The HEA holds information on students in HEA-funded Higher Education Institutions (HEIs). The Student Collection Notice describes the purpose for which the data is collected.

HEIs must provide the HEA Student Collection Notice to their students.

Article 13 of the General Data Protection Regulation requires information to be provided, or made readily available, to data subjects so that they are not deceived or misled as to the purposes for which their data is to be processed. In order to satisfy this principle, the HEA supply text for use by HEIs.

The student data collection notice can be supplied to students in any of the following areas:

• Providing the text with the registration form and the HEI’s own Data Protection statement
• Including the text on a website with the HEI’s own Data Protection information
• Including the text in a student handbook or other reference source for students

Certain categories of data are categorised as ‘special categories’ under GDPR. These are subject to stricter conditions of processing. The following data fields in the HEA Student Record capture sensitive or special categories of personal data:

• PPSN
• Address
• Disability
• Ethnicity
• Socio-economic background
• Name
• Date of birth
• Gender identity

Collection of these sensitive categories of data is necessary for statistical research purposes to help public authority data controllers to meet their public-sector duties.

Student Data Collection notice to their students.