2022   Update 

Privacy Notice (How we use student information)

This privacy notice explains how The Sixth Form College, Colchester collects, uses (processes) and shares your personal data, including special categories of personal data, and your rights in relation to the personal data we hold. This privacy notice concerns our processing of personal data of past, present and prospective students of The Sixth Form College, Colchester.

The Sixth Form College, Colchester is the data controller of your personal data and is subject to current data protection legislation.

How we collect your information

We may collect your personal data in a number of ways, for example:

  • from the information you provide to us when you interact with us before joining, for example when you express your interest in studying at The College and complete submit an application
  • when you enrol to study at the College and complete enrolment forms and other documentation related to our other admissions processes and procedures;
  • when you communicate with us by telephone, email or via our website, for example in order to make enquiries or raise concerns;
  • in various other ways as you interact with us during your time as a student of The College, for the various purposes set out below;
  • from third parties, for example from your previous or current school/ college, who may provide a reference about you. 

The types of information we collect

Whilst the majority of student information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain pupil information to us or if you have a choice in this. We may collect the following types of personal data about you:

  • your name, and contact information such as address, email address and telephone number, as well as your date of birth, country of domicile and your nationality. We will also allocate you a unique College student number;
  • information relating to your education employment history (where applicable), the school(s), and other colleges you have attended and places where you have worked, the courses you have completed, dates of study and examination results (including your Unique Candidate Identifier number - UCI, Unique Learner Number - ULN) . We will also keep records relating to assessments of your work, details of examinations taken, your predicted and actual examination grades and other information in your student record;
  • Attendance information (such as sessions/ lessons attended, number of absences and absence reasons)
  • data on the use of email and access to the internet
  • information about your family or personal circumstances, and both academic and extracurricular interests, for example where this is relevant to the assessment of your suitability to receive a bursary and ‘free school meal eligibility’, or in order to provide you with appropriate pastoral care;
  • personal data, including special categories of personal data and information about criminal convictions and offences, including:
    • information concerning your health and medical conditions (e.g. disability and dietary needs);
    • Special Educational Needs (examination arrangements and other learning support requirements)  
    • certain criminal convictions; and
    • information about your racial or ethnic origin; native languages; religion or similar beliefs; and sexual orientation.
  • videos/photographs of general College day and of special events may be taken and may be used in publicity events over the next six years.

How we use information about our students

The purposes for which we may use personal data (including special categories of personal data) we collect during a student's association with us include:

  • recruitment and admissions;
  • academic matters, including:
    • the provision of our core teaching, learning services (e.g. registration, assessment, attendance, managing and monitoring progress (including communication with parents/carers), student behaviour, examination entries and publication of results).
    • maintaining student records;
    • assessing your eligibility for bursaries and access to other sources of financial support.
  • providing library, IT and information services;
  • non-academic matters in support of our core services, including:
    • providing student support services (e.g. through Pastoral Support and Personal Development, Disability and Additional Learning Support, Careers and Employability Support)
    • monitoring equal opportunities;
    • safeguarding and promoting the welfare of students;
    • ensuring students' safety and security;
    • managing the use of social media;
  • administering finance (e.g. fees, scholarships and bursaries);
  • other administrative purposes, including:
    • carrying out research and statistical analysis;
    • carrying out audits (e.g. to ensure compliance with our regulatory and legal obligations);
    • providing operational information (e.g. providing IT support, information about building closures or access restrictions on campus, or safety advice);
    • promoting our services (e.g. providing information and publicity about events happening on and off college premises);
    • preventing and detecting crime;
    • dealing with grievances and disciplinary actions;
    • dealing with complaints and enquiries.
    • assessing the quality of our services
    • to comply with the law regarding data sharing
  • Personal data (including subjects achieved and first destinations) will be published in the College Student Reunion and Awards booklet. This information will also be passed to third parties involved in the ceremonies (including schools and award sponsors). All published details will be available on our website following the relevant events.

(You may withhold your consent to your name being published for the Reunion and Awards booklet  when you register online to attend the award ceremony).

The basis for processing and using your information.

We may process your personal data because it is necessary for the delivery of your education or in order to take steps at your request prior to joining the College. In this respect, we use your personal data for the following:

  • interact with you before you are enrolled as a student, as part of the admissions process (e.g. to provide you with a prospectus or answer enquiries about our courses);
  • once you have enrolled, to provide you with the services as set out in your Learning Agreement;
  • to deal with any concerns or feedback you may have;
  • for any other purpose for which you provide us with your personal data.
  • to deal with concerns we may have regarding attendance/fitness to study/well being or health related issues.

We may also process your personal data because it is necessary for the performance of our tasks carried out in the public interest or because it is necessary for our or a third party's legitimate interests (e.g. compliance with the terms of the 1996 Education Act). In this respect, we may use your personal data for the following:

  • Returns to the Learning Records Service (LRS) to obtain or update Unique Learner Number (ULN) and Personal Learning Records (PLR).  Details can be found at  https://www.gov.uk/government/publications/lrs-privacy-notices/lrs-privacy-notice
  • Returns to the ESFA (an executive agency of the Department for Education – DfE) for funding (ILR funding returns) and other statistical purposes. https://www.gov.uk/government/publications/esfa-privacy-notice - updated January 2022)
  • to provide you with educational services which may not be set out in your Learning Agreement but which are nevertheless a part of our academic and educational mission;
  • to monitor and evaluate the performance and effectiveness of the College, including by training our staff or monitoring their performance;
  • to maintain and improve the academic, corporate, financial, estate and human resource management of the college;
  • to promote equality and diversity throughout the college;
  • to seek advice on our rights and obligations, such as where we require our own legal advice;
  • recovering money you owe to us;

We may also process your personal data for our compliance with our legal obligations. In this respect, we may use your personal data for the following:

  • to meet our compliance and regulatory obligations, such as compliance with safeguarding requirements;
  • in order to assist with investigations (including criminal investigations) carried out by the police and other competent authorities.

We may also process your personal data where:

  • it is necessary for medical purposes (e.g. medical diagnosis, provision of health or social care or treatment, or a contract with a health professional);
  • it is necessary to protect your or another person’s vital interests; or
  • we have your specific or, where necessary, explicit consent to do so.

Storing student data

Subject to any other notices that we may provide to you, we may retain your personal data for a period of six years after your association with us has come to an end. However, some information may be retained indefinitely by us in order to maintain your academic record for archiving. 

Sharing information with others 

For the purposes referred to in this privacy notice and relying on the bases for processing as set out above, we may share your personal data, including special categories of data, with certain third parties, including: 

  • agents where there is a legitimate reason for their receiving the information, including:
    • third parties who work with us to provide student support services (e.g. counselling, mental health and Safeguarding agencies);
    • internal and external auditors.
  • those with an interest in tracking student progress and attendance, including:
    • current or potential employers (to provide references)
  • government departments and agencies where we have a statutory obligation to provide information (e.g. the ESFA, the Home Office (in connection with UK visas and immigration), Council Tax and Electoral Registration Officers at relevant local authorities (for the purpose of assessing liability for Council Tax and for electoral registration purposes));
  • crime prevention or detection agencies (e.g. the police, the Department for Work and Pensions and Trading Standards);
  • parents and carers (where there is a legitimate reason for disclosure);
  • third parties conducting surveys, e.g. DfE – Learner Satisfaction Survey, Alps and Six Dimensions;
  • Microsoft for cloud data storage and authentication;
  • www.go4schools for reporting purposes.
  • WisePay for on-line payments (trips / visits etc.) and grants to students

We routinely share student information with:

  • the current school that applicants are applying from
  • previous schools that students attended and Universities, schools or colleges  after leaving us
  • Essex Local Education Authority (Essex LEA) 
  • the Department for Education (DfE) 

Why we share student information

We do not share information about our pupils with anyone without consent unless the law and our policies allow us to do so.

We share student’s data with the Department for Education (DfE) on a statutory basis. This data sharing underpins college funding and educational attainment policy and monitoring.  (DfE Privacy notice for Key Stage 5 and adult education - https://www.gov.uk/government/publications/privacy-notice-for-key-stage-5-and-adult-education/privacy-notice-for-key-stage-5-and-adult-education)

We are required to share information about our pupils with our local authority (LA) and the Department for Education (DfE) using their powers under section 14 Education Act 2002, through the Education and Skills Funding Agency (ESFA).

Data collection requirements:

To find out more about the data collection requirements placed on us by the Department for Education (for example; via the college ILR returns) go to: https://www.gov.uk/education/data-collection-for-further-education-providers

Youth support services

Students aged 16+ 

We will also share certain information about students aged 16+ with our local authority and / or provider of youth support services as they have responsibilities in relation to the education or training of 13-19 year olds under section 507B of the Education Act 1996.

This enables them to provide services as follows: 

  • post-16 education and training providers
  • youth support services
  • careers advisers

The National Pupil Database (NPD)

The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies. 

We are required by law, to provide information about our students to the DfE as part of statutory data collections such as the Individualised Learner Record (ILR) . Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013.

To find out more about the NPD, go to https://www.gov.uk/government/publications/national-pupil-database-user-guide-and-supporting-information.

The department may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:

  • conducting research or analysis
  • producing statistics
  • providing information, advice or guidance

The Department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:

  • who is requesting the data
  • the purpose for which it is required
  • the level and sensitivity of data requested: and 
  • the arrangements in place to store and handle the data 

To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

For more information about the Department of Education’s data sharing process, please visit: 


For information about which organisations the department has provided pupil information, (and for which project), please visit the following website: https://www.gov.uk/government/publications/dfe-external-data-shares

To contact DfE: https://www.gov.uk/contact-dfe

Requesting access to your personal data

Under the DPA you have the following rights:

  • to obtain access to, and copies of, the personal data that we hold about you;
  • to require that we cease processing your personal data if the processing is causing you damage or distress;
  • to require us not to send you marketing communications.
  • to require us to correct the personal data we hold about you if it is incorrect;
  • to require us to erase your personal data;
  • to require us to restrict our data processing activities (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal);
  • to receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of you transmitting that personal data to another data controller;
  • to object, on grounds relating to your particular situation, to any of our particular processing activities where you feel this has a disproportionate impact on your rights.

Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply.

If you have given your consent and you wish to withdraw it, please contact our Data Protection Officer using the contact details set out below. Please note that where our processing of your personal data relies on your consent and where you then withdraw that consent, we may not be able to provide all or some aspects of our services to you and/or it may affect the provision of those services.

Under data protection legislation, you have the right to request access to information about you that we hold. To make a request for your personal information, contact the College’s Data Protection Officer (DPO) via email:  dpo@colchsfc.ac.uk

Changes to your personal data

Please tell us promptly about any changes to the information we hold about you. This is particularly important for your contact details. You can do this via your Personal or Senior Tutor. 


If you would like to discuss anything in this privacy notice, please contact our Data Protection Officer by email: dpo@colchsfc.ac.uk

If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/


Appendix A – ILR Privacy Notice 2022 to 2023 version 1 January 2022

How We Use Your Personal Information

This privacy notice is issued by the Education and Skills Funding Agency (ESFA) on behalf of the Secretary of State for the Department of Education (DfE) to inform learners about the Individualised Learner Record (ILR) and how their personal information is used in the ILR. Your personal information is used by the DfE to exercise our functions under article 6(1)(e) of the UK GDPR and to meet our statutory responsibilities, including under the Apprenticeships, Skills, Children and Learning Act 2009.

The ILR collects data about learners and learning undertaken. Publicly funded colleges, training organisations, local authorities, and employers (FE providers) must collect and return the data to the ESFA each year under the terms of a funding agreement, contract or grant agreement. It helps ensure that public money distributed through the ESFA is being spent in line with government targets. It is also used for education, training, employment, and well-being purposes, including research. We retain ILR learner data for 3 years for operational purposes and 66 years for research purposes. For more information about the ILR and the data collected, please see the ILR specification at https://www.gov.uk/government/collections/individualised-learner-record-ilr

ILR data is shared with third parties where it complies with DfE data sharing procedures and where the law allows it. The DfE and the English European Social Fund (ESF) Managing Authority (or agents acting on their behalf) may contact learners to carry out research and evaluation to inform the effectiveness of training.

For more information about how your personal data is used and your individual rights, please see the DfE Personal Information Charter https://www.gov.uk/government/organisations/department-for-education/about/personal-information-charter) and the ESFA Privacy Notice (https://www.gov.uk/government/publications/esfa-privacy-notice)

If you would like to get in touch with us or request a copy of the personal information DfE holds about you, you can contact the DfE in the following ways:

If you are unhappy with how we have used your personal data, you can complain to the Information Commissioner’s Office (ICO) at:

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You can also call their helpline on 0303 123 1113 or visit https://www.ico.org.uk

Date last updated: 12 January 2022

Appendix B - Covid 19 Notifications

In order to comply with current Government requirements the College is required to record and pass on contact details to NHS track and trace of students who have tested positive with Covid 19. The requirement also extends to those students who have been in close contact with a student who has gone on to be tested positive. All such students will be notified directly by the College. Data passed onto the NHS track and trace system is restricted to basic contact details. As of September 2021, this process will be transferred entirely to NHS track and trace. At this point we will no longer collect the information and it will be deleted in accordance with standard College retention policies.