico.org.uk/.

Jisc takes information security extremely seriously and is committed to keeping your data secure. Jisc is certified to information security standards and undertakes detailed monitoring of its systems. This includes logging IP addresses of users of the survey system.

Jisc is certified to the ISO27001 international standard for information security management, and the UK Cyber Essentials standard for cyber security. The systems used to run the Graduate Outcomes survey are subject to penetration testing to identify and minimise vulnerabilities.

The online survey system logs the IP address, operating system and browser of each user for security and audit purposes and to improve the quality of the survey system.

Your HESA Information may be transferred to countries outside the United Kingdom for the purposes described above.

Your HESA Information will only be transferred to countries whose data protection laws have been assessed as adequate, or where adequate safeguards, are in place to protect your HESA Information.