OfS privacy
Privacy notice
How to use this privacy notice
Use the links below to select the reason that we process your personal information and see the following details:
- The specific personal information held and used
- Our purpose for using the information
- Our legal basis for using the information
- Any information we obtain from other sources
- Who we share the information with and the reason for this
- How long we will retain your personal data for
- A link to a more specific privacy notice (if applicable).
Unless otherwise stated we will not transfer your data to another country or do automated decision making.
|
The specific personal information held and used |
Depending on the purpose and context, the personal data we collect for our regulatory purposes may include:
Special category data, including:
|
|
Our purpose for using the information |
We mainly collect and process personal information in connection with performing any of our statutory functions. This includes (but is not limited to) the following:
|
|
Our legal basis for using the information |
|
|
Any information we obtain from other sources |
Other than the personal information collected from you directly, we also obtain personal information about you from other sources, listed below:
|
|
Who we share the information with and the reason for this |
We may also, from time to time, need to share your personal data with other third parties, including:
We may pass your information (routinely or otherwise) to any other organisation where that is connected to the performance of our functions or the functions of the receiving organisation. We will also pass your information to other organisations where we have a legal duty to do so. |
|
How long we will retain your personal data for |
We will determine the period for which we need to keep your personal data having regard to the reasons and purposes for which it was collected, our statutory duties and other legal obligations, the exercise and defence of any legal claims, including the period within which any current or potential future legal claims may be brought. After that point, your personal information will be confidentially and securely disposed of. |
|
A link to a more specific privacy notice (if applicable) |
Within our privacy notice, see also:
|
I am a current or former student at a higher education provider in England
- People who are current students at a higher education provider in England
- People who used to be students at a higher education provider in England
- People who have participated in a programme specifically funded by the OfS.
|
The personal data we process |
Special category data:
|
|||||||||||||||||||
|
Our purpose for processing the information |
We process personal information on students to enable us to fulfil our public tasks under the Higher Education and Research Act (HERA) 2017, including our responsibilities as the lead regulator for higher education in England. We use individualised and aggregate data relating to students in English higher education to inform and monitor funding allocations and to produce target lists, metrics and other data summaries. For further information, please view our guide to supplying data. We use artificial intelligence as part of this processing activity. For more information on our use of AI, please see the ‘Information security’ guidance section. |
|||||||||||||||||||
|
Our lawful basis for using the information |
|
|||||||||||||||||||
| Information we obtain from other sources |
Other than the personal information collected from you directly, we also obtain personal information about you from other sources, for example your higher education provider. If you have attended an educational establishment in the UK since 1994, then we will hold personal data about you from some or all of these sources:
|
|||||||||||||||||||
| Who the information is shared with and why |
We will share your personal information with other organisations for specific reasons:
We will not routinely disclose your information to any other organisation other than those listed except where required to do so as part of our functions or by law. Where personal information is disclosed routinely to another organisation, a contractual agreement will be in place to ensure the protection of your personal information and to ensure it is only used for the reasons described in this notice. |
|||||||||||||||||||
|
Whether the information will be transferred to another country |
Your personal information will be stored on servers in the UK or European Economic Area and will not be transferred outside those territories unless required by a court order. |
|||||||||||||||||||
| How long we will retain your personal data for |
We will only retain your personal data for as long as it is necessary to fulfil the purpose it was collected for, including for the purpose to comply with any legal, reporting or accounting requirements. After that point, your personal information will be confidentially and securely disposed of. Where student data is no longer necessary for ongoing functions, we may keep the data for the purposes of archiving for historical research or statistical purposes. For personal data relating to students, we consider archiving to be necessary to enable statistical analyses we must perform to fulfil our functions. |
|||||||||||||||||||
|
Other relevant privacy notices |
National Student Survey (NSS) - see the NSS privacy policy We also collect information directly from students in student surveys. See the ‘consultation and survey respondents’ section for further information. |
I am a current or former employee of a higher education provider
- People who are currently or formerly employed by a higher education provider in England.
|
The personal data we process |
Special category data:
For further details on categories of personal data, please see the links to more specific privacy notices at the bottom of this table. |
|
Our purpose for processing the information |
We process personal information to enable us to fulfil our public tasks under the Higher Education and Research Act (HERA) 2017, including our responsibilities as the lead regulator for higher education in England. We use individualised and aggregate data relating to students and staff in English higher education to inform and monitor funding allocations and to produce target lists, metrics and other data summaries. For further information, please view our guide to supplying data. We use artificial intelligence as part of this processing activity. For more information on our use of AI, see the ‘Information security’ guidance section. |
|
Our lawful basis for using the information |
|
|
Information we obtain from other sources |
Much of the information that we hold about provider staff is collected from other sources. If you have worked at an educational establishment in the UK since 1994, we will hold personal data about you from some or all of the following sources:
|
|
Who the information is shared with and why |
Where necessary or required, this information may be shared with:
We will not routinely disclose your information to any other organisation other than those listed except where required to do so as part of our functions or by law. Where personal information is disclosed routinely to another organisation, a contractual agreement will be in place to ensure the protection of your personal information and to ensure it is only used for the reasons described in this notice. |
|
Whether the information will be transferred to another country |
Your personal information will be stored on servers in the UK or European Economic Area and will not be transferred outside those territories unless required by a court order. |
|
How long we will retain your personal data for |
We will only retain your personal data for as long as it is necessary to fulfil the purpose it was collected for, including for the purpose to comply with any legal, reporting or accounting requirements. After that point, your personal information will be confidentially and securely disposed of. Where staff data is no longer necessary for ongoing functions, we may keep the data for the purposes of archiving for historical research or statistical purposes. For personal data relating to provider staff, we consider archiving to be necessary to enable statistical analyses we must perform to fulfil our functions. |
|
Other relevant privacy notices |
See the ‘registration’ section of this notice |
I am employed by a provider that is applying to register with the OfS
- People who are submitting an application to the OfS Register, on behalf of their provider
- People who are completing ‘fit and proper person checks’ as part of their provider’s registration process.
- People invited to attend an interview as part of the OfS’s assessment of the provider’s compliance with registration conditions.
| The specific personal information held and used |
As part of the provider registration process, we collect and process personal data relating to people in key governance, leadership, or ownership roles. This includes data gathered through the OfS Register, interviews (including audio and video recordings or written notes), and fit and proper person checks. Types of personal data collected:
|
| Our purposes for using the information |
Please note, we use artificial intelligence as part of this processing activity. AI is not used to carry out fit and proper persons checks or interviews, or to collect personal data. For more information on our use of AI, please see the ‘Information security’ guidance section. |
| Our legal basis for using the information |
We rely on the following legal bases under the UK GDPR:
Where special category data is processed (for example, ethnicity or health information) we rely on:
Where criminal offence data is processed, we rely on:
|
| Any information we obtain from other sources |
In addition to information collected directly, we may gather relevant information from other sources, for example:
|
| Who we share the information with and the reason for this |
We share your personal data with a small number of external organisations where necessary for regulatory purposes:
We may use a third party organisation to assist with ‘fit and proper person’ checks. We do not share your personal data beyond those listed unless required to do so by law or as part of our regulatory responsibilities. |
| How long we will retain your personal data for |
We only retain personal data for as long as it is needed for the purpose(s) for which it was collected. For providers that are approved and remain on the register, personal data may be retained for the duration of their registration and any ongoing regulatory activities. For providers that are deregistered or not approved, personal data will be retained for up to seven years from the date of deregistration or the decision not to register. Interview records, whether audio or video recordings or written notes, will be retained for no more than seven years. We will periodically review whether to retain or securely delete records in line with our regulatory needs and data protection principles. |
I am a stakeholder or a member of a board, committee or panel who regularly interacts with the OfS
- People who are currently or formerly board, committee and panel members
- People who are stakeholders working together, or interacting with, the OfS.
|
The specific information held and used |
|
| Our purpose for using the information |
As an independent regulator, the OfS needs to communicate regularly with its stakeholders in the higher education sector, government departments and other sector bodies. These stakeholders include chief executive officers of sector bodies that we work with and officers in government departments. In order to ensure that we can communicate with our stakeholders effectively, the OfS maintains a database of contact information for stakeholders. In addition:
|
|
Our legal basis for processing your personal information |
Our legal basis for holding this information depends on the reasons why we need to contact you:
Or
|
| Any information we obtain from other sources |
We obtain this information directly from stakeholders and their interactions from us. There will also be circumstances where we need to obtain your contact information from another source, so that we can contact you to meet our public task or a specified legitimate interest. For example, if you have recently joined a sector body that we work with and we do not have your contact details, we may need to obtain your details from a public source, such as your organisation’s website. |
|
Who we share the information with and the reason for this |
We will not routinely pass your information to any other organisation except where required to do so as part of our functions or by law. |
| How long we will retain your personal data for |
We will only retain your personal data for as long as it is necessary to fulfil the purpose it was collected for, including for the purpose to comply with any legal, reporting or accounting requirements. Board, committee and panel records are retained seven years from date of last document. |
|
A link to a more specific privacy notice (if applicable) |
Stakeholders can subscribe to receive emails and news alerts from the OfS. Please refer to the section 'Staying informed' for this privacy information. |
I’m responding to an OfS consultation or a survey
- People who respond to one of our consultations or surveys.
| The personal data we process |
The categories of personal information collected may vary depending on the specific consultation or survey. However, the information needed will include some or all of the following:
Special category data:
Where the information collected differs from the information set out in this notice, the specific information collected will be set out in an individual privacy notice for the relevant consultation or survey. |
| Our purpose for processing the information |
We process personal information about you in order to understand who has responded to the consultation or survey, and respondents’ views with the aim of being able to understand the different perspectives of stakeholders. We may also contact you for any queries relating to your responses. We may publish a summary of the consultation responses and, in some cases, the responses themselves. The specific information that will be published will be set out in the individual privacy notice for each consultation and survey. |
| Our legal basis for using the information |
Unless otherwise specified, the legal basis for processing your information is:
Where special category data is collected, the relevant lawful bases may be:
The relevant lawful bases will be set out in the individual privacy notice for each consultation and survey. |
| The right to withdraw consent |
Where we rely on your explicit consent to process special category data, you can withdraw your consent at any point if you are no longer happy with the use of your personal data. If you to wish to withdraw consent, please do so by emailing: [email protected] Once consent is withdrawn, we will destroy all relevant personal data unless we are relying on a different legal basis to justify keeping your personal information. If that is the case, we will tell you in writing. However, withdrawing your consent does not affect the lawfulness of processing based on consent before you withdrew consent. |
| Who the information is shared with and why |
Unless otherwise specified, responses are collected via SmartSurvey. To support the analysis of consultations, we occasionally share the information collected through consultations with external organisations. Unless otherwise specified, analysis is undertaken by Navigator Insight. See Navigator Insight’s Privacy Policy for further information. We will not routinely disclose your information to any other organisation, other than those listed, except where required to do so as part of our functions or by law. Where personal information is disclosed routinely to another organisation, a contractual agreement will be in place to ensure the protection of your personal information and to ensure it is only used for the reasons described above. |
| Whether the information will be transferred to another country |
Information held by SmartSurvey is routinely held on servers in the UK. In limited circumstances, it may be transferred to countries outside of the UK, for example where IT infrastructure and support arrangements require. Where that is the case, SmartSurvey has put in place appropriate safeguards as required under Article 46 of the UK GDPR. |
| How long we will retain your personal data for |
We will hold personal data from consultations for 12 months from the point that we publish our consultation response. Each survey will indicate the retention period in its own notice. After that point, your personal information will be confidentially and securely disposed of. If we need to keep your personal information for longer than the retention period above, we will update our privacy information to reflect this. |
|
Other relevant privacy notices |
I am attending an OfS conference or event
- Invitees and delegates of in-person conferences or events organised by the OfS.
| The specific personal information held and used |
If you choose to attend one of our events, you will be asked for the following:
|
| Our purpose for using the information |
Our purpose for collecting this information is so that we can manage our conferences and events, including event invitations, acceptances, contact details of invitees and delegates, dietary and access requirements. We use Eventbrite to manage our conferences and events. If you prefer not to use Eventbrite to respond to a conference or event invitation, you may respond directly using the contact details provided in the invitation. When you register for an OfS event using an Eventbrite form, you will be presented with a summary of how any personal information submitted will be used. The summary privacy information also includes a link to a more detailed privacy notice. We usually provide a list of delegates as part of the delegate pack for the conference or event. We will give you an opportunity to indicate if you do not wish your name, job title and institution or organisation to be included on the delegate list. Our key policy events may have a member of staff taking informal photos of the event, some of which may be published on our social media feeds. Photos will focus on speakers, but delegates may be captured incidentally. If you do not wish to be included in any photos, please make this known to a member of staff at the beginning of the event. |
| Our legal basis for using the information |
To ensure the effective management and running of OfS events:
Access and dietary requirements:
|
| Who we share the information with and the reason for this |
We share information on numbers of delegates as well as access and dietary requirements (where supplied) with the conference venue or other event suppliers but not in way that identifies individuals. |
| Your rights over your personal information |
Information about access and dietary requirements - Withdrawal of consent |
|
Whether we intend to transfer information to another country |
Eventbrite processes data (including any personal data submitted by booking one of our events) in the USA. Because this means your information will be held outside the UK we have assessed the risks with storing your personal information in this country and are satisfied that it will not be put at any undue risk as a result. The reasons for this are there is an appropriate transfer mechanism in place (Standard Contractual Clauses) and an adequate level of protection for the nature of the personal data to be transferred. Please only submit any personal data which you are happy to have processed in this way, and in accordance with Eventbrite’s privacy policy. If you prefer not to use Eventbrite for responding to a conference or event invitation, you may respond directly to the OfS by contacting the event organiser using the details provided in the invitation. |
|
How long we will retain your personal data for |
We are only able to retain a copy of your personal information as long as it is still needed for the purpose(s) for which it was collected. The personal information you have submitted will be kept for one month after the event. After that point, your personal information will be confidentially and securely disposed of. Eventbrite keeps registrations indefinitely. |
|
A link to a more specific privacy notice or information page (if applicable) |
I am attending an OfS webinar
- People who participate in our webinars for events, workshops and conferences.
|
The specific personal information held and used |
|
|
Our purpose for processing the information |
The OfS holds webinars, events, workshops and conferences to promote its work as a regulator and to support its statutory functions. We usually use Zoom and Microsoft Teams to deliver and manage webinars, allowing participants to log in and attend webinars at the time or view the webinar later. |
|
Our legal basis for using the information |
We have a legitimate interest in collecting your personal information to ensure that the OfS has the necessary information to host webinars effectively, and to also ensure only invited individuals attend webinars or view webinars later. |
|
Any information we obtain from other sources |
We usually use Zoom and Teams to deliver and manage webinars. We also use Teams to host external meetings and events. On occasion, we use Eventbrite to allow attendees to register for online events we host. |
|
Who we share the information with and the reason for this |
We will not disclose your information to any other organisation except where required to do so as part of our functions or by law. |
|
Whether we intend to transfer to another country |
Eventbrite and Zoom are based in the United States. If you choose to register for an event through Eventbrite, any personal information you submit will be transferred to the United States. Zoom, in certain cases, will transfer data to the United States, as well as to other countries outside of the EEA. |
|
How long we will retain your personal data for |
We will only retain your personal data for as long as it is necessary to fulfil the purpose it was collected for.
|
|
A link to a more specific privacy notice or information page (if applicable) |
I am a social media user
- Information we gather through social media platforms.
|
The personal data we process |
Personal data posted on social media platforms and other public sources, including:
|
|
Our purpose for processing the information |
We use social media to understand what the wider public is saying about the Office for Students and the sentiment and conversations around other topics relevant to students and the higher education sector. We also use social media for our general regulatory purposes, including to identify potential regulatory issues and sector-wide emerging themes. To achieve these aims, we use a social listening tool to monitor publicly available social media and generate reports about trends, insights, and regulatory issues across the higher education sector. |
|
Our lawful basis for using the information |
UK GDPR Article 6(1)(e) Public task – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. |
|
Information we obtain from other sources |
Other than the personal information collected from you directly, we also obtain personal information about you from Pulsar, a social listening tool to monitor and analyse publicly available posts from social media sites, blogs, forums, and news sites. |
|
Who the information is shared with and why |
We will not routinely pass your information to any other organisation except where required to do so as part of our functions or by law. |
|
Whether the information will be transferred to another country |
We do not store data from social media users on our servers. Instead, your personal information will be stored by the individual social media companies, on their own servers. Please note, Pulsar, LinkedIn, YouTube (Google), X, and Facebook and Instagram (Meta) all share data outside of the European Economic Area. Their privacy notices are linked at the end of this table. |
|
How long we will retain your personal data for |
Any personal data that underpins the aggregate reports will be retained by the social media monitoring and listening company for a maximum of two years. After that point, your personal information will be confidentially and securely disposed of. If we need to keep your personal information for longer than two years, we will update our privacy information to reflect this. |
|
Other relevant privacy notices |
I have given permission or signed up to receive information about OfS news, events and opportunities to be involved in the work of the OfS
- People who have subscribed to receive OfS alert emails
- People who have subscribed to receive the OfS monthly update
- People who have subscribed to receive the OfS ‘Student News’ newsletter (previously named 'Student spotlight')
|
The personal data we process |
|
| Our purpose for processing the information |
We will use your information to:
|
| Our lawful basis for using the information |
UK GDPR Article 6(1)(a) Consent - the data subject has given consent to the processing of his or her personal data for one or more specific purposes. |
| The right to withdraw consent |
You can withdraw your consent at any point if you are no longer happy with the use of your personal data for a specific reason. If you to wish to withdraw consent, please do so by clicking ‘unsubscribe’ link on the bottom of any email you receive. Alternatively, you can contact our Digital team at [email protected]. Once consent is withdrawn, we will destroy all relevant personal data unless we are relying on a different legal basis to justify keeping your personal information. If that is the case, we will tell you in writing. However, withdrawing your consent does not affect the lawfulness of processing based on consent before you withdrew consent. |
| Who the information is shared with and why |
We use Mailchimp (owned by Intuit) as our mailing platform. Your personal data will be shared with Intuit for processing in accordance with its privacy policy. We will not routinely disclose your information to any other organisation other than those listed except where required to do so as part of our functions or by law. Where personal information is disclosed routinely to another organisation, a contractual agreement will be in place to ensure the protection of your personal information and to ensure it is only used for the reasons described above. |
|
Whether the information will be transferred to another country |
Mailchimp is based in the United States; therefore, when you subscribe to any of our newsletters, your personal data will be processed by Mailchimp in the USA. Because this means your information will be held outside the EEA, we have assessed the risks with storing your personal information in this country and are satisfied that it will not be put at any undue risk as a result. The reasons for this are set out below:
Mailchimp also reserves the right to transfer your personal data to other countries in which its service providers operate. For further information, you may wish to read Intuit’s privacy policy. |
| How long we will retain your information for |
Your personal data will be processed until you withdraw consent. Once consent is withdrawn, we will maintain a record of this to ensure that we don’t send you any further emails. In addition to the categories of personal data listed above, we will keep information relating to:
Following the withdraw of consent, if you would like us to erase your personal data completely, you can contact our Digital team at [email protected] to request this. |
| Other relevant privacy notices |
I am a third-party supplier to the OfS
- People or organisations that provide unique services or goods to the OfS.
- People or organisations that bid on invitations to tender and other procurement opportunities.
| The personal data we process |
We may also process criminal offence data to allow us to comply with our legal obligations under the Procurement Act 2023 and the Procurement Regulations 2024. As part of the credit checks (carried out by a third party, see ‘any information we obtain from other sources’ below), we process the following information of people with significant control:
|
| Our purpose for processing the information |
|
| Our lawful basis for using the information |
|
| Whether individuals are under a statutory or contractual obligation to provide the personal data |
In the context of this processing, the personal data of connected persons is required by the Procurement Act 2023 and the Procurement Regulations 2024. That is:
If this data is not provided, we will not be able to process supplier's bids for invitations to tender and other procurement opportunities. |
| Information we obtain from other sources |
We use a third party for credit checks – Creditsafe We process personal data jointly with the Cabinet Office via the Find a Tender service. |
| Who the information is shared with and why |
We use a third-party company, BiP Solutions, for managing and storing procurement and contract records. We are required to publish contract award notices through the Find a Tender service portal (Delta e-sourcing). This includes who the contract was awarded to, a contact name, phone number and email address. We will not routinely pass your information to any other organisation except where required to do so as part of our functions or by law. |
| Whether the information will be transferred to another country |
Your personal information will be stored on servers in the UK and will not be transferred outside that territory unless required by a court order. |
| How long we will retain your information for |
After that point, your personal information will be confidentially and securely disposed of. If we need to keep your personal information for longer than the stated retention period, we will update our privacy information to reflect this. |
| Other relevant privacy notices |
I am applying for a job with the OfS
- Job applicants (current or former).
|
|
Employees |
Board and committee members (with the exception of quality assessors) |
|
The personal data we process
|
Optional data, including special category data (you can select ‘prefer not to say’ for all these categories):
Our hiring managers shortlist applications for interview. Any special category data supplied is not shared outside the HR team (including hiring managers). Your application will not be affected if you choose not to supply this data. Any special category data used for reporting purposes will be aggregated and anonymised. Strict controls are in place to ensure that individuals cannot be identified in any published data. If we invite you to an interview, we will ask if you require any reasonable adjustments to be made in relation to the interview process. This information will be held and used separately from the application form. Some roles require you to take an online assessment. If we make a conditional offer of employment, we will ask you for the following personal data so that we can carry out pre-employment checks and health questionnaire:
Some roles require a higher level of security clearance and, if this is the case, we will let you know. If we make a final offer, we will also ask for the following:
|
Optional data, including special category data (you can select ‘prefer not to say’ for all these categories):
Our corporate governance team shortlist applications for interview. Any special category data supplied is not shared outside the HR team (including the corporate governance team). Your application will not be affected if you choose not to supply this data. Any special category data used for reporting purposes will be aggregated and anonymised. Strict controls are in place to ensure that individuals cannot be identified in any published data. If we invite you to an interview, we will ask if you require any reasonable adjustments to be made in relation to the interview process. This information will be held and used separately from the application form. If we make a final offer, we will also ask for the following:
Some roles require a higher level of security clearance and, if this is the case, we will let you know. |
|
Our purpose for processing the information |
We will use your information for the following purposes:
We are a Disability Confident Employer and may ask for certain information to enable us to carry out our responsibilities in this area – for example, making reasonable adjustments for any part of the selection process. You must successfully complete pre-employment checks to progress to a final offer. We are legally required to confirm your identity and right to work in the UK. |
We will use your information for the following purposes:
. |
|
Our legal basis for using the information |
|
|
|
Whether individuals are under a statutory or contractual obligation to provide the personal data |
In the context of this processing, prospective employees are required under contract to provide the personal data requested during the recruitment and onboarding process. Without it we will not be able to fully process your application to the point of offer. You may choose not to provide the optional data, including special category data listed above, by selecting ‘prefer not to say’ during your application. |
|
|
Information we obtain from other sources |
|
|
|
The right to withdraw consent |
When providing us with optional special category data in the application, consent must be a clear positive action that you have given your agreement to the use of your personal information, and consent can also be withdrawn at any point if you are no longer happy with the use of your personal information for a specific reason. If you to wish to withdraw consent, please do so by emailing: [email protected] Once consent is withdrawn, we will destroy all relevant personal information unless we are relying on a different legal basis to justify keeping your personal information. If that is the case, we will tell you in writing. However, withdrawing your consent does not affect the lawfulness of processing based on consent before you withdrew consent. |
|
|
Who the information is shared with and why |
We will share your personal information with other organisations for specific reasons, as explained below:
We will not routinely disclose your information to any other organisation other than those listed except where required to do so as part of our functions or by law. In exceptional circumstances, your information may be shared with someone who is not an OfS employee but is working with us to recruit individuals to an OfS role. Where personal information is disclosed routinely to another organisation, a contractual agreement will be in place to ensure the protection of your personal information and to ensure it is only used for the reasons described above. |
We will share your personal information with other organisations for specific reasons, as explained below:
We will not routinely disclose your information to any other organisation except where required to do so as part of our functions or by law. In exceptional circumstances, your information may be shared with someone who is not an OfS employee but is working with us to recruit individuals to a committee or panel. Where personal information is disclosed routinely to another organisation, a contractual agreement will be in place to ensure the protection of your personal information and to ensure it is only used for the reasons described above. |
|
Whether the information will be transferred to another country |
Workday and may transfer your personal data to a country outside of the UK or European Economic Area. Because this means your information will be held outside the European Economic Area, we have assessed the risks with storing your personal information in these countries and are satisfied that it will not be put at any undue risk as a result. The reasons for this are due to Workday’s binding corporate rules and reliance on the following transfer mechanisms:
|
|
|
How long we will retain your information for |
Unless you are appointed, the personal information you have submitted will be kept for one year after the advert has closed. After that point, your personal information will be confidentially and securely disposed of. If we need to keep your personal information for longer than the retention period above, we will update our privacy information to reflect this. |
|
|
Other relevant privacy notices |
|
|
I am a member of the OfS board or an OfS committee
|
The personal data we process
|
Personal data:
Special category data:
|
|
Our purpose for processing the information |
Your personal data is processed primarily for the administration of current and former board and committee members. We will use the personal information supplied by you or collected as part of your engagement for all purposes associated with the administration of our relationship, including to publish registers of interests on the OfS website and, if required, related party transactions in our annual report and accounts. To achieve the above aims, the specific uses that will be made of your personal information are listed below:
We will only collect information about criminal convictions or allegations of criminal behaviour where it is appropriate given the nature of the role and where we are legally able to do so. We will collect information about criminal convictions if we are notified of such information directly by you while you are engaged with us. More information about background checks is provided as part of the recruitment process. |
|
Our lawful basis for using the information |
Depending on the processing activity, we rely on the following legal bases to process your personal information:
For the special categories of personal data listed above, the additional legal bases for processing that we rely on are:
|
|
Information we obtain from other sources |
The OfS collects personal information about board, committee and panel members through the application and recruitment process, either directly from candidates or sometimes from an employment agency or background check provider, and then through your engagement with us. Sometimes we collect additional information from third parties, such as:
|
|
Who the information is shared with and why |
We will publish your interests in a register of interests on the OfS website. We may publish related party transactions in the annual report and accounts. We will share your personal information with other organisations for specific reasons, where such transfer forms part of the administration of our relationship, as explained below:
A list of third party service providers that might process your personal information is available on request. We will not routinely disclose your information to any other organisation other than those listed except where required to do so as part of our functions or by law. |
|
Whether the information will be transferred to another country |
We will store your personal information on servers in the UK and we will not routinely transfer it outside of that territory unless required by a court order. Workday and Diligent, acting as our data processors, process personal data globally, including in countries that are not regarded as ensuring an adequate level of protection of personal data when compared to the protection afforded under the UK GDPR. Because this means your information will be held outside the EEA, we have assessed the risks with storing your personal information in those countries and are satisfied that it will not be put at any undue risk as a result. Both organisations have put in place appropriate safeguards (such as transferring data under the UK Extension to the EU-US Data Privacy Framework (DPF) or under standard contractual clauses) in accordance with applicable legal requirements. |
|
How long we will retain your information for |
We will only retain your personal data for as long as it is necessary to fulfil the purpose it was collected for, including for the purpose to administer our relationship or to comply with any legal obligations and in accordance with our retention schedule. After that point, your personal information will be confidentially and securely disposed of. If we need to keep your personal information for longer than the retention period above, we will update our privacy information to reflect this. |
I am submitting a request under access to information legislation
- People who submit a request for information under the Freedom of Information Act 2000, the Environmental Information Regulations 2004 or the Re-use of Public Sector Information Regulations 2015.
- People who make a subject access request or another request about their information under the Data Protection Act 2018 (DPA) and UK General Data Protection Regulation (UK GDPR).
|
The personal information we process |
We do not actively seek special category data, but on occasion, those making a complaint may refer to special category data such as their racial or ethnic origin, opinions or beliefs, or health data as part of their complaint. These are classed as special categories of personal data:
|
|
Our purpose for processing the information |
We use your name and contact details so that we can respond to your request for information. If you are making a subject access request or another request under the DPA or UK GDPR, we may require a form of identification so that we can verify your identity and search for your personal data. If you are making a subject access request or another request under the DPA or UK GDPR on behalf of another person, we may require a form of identification and confirmation that you are entitled to act on this person’s behalf before we begin processing your request. If you are making a data protection complaint, we will use your personal data to handle the complaint and any subsequent issues, but also to check on the level of service we provide:
Our data protection complaints process is set in accordance with our obligations under the Data Protection Act 2018. |
|
Our lawful basis for using the information |
If a complainant chooses to share special category data with us as part of their complaint against the OfS the lawful basis for processing is:
|
|
Who the information is shared with and why |
We will not routinely pass your information to any other organisation except where required to do so as part of our functions or by law. However, in some circumstances we may need share your details with third parties so that we can respond to your request, for example the Information Commissioner's Office. |
|
Whether the information will be transferred to another country |
Your personal information will be stored on servers in the UK and will not be transferred outside that territory unless required by a court order. |
|
How long we will retain your personal data for |
The personal data and information related to your request or subsequent appeals will be retained for three years from date created. The personal data related to any data protection complaint you may submit will be retained for three years. After that point, your personal information will be confidentially and securely disposed of. If we need to keep your personal information for longer than three years, we will update our privacy information to reflect this. |
|
A link to a more specific privacy notice or information page (if applicable) |
I am making a notification about a provider
- Students, staff members and members of the public who wish to let us know about an issue within a university or college registered with the OfS.
|
The personal data we process |
Personal data:
In some instances, this might include special category data. These are classed as special categories of personal data:
|
|
Our purpose for processing the information |
A notification is a way for students, staff members or others to let us know about an issue at university or college. Notifications are sent to us by email to [email protected] or via other routes. We process your personal information to review notifications and decide whether or not to investigate further, to take regulatory action, or both. We may need to contact you again if we require any further details. |
|
Our lawful basis for using the information |
If you choose to share special category data with us as part of your notification, the lawful basis for processing is:
|
|
Information we obtain from other sources |
We sometimes receive notifications, and related information, on behalf of others, for example:
|
|
Who the information is shared with and why |
We may share information obtained in the course of our review or other activity with other bodies, including:
Our general approach is to make every attempt to protect a notifier’s identity from a university or college where requested, and we can normally share information about a notification without revealing this. Sometimes the nature of a notification reveals the notifier’s identity, or those of students the concerns relate to, especially if the issue has already been raised directly with the university or college. If you are worried that an identity could be revealed if we contact a university or college about your notification, please let us know so that we can consider how best to proceed. We wouldn’t expect submitting a notification to negatively impact your studies. We will not routinely disclose your information to any other organisation other than those listed, except:
Where personal information is disclosed routinely to another organisation, a contractual agreement will be in place to ensure the protection of your personal information and to ensure it is only used for the reasons described above. |
|
Whether the information will be transferred to another country |
Your personal information will be stored on servers in the UK or European Economic Area and will not be transferred outside that territory unless required by a court order. |
|
How long we will retain your personal data for |
We will keep your personal data for ten years. After that point, your personal information will be confidentially and securely disposed of. If we need to keep your personal information for longer than ten years, we will update our privacy information to reflect this. |
|
Other relevant privacy notices or information |
See information about OfS notifications |
I am making a complaint about the OfS
|
The personal data we prcoess |
We do not actively seek special category data, but on occasion, those making a complaint may refer to special category data such as their racial or ethnic origin, opinions or beliefs, or health data as part of their complaint. These are classed as special categories of personal data:
|
|
Our purpose for processing the information |
We use personal information to respond to a complaint. Often we need to redirect a complaint to the OfS notifications email address, as the correspondence is not a complaint within the scope of the scheme, but instead concerns a student’s provider. Where complaints are submitted to us by email at [email protected] or via other routes, we will use and retain the information supplied to us to handle the complaint and any subsequent issues, and to check on the level of service we provide:
Our complaints process follows and is subject to the Parliamentary and Health Service Ombudsman’s principles of good complaint handling. |
|
Our lawful basis for using the information |
If a complainant chooses to share special category data with us as part of their complaint against the OfS, the lawful basis for processing is:
|
|
Who the information is shared with and why |
In the event of a complaint about the OfS itself, we will share your personal information with other organisations for specific reasons:
We will not routinely disclose your information to any other organisation other than those listed except where required to do so as part of our functions or by law. Where personal information is disclosed routinely to another organisation, a contractual agreement will be in place to ensure the protection of your personal information and to ensure it is only used for the reasons described above. |
|
Whether the information will be transferred to another country |
Your personal information will be stored on servers in the UK and will not be transferred outside that territory unless required by a court order. |
|
How long we will retain your personal data for |
The personal data relating to your complaint may be kept for up to 10 years from the end of the project, case closure or date created, if it is considered to come within the scope of our complaints policy. After that point, your personal information will be confidentially and securely disposed of. If we need to keep your personal information for longer than ten years, we will update our privacy information to reflect this. |
|
A link to a more specific privacy notice or information page (if applicable) |
Our complaints process follows, and is subject to, the Parliamentary and Health Service Ombudsman’s principles of good complaint handling. |
How we use information captured by CCTV at our Bristol office
- People who visit our premises including staff, onsite contractors and visitors
| The personal data we process |
|
| Our purpose for processing the information |
|
| Our lawful basis for using the information |
|
| Who the information is shared with and why |
We do not routinely share CCTV footage with anyone outside our organisation. We will only share it when required by law or where it is reasonable and proportionate to do so, for example in response to a legitimate request from the police. We keep a record of all disclosures. |
|
Whether the information will be transferred to another country |
Your personal information will be stored on servers in the UK and will not be transferred outside that territory unless required by a court order |
|
How long we will retain your information for |
CCTV footage will ordinarily be kept for one month but may be retained for up to 60 days. Copies of images taken in response to incidents or to legitimate requests by a third party may be retained for up to six months. After that point, your personal information will be confidentially and securely disposed of. If we need to keep your personal information for longer than the retention period above, we will update our privacy information to reflect this. |
|
Additional information |
|
We meet pre-arranged visitors at our Bristol offices, including:
- People visiting our premises to attend a meeting or an interview
- People who are on-site contractors.
Our London office is part of a shared government building, where visitor arrangements are controlled by our landlord, the Government Property Agency (GPA).
| The personal data we process |
For visitors, we routinely collect:
Special category data
For OfS staff, and for staff from our tenant organisation (Research England) we collect:
Special category data
|
| Our purpose for using the information |
We use visitor information for security and safety reasons: to manage our office sites and building access (including car park at our Bristol office) effectively, securely and safely. Your name and visit details will be shared with the on-site team before your visit, so that they know to expect you. You'll be asked to sign in and out and may be asked to show a form of photo ID. This is for identification only; we don't keep a record of this information. You'll be given a personalised paper pass which you must wear throughout your visit. This pass will be destroyed when you leave the site. You are invited to share any information which may impact your building access requirements. We also process your personal information to manage our health and safety processes, including the reporting of accident and incident reporting. |
| Our lawful basis for using the information |
Very occasionally we may need to process your special category data to protect your vital interests or those of another person where you are incapable of giving your consent (Article 9(2)(c)). For example, by providing your personal data to ambulance or healthcare professionals if you are unconscious or otherwise unable to speak for yourself. |
|
Information we obtain from other sources |
Images captured using CCTV: static or moving imagery is recorded of those who visit the OfS building and staff. This is covered by a separate privacy notice. For our London office managed by the GPA, the GPA will share information with us to manage and develop the government property estate, and to provide building services and facilities in a safe and secure environment. |
| Who the information is shared with and why |
In some circumstances we may need to share your personal information with other organisations for specific reasons. The information may be handled and used by the following recipients to maintain a safe, secure, efficient, and compliant environment for our colleagues, stakeholders and visitors:
For our London office managed by the GPA, we will share information with the GPA to enable the provision of landlord, workplace and organisational services. We will not routinely disclose your information to any other organisation other than those listed except where required to do so as part of our functions or by law. Where personal information is disclosed routinely to another organisation, a contractual agreement will be in place to ensure the protection of your personal information and to ensure it is only used for the reasons described above. |
| Whether the information will be transferred to another country | Your personal information will be stored on servers in the UK or European Economic Area and will not be transferred outside that territory unless required by a court order. |
| How long we will retain your personal data for |
We will only retain your personal data for as long as it is necessary to fulfil the purpose it was collected for:
For OfS staff and Research England staff:
After that point, your personal information will be confidentially and securely disposed of. If we need to keep your personal information for longer than specified here, we will update our privacy information to reflect this. |
| Other relevant privacy notices |
I am an employee of the OfS, or a member of a board, committee, or panel, for whom corporate travel has been arranged.
| The personal data we process |
Personal data:
Special category data:
|
| Our purpose for processing the information |
We will use your information in the following ways:
|
| Our lawful basis for using the information |
|
| Who the information is shared with and why |
We will share your personal information with other organisations for specific reasons, as explained below:
Where necessary, our supplier will further share relevant personal data with organisations involved in delivering your travel arrangements. This may include, for example:
This sharing is limited to what is necessary to arrange and deliver your travel and make any reasonable adjustments. We will not routinely disclose your information to any other organisation other than those listed above, except where required to do so as part of our functions or by law. Where personal information is disclosed routinely to another organisation, a contractual agreement will be in place to ensure the protection of your personal information and to ensure it is only used for the reasons described above. |
| Whether the information will be transferred to another country |
Your personal data will be stored on servers in the UK. Where travel is arranged outside the UK, it may be necessary to transfer relevant personal data to organisations in the destination country (for example, airlines or hotels) in order to manage your booking and to ensure any reasonable adjustments are made. Where such transfers take place, we will ensure there is a basis for the transfer under UK data protection law. This may include:
|
| How long we will retain your personal data for |
After that point, your personal information will be confidentially and securely disposed of. If we need to keep your personal information for longer than the retention period above, we will update our privacy information to reflect this. |
09 July 2026 - Updated sections: OfS consultation and survey respondents; Recruitment; OfS CCTV. Added new section: Board and committee members.
19 June 2026 - Updated the 'Requesting information held by the OfS' section of the privacy notice.
03 June 2026 - Refreshed the section on 'signed up to receive information'.
01 June 2026 - Section added on OfS corporate travel.
27 April 2026 - Updated information across several sections, including our general privacy notice, to provide further clarity on how we use personal data in accordance with updated data protection regulations and changes to guidance around information security.
10 December 2025 - We have updated the 'Collecting personal data for regulatory purposes' section of the privacy notice.
05 September 2025 - Updated social media policy to reflect use of a social listening tool (Pulsar)
04 September 2025 - Updated details for registration of providers.
01 July 2025 - The 'OfS CCTV' section has been updated.
07 April 2025 - The 'Recruitment' section has been updated.
18 March 2025 - The 'Third party services' section has been renamed to 'Procurement', and the content of that section has been updated.
23 December 2024 - Updated privacy information for 'Signed up to receive information' section.
12 March 2024 - Updated OfS consultations and survey respondents information
04 May 2023 - Section added on 'OfS car park' giving information on how we use vehicle information.
09 January 2023 - Wording added on sharing information for recruitment.
18 November 2022 - Added a section on collecting data for regulatory purposes.
20 May 2022 - Updates to the recruitment section to reflect changes to the specific personal information held and our purpose for processing the information.
02 November 2021 - Extensive review and update of the OfS privacy notice, re-structuring to help users find information more easily.
Describe your experience of using this website