Data Protection

GLA / ESFA Privacy Notice: 

The Education and Skills Funding Agency (ESFA) is an executive agency of the Department for Education (DfE). The ESFA:

• is accountable for funding for the education and training sector, providing assurance that public funds are properly spent, achieves value for money for the tax payer and delivers the policies and priorities set by the Secretary of State
• regulates academies, further education and sixth-form colleges, and training providers, intervening where there is risk of failure or where there is evidence of mismanagement of public funds
• delivers major projects and operates key services in the education and skills sector, such as the National Careers Service, the National Apprenticeship Service and the Learning Records Service

This privacy notice explains how we use (process) any personal data you give to us, or any that we may collect about you.

This notice is layered. So, if you wish, you can easily select the reason we process your personal information and see what we do with it.

For the purposes of relevant data protection legislation, the DfE is the data controller for personal data processed by ESFA.

If you would like:

• more information about how we process your personal data or your data protection rights
• to make a request about your information – for example to request a copy of your information or to ask for your information to be changed
• to contact our Data Protection Officer

You can contact us in the following ways:

• using our secure online contact form
• or in writing to:

The kinds of personal data we process about you

When we ask you for personal data, we will:

• tell you the reasons we’re asking for it
• only ask for the information we need
• make sure we don’t keep it for longer than necessary
• protect it and make sure only the appropriate people have access to it
• let you know if we’ll share it with other organisations
• keep it up to date where necessary
• consider privacy risks when we’re planning to change the way we use or hold it
• train our staff to ensure we use and protect it properly

In return, we ask you to:

• give us accurate information
• tell us as soon as possible if there are any changes

We may process the following types of personal data about you:

• your personal contact details
• your date of birth
• your nationality/ethnicity
• equality, diversity and inclusion information
• information about your career, workplace, employer
• data and information about your learning, including courses and qualifications you are taking or have taken

We may also process images and recordings for the purposes of engaging and communicating with the general public. This is done in accordance with codes of practice and guidelines laid down by the Information Commissioner’s Office.

More information about how the DfE handles personal data is published on GOV.UK.

How and why we get personal information

We collect your personal data where the law allows, or we have a legal duty to do so. We may also receive your personal data from third parties, including other government departments. Your personal data is collected to enable us to carry out our functions and the functions of the DfE.

The lawful basis we often rely on for processing your personal data is to perform our public task. We may also rely on the following lawful bases:

• your consent – where this is relied upon, you can ask to remove your consent at any time. You can do this by using our online contact form.
• a contractual obligation
• a legal obligation
• to protect a person’s vital interest
• legitimate interest

a) Personal data collected from you directly

We may collect information from you:

• face to face like when you fill in a form or survey at our careers fairs.
• over the telephone like when you contact our helpdesks
• in correspondence that you send to us, like emails, letters and social media posts

We may use personal data we collect directly from you to:

• send you information about our work
• improve the services we offer to you
• operate our complaints policy
• contact you for feedback on services we provide to you
• ensure the protection of public funds
• prevent and detect fraud

b) Personal data collected from ESFA websites and social media channels

We may collect and process the following information:

• details of your visits to our website including the resources that you access, weblogs and other communication data
• subscriptions to our mailing lists

We may use personal data we collect from websites and social media channels to:

• ensure that our website content is presented in the best way for you
• provide you with information, products or services that you request from us or which we feel may interest you, where you have given us your consent
• allow you to participate in interactive features of our service, when you choose to do so
• notify you about changes to our website or services

c) Personal data about learners and apprentices

We collect personal data about learners from you, and third parties, including other government departments/agencies and from organisations funded by ESFA to provide learning. We collect information about you and what you are studying.

We collect and process the following information:

• Enrolment and achievements – this is collected from learning providers following their funding terms and conditions. Learning providers include further education colleges and private training companies where you undertake learning.
• Individualised Learner Record (ILR) – information about you and what you are studying is collected by the ILR. See the ILR privacy notice for more details.
• Learning Records Service (LRS) – information about you is used by ESFA to issue you with a Unique Learner Number (ULN), and to create and keep your Personal Learning Record. See the LRS privacy notice for more details.
• National Careers Service – ESFA encourages participation in further education and learning by providing careers information and advice services. See the National Careers Service privacy notice for more details.
• Bursary for Vulnerable Group Scheme – uses the information you give to your educational institution (e.g. your college) to decide if you are eligible for a bursary under the scheme eligibility criteria.
• If you start an apprenticeship – your information is supplied to us by your employer to enable DfE to carry out its functions. We collect information about you and what you are studying. See the Manage Apprenticeship service privacy notice and Apprenticeship website privacy notice for more details.
• Information is collected from and shared by third parties so ESFA can deliver its obligations to safeguard children and young people.

Sharing your personal data

We share your personal data with other parts of ESFA and DfE, and third parties, including other government departments, agencies, local authorities and organisations, where the law allows it or we have a legal duty to do this.

These organisations can include:

• an organisation who is working for ESFA/DfE under contract
• organisations who provide:
  • administration services
  • careers and other guidance
  • statistics and research about education, training, employment and well-being, this includes the Higher Education Statistics Agency (‘HESA’) so that you can take part in the Graduate Outcomes survey
• organisations that request information to help prevent and detect crime

We may share your personal data with other organisations where:

i) learning is funded by another public authority. This information is shared to help those organisations do their work. These include Department for Work and Pensions managing the European Social Fund, and combined authorities in city regions and the Greater London Authority managing devolved adult education budget funding.

ii) a further education college or other training provider can no longer deliver your training funded by ESFA. This may be where a training provider has stopped trading. To help you continue learning, ESFA will arrange to securely transfer your information from your last training provider to your next training provider or to ESFA if your learning does not continue straight away. To do this:

• the ESFA and training providers share data to make sure information held about you and your funded learning is accurate.
• ESFA and your training provider may need to share your information with another training provider (e.g. to confirm a claim for funding from ESFA) and with an Awarding Organisation (e.g. to confirm what stage your learning has reached).

iii) ESFA are notified of an issue regarding safeguarding of children and young people.

Other people and organisations may also share personal data with ESFA, for example, when they make a complaint or raise a concern with us. This can include information shared in accordance with the statutory guidance ‘Working together to safeguard children’. This information will be used to investigate complaints and to ensure trusts and academies comply with the regulations (Education (Independent School Standards Regulations 2014)) and their Funding Agreement.

How long we will keep your personal data

We will only keep your personal data for as long as we need it. ESFA has a disposal schedule for personal data based on the needs of the agency and the law. We may need to keep some of your personal data for 66 years for research and producing statistics.

We will take necessary steps to keep your information safe. It will then be securely destroyed when it is no longer needed.

If you want to know how long we keep your information, please write to ESFA Departmental Records Officer using our secure online contact form.

Storing personal data outside the UK

When ESFA stores personal data outside the UK, we will make sure we comply with the data protection law, and take additional steps to keep your personal data safe, which can include additional technical/security arrangements, contractual agreements and data sharing agreements.

Your data protection rights

Under data protection law, you have rights including:

• Your right of access – You have the right to ask us for copies of your personal information.
• Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.
• Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to the Data Protection Officer at:

You can also complain to the ICO if you are unhappy with how we have used your data by writing to:

Changes to this privacy notice

We may change this privacy notice and we encourage you to check this privacy notice from time to time.