You need cookies enabled

HEFCE closed at the end of March 2018. The information on this website is historical and is no longer maintained.

Many of HEFCE's functions will be continued by the Office for Students, the new regulator of higher education in England, and Research England, the new council within UK Research and Innovation.

The HEFCE domain - - will continue to function until September 2018. At this point we will close the site entirely and all its information will only be available from the National Web Archive.


You need cookies enabled

Return to Public Interest Disclosure process

Public Interest Disclosure (PID) privacy notice

HEFCE funds and regulates universities and colleges in England. We invest on behalf of students and the public to promote excellence and innovation in research, teaching and knowledge exchange. We also undertake projects on behalf of other funding bodies which will affect the UK as a whole.

Find more information about HEFCE and the work that we do

HEFCE is registered as a data controller with the Information Commissioner’s Office (ICO). Our registration number is Z6366704 and you can check our entry details on the ICO’s website

The HEFCE Public Interest Disclosure (PID) process is the mechanism by which individuals can raise issues of concern to HEFCE that relate to:

  • financial irregularity, impropriety, waste and fraud in the institutions we fund; or
  • non-compliance with charity laws by exempt charity HEIs for which HEFCE is the principal regulator; or
  • implementation of the Prevent Duty by relevant higher education bodies in England.

We will collect the following personal information:

  • name
  • address
  • email address
  • telephone number
  • previous disclosure history.

Sensitive personal information provided to us

We will not routinely collect sensitive personal information about you; however, you might send us supplementary documents that contain sensitive personal information about yourself if you consider that it is evidence to support your disclosure. 

Sensitive personal data means personal data consisting of information about an individual’s:

  • racial or ethnic origin
  • political opinions
  • religious beliefs or other beliefs of a similar nature
  • trade union membership
  • physical or mental health or condition
  • sex life
  • criminal record.

Please see the Data Protection Act for more detailed information.

How we will use your personal information

We will use the personal information provided to communicate with you and to form judgements about whether a disclosure meets the criteria to be considered under the Public Interest Disclosure process and, if it does meet the criteria, to use that information as necessary to undertake the PID process. 

Sensitive personal information that is not relevant to the disclosure will be destroyed immediately. Sensitive personal information that is considered by the PID case manager to be relevant to the disclosure will be securely stored within the case file and used to assess and process the disclosure.

How we will look after your personal information

Personal information will be stored on HEFCE’s secure systems which are accessible, through secure log-in, only to members of the PID team. 

Sharing your personal information

If we consider that the issue is within the scope of our regulatory powers and that it meets the criteria for acceptance we will normally make contact with the provider. We will use discretion in dealing with the disclosure. However, we are not able to guarantee confidentiality. In most cases, the disclosure will already be known to the provider, and any conversation that we have with an institution about a disclosure will, in all likelihood, lead to your identity being deduced.

Should a disclosure lead to an investigation under the PID process, information collected may be shared with the applicable regulatory partner:

  • The Charity Commission – in cases relating to charity laws by exempt charity HEIs
  • The Department for Education – in cases relating to the Prevent duty.

We will not pass on your name or contact details without permission but the case file may contain contextual information, including sensitive personal information, where it forms a relevant part of the evidence base.

We will not disclose your information to any other organisation except where required to do so as part of our functions or by law.

When we will destroy your personal information

We will destroy personal information in accordance with our retention schedule, this will normally be five years after the final decision has been communicated to you and, if relevant, the provider.

Sensitive personal information that is not relevant to the disclosure will be destroyed immediately. Sensitive personal information that is considered by the PID case manager to be relevant to the disclosure will be destroyed in accordance with our retention schedule. This will be five years after the final decision has been communicated to you and, if relevant, the provider.

Access to your personal information and correcting any inaccuracies

You have the right to request a copy of the information that we hold about you. If you would like a copy of some or all of your personal information, please use the request form on our website.

Alternatively you can email or write to us at the following address:

Private and Confidential

Data Protection and Information Manager

HEFCE, Nicholson House

Lime Kiln Close

Stoke Gifford

Bristol, BS34 8SR

We may make a small charge for this service and we may also need to verify your identity before providing your personal information.

We want to make sure that your personal information is accurate and up to date. You may ask us to correct or remove information you think is inaccurate.

How to contact us to discuss this privacy notice

Please contact us if you have any questions about this privacy notice or the information we hold about you using the contact details provided above.

Use of cookies by HEFCE

Cookies are test files placed on your computer to collect standard internet log information and visitor behaviour information. This information is used to track visitor use of the website and to complete statistical reports on website activity.

Read further information about our cookies or for further general information visit: or

Changes to this privacy notice

We keep our privacy notices under regular review and we will place updates on the HEFCE website.

PID privacy notice v1 - August 2017

Page last updated 14 December 2017