Guidance

Privacy notice - Student Loans Company

Published 3 April 2025

Student Loans Company Limited (“SLC”, “we”, “us” and “our”)

1. Data Protection Statement/Privacy Notice (the “Notice”)

This Notice is applicable to customers (including applicants, students, parents, guardians, step-parents, partners and/or sponsors), any third parties’ details we hold (including alternative contacts and dependants), and suppliers (hereinafter referred to as “you”, “your”, “customer”, “student” and/or “supplier” as appropriate in the particular context) as part of supporting an application or repayment, during your relationship with us.

The Notice explains how SLC and others may use personal information (as defined below).

SLC is a non-profit making Government-owned organisation set up in 1989 to provide loans and grants to students in universities and colleges in the United Kingdom (“UK”). Certain functions relating to the student finance schemes within the UK have been transferred to SLC by:

• the Secretary of State for Education
• the Welsh Ministers
• the Department for the Economy Northern Ireland
• the Scottish Ministers; collectively hereafter referred to as the “UK Administrations”.

If you have:

• made or begun an application for student finance through:

» Student Finance England (“SFE”)

» Student Finance Wales (“SFW”)

» Student Finance Northern Ireland (“SFNI”) (or you’re a parent or partner who has supported such an application through SFE, SFW or SFNI)

» Student Awards Agency Scotland (“SAAS”)

» Student Finance Services as a European Union (“EU”) student studying in England, Wales, or Northern Ireland

• applied for Education Maintenance Allowance (“EMA”) funded by the Northern Ireland Assembly
• applied for EMA or Welsh Government Learning Grant funded by the Welsh Government
• provided a service to a student, including by way of example without limitation childcare and/or Disabled Student’s Allowance (“DSA”) support;

then, as part of your application, you will have supplied information (“personal information”). The personal information will be held and used by SLC to administer the student finance schemes (or part thereof) in the UK for and on behalf of the UK Administrations.

SFE and SFW are trading names of SLC which provide student finance services for English and Welsh domiciled students. SFNI is a partnership between SLC and the Education Authority in Northern Ireland which provides student finance services for Northern Ireland domiciled students. Student Finance Services is a trading name of SLC which provides the student finance services for students from the EU (and where applicable non-EU) studying in England, Wales, or Northern Ireland.

The personal information in your application will be held by SLC in accordance with relevant data protection legislation for the purposes set out in this Notice. It is important that you read this Notice, together with any other privacy notice we may provide on specific occasions when we collect or process your personal information, so that you are aware of how and why we are using such information.

2. What information do we collect about you?

We may collect, store, and use the following categories of information:

• contact details such as name, title, addresses, telephone numbers and personal email addresses
• date of birth
• gender
• National Insurance Number (“NINO”)
• financial data, including bank account details, student loan repayment details and annual income details
• nationality and residency details
• education history
• residence history
• household details (for example, if you have any dependants)
• employment status
• your Internet Protocol address, and which web browser and version you used
• information on how you use SLC websites (including data analytics), cookies and page tagging techniques. More detail about cookies can be found on the relevant websites eg. Cookies on GOV.UK, and
• any other information that you volunteer to us through communications between you and SLC.

We may also collect, store, and use the following “special categories” of personal information:

• information about your race or ethnicity, religious beliefs, and sexual orientation (so that we can, for example, comply with our public sector equality duty under the Equality Act 2010)
• information about your health, including any medical condition and sickness records (so that we can, for example, administer applications for DSA, and make reasonable adjustments in line with our statutory obligations under the Equality Act 2010)
• information about criminal convictions and offences (for example, where this is provided as evidence to support an application or appeal).

We may also collect, store, and use the following categories of information about members of your family or household, including child or adult dependants, to assess your eligibility for, and entitlement to, student finance (and, if they later apply for student finance in their own right, for the purposes of determining their own entitlement to student finance):

• name
• date of birth
• gender
• financial details, including income
• nationality and residency details
• childcare or education details.

We may also collect, store, and use information about anyone with a Power of Attorney, Court of Protection appointed Deputy or consent to act on your behalf. For these purposes we may therefore collect the following categories of personal information:

• contact details such as name, title, addresses, telephone numbers, and personal email addresses
• date of birth
• relationship to applicant
• duration of authority/consent.

3. How is your personal information collected?

We collect your personal information in the following ways:

When you provide it to us directly

You may give us your personal information through the student finance applications, student loan repayment and the student finance overpayment processes. This personal information may be provided by you, your partner, relatives (including step-parents) or Attorney/Court of Protection Deputy.

When your personal information is transferred from third parties

Your personal information may be shared by and/or among the Joint Data Controllers (as defined in the table below under Data Sharing) for the purposes of administering your loan.

We may also collect additional information from third parties including HM Revenue & Customs (“HMRC”), the Home Office, other government departments such as the Department for Work and Pensions (“DWP”), and fraud prevention and law enforcement agencies such as Police forces and the National Crime Agency.

You should check the privacy policies of the relevant Joint Data Controller and the other government departments mentioned in this Notice (available on their websites) to fully understand how they will process your data.

4. How will we use information about you?

We need this personal information to administer student finance within the legislative framework set by the UK Government and the UK Administrations. In particular, we need it in order to:

• administer loans and grants to students in line with UK Government Administrations’ Policy/ Regulatory requirements
• process your application for student finance
• determine whether you are eligible for student finance
• make payment of student finance
• maintain accurate and up-to-date records
• answer queries you might have in relation to your student finance application
• process any complaint or appeal you submit
• administer and/or pursue the repayment of any loan and/or overpayment of student finance you receive.

We may also use your personal information for the following purposes:

• to detect, investigate and prevent crime including fraud and/or repayment evasion using both the information provided to us, on-line identifiers, and publicly available information, such as that on social media and other public platforms
• equal opportunities monitoring
• for research and statistical purposes
• to allow the assessment and payment of student finance to be audited
• to maintain or develop systems and processes
• improving service levels.

5. Legal Basis for Processing Your Personal Information

We must have a legal basis for processing your personal information (and special categories of your personal information). The legal bases for processing personal information are set out in data protection legislation. Some of the above bases for processing will overlap with others, so there may be more than one legal basis which justifies us using your personal information.

We will primarily process your personal information to fulfil our public task of administering student finance in the UK and to ensure public funds are used appropriately.

SLC’s primary roles and performance targets include:

• using technology and improved business processes to strengthen and streamline the student finance system
• making service improvements and improving the customer experience
• delivering changes to student finance policy
• improving customer satisfaction.

We may therefore use your personal information for these purposes, which form part of our public function. Processing your personal information to make payment of student finance is also necessary for us to fulfil our obligations to provide student finance.

We also have legal obligations under the Equality Act 2010, for example we must comply with the public sector equality duty. We may therefore use your personal information to fulfil these obligations.

As we process special category data, we must also identify a special category condition for processing. We process special category data where any one of the following applies:

i. it is necessary for reasons of substantial public interest

ii. we have your explicit consent

iii. it is necessary for archiving purposes in the public interest and statistical purposes.

6. Change of Purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider it is necessary to use it for another purpose compatible with the original purpose. If we need to use your personal information for a different purpose, we will notify you and explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

7. Automated Decision-Making

Due to the volume of applications SLC receive on a yearly basis, SLC replicate the manual assessment of our SLC assessors and carry out automated processing using the same rules assessors would use to determine whether an applicant is eligible for funding based on government regulations and policies. Your application may be subject to automated decision making if you are:

• a new student applying for a non-means tested student loan
• a new student applying for a means tested student loan, provided we are able to confirm your identity and household income through our data sharing agreements with other government bodies or
• a returning student, who has previously applied and was awarded a non-means tested student loan. *a returning Northern Ireland student, who was previously means tested.

This automated processing also reduces the need for you to complete a full application for subsequent academic years if the information you have previously supplied SLC with is unchanged. If your information has changed, you can manually make changes to your application on your online account or contact us on the relevant telephone number for your domicile as per page one of this notice. Once you have made the manual changes online this will trigger a reassessment of the application by an assessor, who will reassess your application based on the new information, and make a new decision based on the updated information. The reassessment may or may not alter the original decision made.

The automated decision-making process is reviewed and tested annually to ensure that all decisions made are correct at the time the assessment is carried out based on the information the customer provided SLC with in their previous year’s application.

For more information on how your personal information is processed by automated decision-making or to challenge an automated decision, or to request human intervention please contact us using the relevant contact telephone number on page one of this notice.

If you wish to appeal against our decision not to award you student finance or you disagree with how any funding has been calculated, please contact us depending on your domicile:

• England and Wales - email: formal_appeals@slc.co.uk
• Northern Ireland – contact your Education Authority directly
• SAAS – contact SAAS directly.

8. Artificial Intelligence, Analytics and Machine Learning

SLC will only use Artificial Intelligence (“AI”), including analytics and machine learning where the law allows us for the purposes of administering student finance, or the prevention and/or detection of crime. AI helps us learn more about large amounts of data, improve our customer services and prevent and respond to issues among our customers.

When using systems that involve AI and processing personal data, SLC complies with relevant data protection regulations, security, and ethical professional standards.

9. Data Sharing

We may share your personal information with third parties where required by law or where it is necessary to process your application or administer a student support account (including repayments).

For example:

Who we share your information with	Why we share your information
Banks and Building societies	To make payment for loans, grants or bursaries you are entitled to. To prevent and detect fraud.
Chief Executive of the Education and Skills Funding Agency	To monitor the performance of the student finance system and to develop future policies or initiatives.
Childcare Providers	To verify the information you provide to us as part of any application for assistance with childcare costs and to ensure that the amount of any such assistance is accurate.
Contracted Third Parties	To help SLC meet service delivery needs, we may share your or your dependants’ personal information pursuant to data sharing agreements which include data protection safeguards.
Disability Equipment Suppliers	To provide the support or equipment you may need as a student (where consent has been given by the applicant).
Disability Needs Assessors	To ensure you get the support you may need as a student (for example in order that they can carry out an assessment to determine your needs) (where consent has been given by the applicant).
DWP	To verify and/or obtain your NINO and personal details including if appropriate the level of any benefits you currently receive (for the purpose of assessing your eligibility for student finance). To check income from benefits for repayment purposes.
Fraud prevention and law enforcement agencies such as the Police and the National Crime Agency (including CIFAS)	To check the accuracy of information provided to us and to prevent and detect fraud both in the student finance application process and more widely. If false or inaccurate information is provided and fraud is identified, details will be passed to fraud prevention and law enforcement agencies who may access and use this information. If fraud is detected, you could be refused certain services, finance, or employment. Further details of how your information will be used by such fraud prevention agencies, and your data protection rights, can be found by visiting www.cifas.org.uk/fpn
General Register Office	To check birth and death certificates.
HMRC	To verify income levels if supporting an application and to verify and/or obtain your NINO to facilitate collection of loan repayments from students. HMRC may also have shared access to your loan account information to help SLC collect loan repayments and for the purposes of detecting fraud.
Home Office including His Majesty’s Passport Office and UK Visas and Immigration	To verify your passport or biometric residence permit details and to check the validity of visas, residency, and immigration status.
Identification (ID) and Income Checking Agencies	To carry out ID and Income checks, to facilitate repayment of student support and for the purposes of detecting fraud.
Jobcentre Plus	To help you obtain a NINO if necessary (they may ask SLC to provide confirmation of your eligibility for a loan).
Joint Data Controllers: UK Administrations, The Education Authority, SAAS	To provide customer services to you and monitor the performance of the student finance systems. To develop future policies and/or initiatives, and for the purpose of detecting fraud. These organisations and SLC may share data with third parties for research and statistical purposes. Any published output will be anonymous and will not identify individuals.
Money and Pension Service (MaPS)	To support with the provision of debt advice, (where consent has been given).
National Health Service Business Services; Care Council for Wales; Northern Ireland Social Care Council	To assess whether you are entitled to receive tuition fee support and/or a bursary
Non-Medical Helpers	To ensure you get the support you may need at university.
Repayments Related Third Parties (including the Government or a Government Agency of another Country and/or credit reference agencies)	To help locate and/or help take action to recover any payments you owe where you are in breach of your terms and conditions.
Related Third Parties (including Utility Providers, Mobile Phone Companies, Local Councils and Government Organisations eg. DVLA)	To verify evidence you have supplied us.
Taxi Providers	To ensure you get transportation if you have applied for DSA.
The Office for Students (“OfS”), United Kingdom Research and Innovation (“UKRI”) and Jisc (the UK Digital, Data and Technology Agency).	For the purposes of carrying out statutory functions relating to the funding of education and for statistical analysis. OfS, UKRI and Jisc should not identify individuals in any published results.
Universities, schools, colleges, and training providers*	To pay you any tuition fee support you are entitled to. To process your information for the purpose of providing you with any non-repayable Bursary, EMA or scholarship you are entitled to. To verify the details of your course of study including details in relation to enrolment and attendance. To ensure students get the support they need for their studies if they have applied for DSAs (where consent has been given). For research purposes with the consent of the data subject

*Universities, colleges, and training providers

Our applications and accompanying guidance set out which information will or may be shared with third parties, and for what purposes. Please review these fully to establish which personal data will be shared with third parties.

Some students may be eligible for a non-repayable Bursary or scholarship. Your University, College or training provider will become a joint data controller of the information used to determine whether you are eligible to receive a Bursary or scholarship, and if you are eligible, will pay the relevant sum to you. For your University, College or Training provider to determine your eligibility, we will share some of your personal information including your contact details, your financial circumstances and course details as well as some information about your eligibility for student finance with them. If you do not want us to share your information with your University, College or Training Provider for these purposes, please contact us using the relevant contact telephone number on page one of this notice.

In some cases, your University, College or Training Provider will also be a joint data controller of enrolment and attendance information used to verify the details of your course of study.

10. Transferring Information Outside the EU

We may transfer the personal information we collect about you to other countries outside the EU in carrying out the specific purposes that the personal information was collected for. We will only transfer your personal information to other countries outside of the EU whose data protection laws offer an equivalent or greater level of protection than EU and UK data protection laws. Where this is not possible, we will ensure appropriate safeguards are in place to ensure that your personal information is protected. For more information about transfers of your personal information outside the EU, please either write to the:

Data Protection Officer
Student Loans Company
10 Clyde Place
Glasgow
G5 8DF

or email DPO@slc.co.uk

11. Data Security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach, and we will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

12. Data Retention

SLC retains your personal information, and may retain that of relevant parties (such as your partner and your relatives) in order to:

• administer loans and grants to students in line with UK Government Administrations’ Policy/ Regulatory requirements
• enable assessment of any future eligibility or entitlement to study
• allow the auditing of the assessment and payment of student finance
• facilitate repayment of student finance
• improve customer satisfaction
• provide you with customer services, respond to any questions you may have and update your account information
• identify and prevent fraudulent activity
• maintain or develop systems and processes
• comply with legal and regulatory requirements

When customers take out a student loan, it’s likely that they’ll be making repayments towards it for several years after they’ve finished or left their course. This means we’ll hold on to the majority of their information until they’ve repaid their loan in full, or it’s been cancelled.

Our Records Management Policy involves key stages where information we hold on a customer’s record can be reduced through data minimisation/erasure activity. For example, six years after a customer has finished or left their course, or six years after a customer has fully paid off their loan. After a customer has received some non-repayable funding or has fully paid off their loan we’ll continue to hold a reduced amount of information on the customer, in the form of a ‘Lifetime’ record, ensuring that we’re only holding the necessary amount of data to fulfil our Regulatory obligations under our Public Task and no more. A customer’s Lifetime record is held until 70 years after their date of birth, when it will be fully erased from our systems.

For more information on how long we keep your information, see the SLC Records Management Policy by visiting www.gov.uk/government/publications/slcs-data-retention-policy or either write to the:

Data Protection Officer
Student Loans Company
10 Clyde Place
Glasgow
G5 8DF

or email DPO@slc.co.uk

In some circumstances (for example, for specific training or reporting purposes) we may anonymise [or pseudonymise] your personal information so that it can no longer be associated with you, in which case we may use such information without giving you any further notice.

13. Rights of Access, Correction, Erasure, and Restriction

13.1 Your duty to inform us of changes

It is important that the personal information we hold about you is accurate and up to date. You are obliged to let us know if your personal information changes eg. any contact details that you have provided as part of supporting an application- during your relationship with us.

13.2 Your rights in connection with personal information

You have the following rights in relation to your personal information:

• Request access to your personal information: You have a right to have access to the personal information which we hold about you, subject to certain legal limitations, including those set out in the Data Protection Act 2018. This is referred to as a data subject access request, or DSAR. Visit www.gov.uk/government/publications/data-subject-access-request for more information if you wish to exercise this right.
• Request correction of your personal information: You have a right to have your personal information corrected, or rectified, if it is inaccurate or incomplete. If you become aware that any of the data which we hold about you is inaccurate, you should contact us as soon as practicable. You must notify us immediately on becoming aware of any change of circumstances which require changes to be made to any of the personal information which we hold about you
• Request erasure (or deletion) of your personal information: You have a right to request the deletion or removal of your personal information where there is no compelling reason for its continued processing. Your right to make such a request will arise in specific circumstances, for example, where data is no longer necessary for the purpose for which it was collected or where you withdraw your consent for processing your data (where consent is the sole basis on which your data is processed). If you would like to exercise this right, you should submit a request specifying the information which you wish deleted. We will then consider this request in accordance with our obligations under data protection laws.
• Request the restriction of processing of your personal information: You have a right to block or suppress the processing of your personal information in certain circumstances. If for example you contest the accuracy of the personal data, processing may be restricted until the accuracy of the personal information has been verified. This may also apply where you contest that the processing is unlawful. If you would like to exercise this right, you should submit a request specifying the information which you would like us to impose a processing restriction.
• Request the transfer of your personal information to another party: You have a right to obtain and re-use your personal information for your own purposes across different services – this is referred to as the right to data portability. This allows you to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way. If you would like to exercise this right, you should submit a request specifying the information which you wish to be transferred. Where the right applies, we are obliged to comply with any such request within one month.
• Object to us processing your personal information: You have the right to object to the processing of your personal data if it is based on the performance of a task carried out in the public interest. You also have a right to object where we process your information for research purposes or where we carry out automated processing (see Automated Decision-Making section above). If you would like to exercise this right, you should submit a request outlining the grounds upon which you object. We will consider any request in accordance with our obligations under data protection laws.

If you want to exercise any of these rights, please either write to:

Subject Access Requests
Verification Operations
Student Loans Company
10 Clyde Place
Glasgow
G5 8DF

or email DSR_SLC@slc.co.uk

Please note that we may need to request specific information from you to help us confirm your identity and ensure that we comply with the right you are exercising. We are obliged to comply with any such requests within one month. This may be extended by an extra two months if we consider the rectification request to be complex.

14. Right to Withdraw Consent

In the limited circumstances where you may have provided your consent to us processing your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please see the relevant contact numbers listed on page one of this notice or write to the Data Protection Officer at the below address. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we are required to do so by law, or have another legitimate basis for doing so in law.

15. Data Protection Officer and Right to Complain

We have appointed a Data Protection Officer (“DPO”) to oversee compliance with this Notice. If you have any questions about this privacy notice or how we handle your personal information, please contact the DPO:

Data Protection Officer
10 Clyde Place
Glasgow
G5 8DF

Email: DPO@slc.co.uk

You also have the right to make a complaint at any time to the Information Commissioner’s Office (“ICO”), the UK supervisory authority for data protection issues about the way in which we process (or have processed) your personal information. You can contact the ICO by writing to:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF

Email: icocasework@ico.org.uk

Telephone: 0303 123 1113

16. Changes to this Notice

We reserve the right to update this Notice at any time. We may also notify you in other ways from time to time about the processing of your personal information.