Prospective apprentice privacy notice

We are registered as a data controller with the Information Commissioner’s Office (our notification number is Z6346945) and are committed to ensuring that the personal data we process is handled in accordance with data protection legislation. We have a named Data Protection Officer, Suzie Mereweather, who can be contacted via

One of our responsibilities is to tell you about the different ways we collect and use your personal data. This statement provides details about these uses. In addition to this statement, you may be given further information about the uses of your personal data when you use certain services offered by the University of Surrey.

What information do we collect from you?

We hold and process personal data about apprentices. The personal data we hold about you consists of your: The personal data we hold about you consists of:

  • Name
  • Contact details
  • Date of birth
  • Confirmation of residency status
  • Place of employment
  • Job title and requirements
  • Existing knowledge, skills and behaviours and  prior qualifications
  • Learning and information about any additional learning support requirements you may have
  • Details in support of any additional payments from the Education and Skills Funding Agency (ESFA) (e.g. care leaver status)
  • Any other data that may be stipulated by the ESFA from time to time

We only collect the data we need and keep that data up to date. We receive this data from you when you complete the expression of interest, application form, initial needs assessment, commitment statement and apprenticeship agreement. From time-to-time we may request that you complete other forms in line with ESFA funding rules.

We may also receive data about you from your employer such as confirmation of:

  • Your name
  • Contact details (postal, email, telephone)
  • Details of qualifications
  • Job title
  • Job role and work experience
  • Length of contract
  • Salary
  • Domicile and whether the apprentice spends minimum 50% of their working hours in England
  • University URN number and user name
  • That you meet the gateway requirements for the end point assessment
  • Any other data that we may need from time to time to enable us to comply with the ESFA funding rules

Why do we collect this information?

The University collects only the data we need, and we keep the data up to date and only for as long as it is needed to support your application for, and ongoing eligibility to, the degree apprenticeship programme as set out by the ESFA funding rules, commitment statement and apprenticeship agreement.

We collect your personal data in order to:

  • Enable us to manage your application to undertake an apprenticeship at Surrey, to assess your ongoing eligibility to take part in the degree Apprenticeship programme and to claim funds for your training via the apprenticeship levy/your employer.
  • Enable us to monitor your attendance and progress.
  • Enable us to report to your employer on your attendance and progress.
  • Enable us to put in place additional learning support as required.
  • Enable you to graduate on the successful completion of your programme of study and to complete your apprenticeship.
  • Investigate and make decisions in respect of any complaints made through the Procedure for Complaints – Apprentice Employers and B7 - Procedure for Complaints, for students.
  • Meet the requirements of the ESFA funding rules and apprenticeship agreement.

The University may process some information about you that is classed as ‘special category’ data in this category.  Special category data receives additional protections. The special category data we collect about you is data relating to health and medical conditions and we may process special category data with your consent where we use it to: 

  • Operate and keep a record of any additional learning support processes you require;
  • Operate and keep a record of any extenuating circumstances you require;
  • Provide to the ESFA if they have directly-funded additional support for you.

You are free to decide whether or not to provide this data we won’t be able to arrange additional learning support or look at any extenuating circumstance for you.

These processes are managed by the University’s Additional Learning Support service based in the Library; they have a separate privacy notice which details how and why they process your data. EFSA provide funding for learning support and you can view their privacy notice online.

We collect data about you at various stages in your relationship with us. The main stages are: 

  • When you apply to undertake an apprenticeship at the University of Surrey and complete an application form, commitment statement, apprenticeship agreement, initial needs assessment, work based learning and end point assessment. 
  • When we validate your academic achievements with your previous education provider (if applicable).
  • When we validate your employment details and knowledge, skills and behaviours with your employer.
  • When you register with us as an apprentice.
  • From third party sources (i.e. your employer).
  • When you communicate with us, via phone, email or via the website, for example to make enquiries or raise concerns.
  • Throughout your time as an apprentice, collating information relating to your attendance, work, examinations and other information in your student record.
  • Through engagement with university services, such as careers advice and counselling. Whenever you engage with one of these services you will be provided with further details about how your data will be used for this purpose at the relevant time. 

How do we process your information?

We take our obligations for data handling very seriously and it is therefore important for you to know the lawful basis for us processing your information.

Public role

We process data to ensure that we can carry out our public role as an educational and research establishment, meeting legal, moral and contractual obligations as laid out in the University of Surrey Charter (PDF).

Statutory and legal requirements

We also process data to meet our statutory and legal requirements, specifically the funding regulations made under S101 of the Apprenticeships, Skills, Children and Learning Act 2009 (ESFA funding rules).

Substantial public interest

We process data for reasons of substantial public interest. This is an assessment made by weighing our need to process your special category data against the impact of the processing on you. We will always ensure that the processing respects the essence of the right to data protection. We process for this purpose when we: 

  • Collect and use information relating to criminal convictions in accordance with the University’s Criminal Convictions Policy (PDF).
  • Operate and keep a record of fitness to study and fitness to practice procedures.
  • Operate and keep a record of disciplinary and complaint issues, including managing any appeals to these process.
  • Operate and keep a record of academic misconduct, integrity and complaint processes.

Legitimate interest

We also process data in our legitimate interests to:

  • Provide opportunities for student wellbeing and support, including pastoral support, counselling services, personal tutoring, careers and employability services.
  • Enable effective communications with you regarding information you need to know for campus security or operations.
  • Operate and keep a record of disciplinary and complaint issues, and the fitness to study process.
  • Ensure the security of campus and those people within it.
  • Produce statistics and research for internal improvements in the way the University develops and delivers its courses and modules. 
  • Provide customer care, including to responding to your request if you contact us with a query.
  • Administer financial support services such as assessing eligibility for bursaries and scholarships, where appropriate.
  • Administer the individualised learner record which is the process by which the university draws down funds from the apprenticeship levy for your training.
  • Collate an evidence pack as required by the ESFA which will be subject to ESFA audit.

These legitimate interests are determined through an assessment made by weighing our requirements against the impact of the processing on you. Our legitimate interests will never override your right to privacy and the freedoms that require the protection of your personal data. If you are interested in learning more about this legitimate interest assessment, please contact

Contractual duties

We also process data to meet our contractual duties to you as an apprentice and provide you with educational and other services as laid out in our Commitment Statement with you.  We process data to meet our contractual obligations when we:

  • Manage your use of facilities and participation in events.
  • Provide email and other IT services, access to the University networks and WiFi, IT accounts and library services.


We process data because you give us your consent, specifically to:

  • Provide you with the additional learning support, where you have provided us with this data.
  • Consider any extenuating circumstances you require.
  • Enable us to review, develop and improve our services by means of survey.

We do not use the data we collect to make decisions about individuals or to analyse information on an individual level.

What do we do with your information?

The University processes personal data and special category data in accordance with data protection legislation and its own Data Protection Policy (PDF).

  • We use the information that we collect and process about you to support your application for, and ongoing eligibility to, the degree apprenticeship programme as set out by the ESFA funding rules and apprenticeship agreement.
  • When you make your application and enrol on the degree apprenticeship programme, we store your data on our customer management relationship database, Aptem. View their privacy notice.
  • We also combine the data you provide us with other data generated during your time with the University in order to maintain a summary record of your academic journey with us which is stored in our student management system (SITS) within University networks.  
  • We track activity via cookies to obtain information about the way you access our services to analyse their effectiveness.
  • We combine the data you provide with data obtained from your employer to keep a record of your apprenticeship journey.
  • We use special category data relating to ethnicity and disability at a statistical level for our Race Equality Charter submission.
  • We monitor use of IT services to ensure adherence to the IT Acceptable Use Policy and Guidelines (PDF).
  • We analyse the effectiveness of our service at an aggregate level so that no individuals are identified from the data.

How long do we keep your information?

We keep your personal data in accordance with the University’s retention schedules. This means that your data is kept for 6 years and then either destroyed or passed to the University’s historical archive for permanent preservation. 

How do we protect your data?

We take the security of your data seriously. Details on University wide measures surrounding IT security can be found in the principal IT Security Policy (PDF) which sets out the definition of, commitment to and requirements of information technology and security. It specifies regulations to be implemented to secure information and technology that the University manages and to protect against the consequences of breaches of confidentiality, failures of integrity and interruption of availability. 

We have internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the performance of their duties. 

Where we engage third parties to process personal data on our behalf such as MWS Technology Limited who administer the Aptem platform that manages the apprenticeship application and enrolment process, they do so on the basis of written instructions contained within a contract, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data. 

Who do we share your information with?

Internally, we share your personal data with:

  • Academic staff, student support staff, your personal tutor and other tutors involved in delivering your course of study.
  • Academic Registry to enable us to operate and keep a record of disciplinary and complaint issues, including managing any appeals to these process.
  • Finance teams, Library, security staff and staff in the Centre for Wellbeing if access to the data is necessary for performance of their roles.
  • IT Services, in order to provide you with an IT account, email address and access to relevant buildings, IT networks, systems and resources.
  • Our Internal Audit team, to ensure University compliance with policies and processes. 
  • Advancement, for them to contact you regarding ongoing involvement with the alumni of the University. View their alumni privacy policy.
  • The Apprenticeship team who are responsible for ensuring compliance with ESFA funding rules and the apprenticeship agreement.

We may also share special category data internally to provide you with support. This will usually be done only with your consent but it may happen where it is necessary to protect your vital interest, or the vital interest of others, and we are unable to get consent from you.  

Sometimes we need to share your personal data with third parties to help us to meet our contractual needs, legitimate interests or to provide a better service. We also share data to meet our statutory and regulatory requirements or as required by law for crime prevention, investigation or detection purposes. We share your personal data, where required, with the following external third parties: 

  • Current employers to confirm details of progress and attendance and to enable us to meet our statutory obligations under the ESFA funding rules. In certain circumstances we may be required to share your data with your employer to enable us to operate disciplinary and complaint processes, including managing any appeals to these processes.
  • EFSA to enable your certificate to be issued on the completion of your programme of study and to enable EFSA to fulfil their audit functions. See their privacy notice.
  • Our agents and contractors where there is a valid reason for their receiving the information  such as third parties who provide: 
    • IT support.
    • Campus card production.
    • Support for any financial transactions. 
    • Anti-plagiarism software on our behalf.
  • Our apprenticeship service provider, Aptem, which is a UK based company. View their privacy notice.
  • External auditors, to ensure University compliance with policies and processes.
  • Surveys, for example the National Student Survey.
  • Government departments and agencies where we have a statutory obligation to provide information: 
    • The Office for Students (OfS) (formerly the HEFCE).
    • The Higher Education Statistics Agency (HESA).
    • The Home Office (in connection with UK visas and immigration).
    • ESFA.

What rights do you have in relation to the way we process your data?

As an individual whose data we process (a data subject), you have certain rights in relation to the processing. Find detailed information about your rights as a data subject.

You have the right to:

  • Withdraw your consent in circumstances where we have relied on your consent as our basis for processing your personal data.
  • Ask us to confirm that your personal data is being processed and to access (i.e. have a copy) of that data as well as to be provided with supplemental information about the processing.
  • Request that we rectify any inaccuracies where the data we hold on you is inaccurate or incomplete.
  • Have your data erased by us, although in certain circumstances we may not be able to do this. The circumstances where this applies can be found in the guide to data subject rights information.
  • Restrict the processing of your personal data in certain ways.
  • Obtain your personal data for reuse.
  • Object to certain processing of your personal data.

To exercise any of these rights, please contact If you have any concerns about the way that we have handled your personal data please contact us as we would like to have the opportunity to resolve your concerns. If you’re still unhappy, you have the right to lodge a complaint with the Information Commissioner’s Office.