Transparency data

Data Protection Statement /Job Applicant Privacy Notice (the “Notice”)

Updated 29 August 2025

Job Applicant Privacy Notice (this “Notice”)

PLEASE NOTE: This Notice is applicable to individuals (hereinafter referred to as “applicants”, “you,” and/or “your,” as appropriate in the particular context) engaging with the candidate application and recruitment process of the Student Loans Company Limited (“SLC,” “we,” “us,” and/or “our”).

This Notice explains how SLC, and others may use personal data (as defined below).

As part of our candidate application and recruitment process SLC collects, processes and stores personal data about you. Personal data is any data or information from which an individual can be identified or data which when mixed with other information held about the same individual would make it obvious as to who the subject of the data is. Examples of personal data include name, address, telephone number and employment history.

We may also collect, process and store special category data about you. Special category data

includes, for example, information about an individual’s health, racial or ethnic origin, religious or philosophical beliefs, biometric data (where it is used for identification purposes) or sexual orientation. We will only process this where it is necessary, and any processing will be done in accordance with our obligations under relevant UK data protection legislation.

SLC is a “controller”. This means that we are responsible for deciding how we hold and use personal data about you. We are required under UK data protection legislation to notify you of the information contained in this Notice.

SLC is committed to being transparent about how it uses your personal data and meets its UK data protection  obligations. This Notice sets out:

• how we collect your personal data;
• why we process your personal data;
• what personal data we might process; and
• how your personal data is processed as part of the candidate application and recruitment process eg. protected, retained and shared with.

Throughout this Notice we use the term “processing” to cover all activities involving your personal data, including collecting, handling, storing, sharing, accessing, using, transferring and disposing of the data.

1. How we collect your personal data

We collect personal data about applicants through the application and recruitment process, either directly from applicants or sometimes from an employment agency or background check provider. We may sometimes collect additional information from third parties including former employers, credit reference agencies or other background check agencies.

2. Why we process your personal data

In order to manage your application, we need to process certain personal data about you. Under the retained UK version of the General Data Protection Regulation and the Data Protection Act 2018, SLC must have a legal basis for processing your personal data. Additionally, special category data may only be processed where an additional lawful basis applies. We will process your personal data for the purposes of progressing your application as required by law or regulatory requirements, so not all of  the purposes for which we process your personal data will apply to you all of the time. SLC’s processing will always be fair and lawful and in accordance with applicable UK data protection legislation. In summary:

• we may need to process personal data to take steps at your request prior to entering into a contract  with you. We may also need to process your personal data to enter into (and comply with our obligations under) a contract with you;
• in some cases, we need to process personal data to ensure that we are complying with our legal obligations; for example, it is mandatory to check a successful applicant’s eligibility to work  in the UK before employment starts;
• SLC has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from applicants allows us to manage   the recruitment process, assess and confirm an applicant’s suitability for employment and to decide whom to offer a job;
• we may also need to process personal data from applicants to respond to and defend legal claims;
• SLC may process special categories of data, such as information to monitor recruitment statistics and to comply with legal obligations in relation to equality and diversity. We may   also collect information about whether or not applicants are disabled in order to make reasonable adjustments for candidates who have a disability in accordance with legal obligations in relation to equality; and
• we will also process your personal data to comply with obligations and exercise specific  rights in relation to employment, social security and/or social protection.

3. What personal data we might process

We may collect, store, and process the following categories of personal data:

• personal details such as name, address (including proof of address), date and place of birth, telephone number(s);
• work history/job data: previous employers, positions, dates;
• remuneration: basic salary, benefit entitlements, bonuses;
• education and work history including professional qualifications, skills and/or memberships;
• references to include regulated references where necessary (this could include absence information received from referees);
• nationality/visa/right to work information (e.g., passport/driving licence/national insurance numbers/birth certificate/evidence of name or gender change);
• results of pre-employment screening checks (e.g., credit history and criminal records checks where permitted by law);
• notes from interviews and/or assessment results e.g., psychometric test or written assessment results;
• bank account details for salary payment purposes (if successful); and
• images from onsite CCTV and audio recordings of telephone interviews (if relevant).

During the process we may also capture some special category data about you in order to make reasonable adjustments (e.g. details of any disabilities) and allow us to complete pre-employment checks.

In very limited circumstances, we may approach you for your explicit consent to allow us to process certain particularly sensitive data. If we do, we will provide you with full details of the personal data that we would like and the reason we need it, so that you can carefully consider whether you wish to consent.

4. Who we share your personal data with

SLC will need to share your personal data internally and may be required to share it with some external third parties (eg. Credit Reference Agencies) or associates of SLC. Your personal data will only be shared if it is necessary or required and permitted by law (eg. in order to carry out pre-employment screening).

The recruitment process will involve:

• assessing and progressing your application;
• assessing your suitability (e.g. skills, experience, and behaviours for the role); and/or
• activities needed to complete the on-boarding and screening process should your application be successful.

To enable these processes your personal data may be shared internally, but the information shared is limited to what is required by each individual to perform their role in the recruitment process: For example, your personal data may be shared internally with:

• employees who would have managerial responsibility for you or are acting on behalf of those employees;
• employees in SLC’s People Department who have responsibility for certain People Department processes (for example recruitment, assessment, pre-employment screening (including checking whether   applicants have a student loan and/or arrears);
• employees in Legal Services, Enterprise Risk & Compliance, People Department and those in the Economic Crime Unit with responsibility for investigating issues of  non-compliance with laws and regulations, policies and contractual requirements;
• employees in Information Technology (IT) who manage user access;
• employees in compliance and audit functions in relation to specific audits/investigations; and
• employees in Estates/Facilities.

SLC may also need to share your personal data with certain external third parties or associates including:

• entities who provide candidate interview and assessment services to SLC;
• suppliers who undertake background screening on behalf of SLC (credit checking agencies, criminal checking bureaus, etc.);
• academic institutions (Universities, colleges, etc.) in validating information you have provided; and
• other third-party suppliers (or potential suppliers) who provide services on our behalf.

5. Pre-employment checks:

Given the nature of our business, we have legal and regulatory obligations to ensure that the people we employ can be relied on to handle public money and customer information responsibly. As part of the selection process, SLC uses third parties to perform a number of pre-employment checks (e.g. personal reference, criminal record, fraud check and credit reference).

These pre-employment checks are only performed on applicants who have accepted an offer of employment from SLC.  We provide the third parties with your name, email address and telephone number; they will then contact you direct in advance of carrying out the checks. We can supply the names and addresses of the third parties we use upon request. We will also check whether an applicant who has accepted an offer of employment from SLC has a student loan and/or arrears.

6. How we protect your personal data:

We have in place appropriate organisational and technical (security) measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. This is done in accordance with SLC’s Information Security Policy.

We may transfer the personal data we collect about you to other countries outside the UK and European Economic Area (“EEA”) in carrying out the specific purposes that the personal data was collected for. We will only transfer your personal data to other countries outside of the EEA whose data protection laws offer an equivalent or greater level of protection than UK data protection law. Where this is not possible, we will ensure appropriate safeguards are in place to ensure that your personal data is protected.

7. Automated Decision making

Automated decision-making takes place when an electronic system uses personal data to make a decision without human intervention. We are allowed to use automated decision-making:

• where we have notified you of the decision and given you 21 days to request a reconsideration;
• where it is necessary to perform the contract with you and appropriate measures are in place to safeguard your rights; and
• in limited circumstances, with your explicit written consent and where appropriate measures are  in place to safeguard your rights.

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making unless we have a lawful basis for doing so and we have notified you.

We do not envisage that any decisions will be taken about you using automated means, however we will notify you in writing if this position changes.

8. Artificial Intelligence, Analytics and Machine Learning

SLC will only use Artificial Intelligence (“AI”), including analytics and machine learning where the law allows us, for the purposes of building efficient and effective staff processes in areas including resourcing and recruitment.

When using systems that involve AI and processing personal data, SLC complies with relevant data protection regulations, security, and ethical professional standards.

9. How long SLC keeps your personal data

If your application for employment is unsuccessful, SLC will hold your personal data on file in accordance with  our Records Management Policy. For more information on data retention, see the SLC Records Management Policy by visiting www.gov.uk/government/publications/slcs-data-retention-policy

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your People Department file and retained in accordance with our Records Management Policy. If successful, our Employee Privacy Notice will then apply to you.

You may be asked when you submit your CV/application, whether you consent to SLC holding your details in  order for you to be considered for other suitable positions within SLC.

10. Your duty to inform us of changes

It is your responsibility to keep your personal data up to date so that accurate application records can be maintained. If you need to make any changes to your personal data once you have submitted your application, then you should contact SLC’s People Department on People@slc.co.uk .

11. Your rights of access, correction, erasure, and restriction

Your rights in relation to your personal data are summarised below.

If you want to exercise any of these rights, please either write to:

Subject Access Requests,

Verification Operations,

Student Loans Company Limited,

10 Clyde Place,

Glasgow,

G5 8DF,

or email: dsr_slc@slc.co.uk

Please note that we may need to request specific information from you to help us confirm your identity and ensure that we comply with the right you are exercising. We are obliged to comply with any such requests within one month. This may be extended by an extra two months if we consider the request to be complex.

12. Request access to your personal data:

You have a right to request access to  personal data we hold about you, subject to certain limitations. This is referred to as a data subject access request, or DSAR.

13. Request correction of your personal data:

You have a right to have your personal data corrected, or rectified, if it is inaccurate or incomplete. If you become aware that any of the personal data which we hold about you is inaccurate, you should contact us as soon as practicable.

You must notify us immediately on becoming aware of any change of circumstances which require changes to be made to any of the personal data which we hold about you.

14. Request erasure (or deletion) of your personal data:

You have a right to request the   deletion or removal of your personal data where there is no compelling reason for its continued processing. Your right to make such a request will arise in specific circumstances, for example, where personal data is no longer necessary for the purpose for which it was collected or where you withdraw your consent for processing your personal data (and this is the sole basis on which your personal data is processed).

If you would like to exercise this right, you must    submit a request specifying the personal data which you wish to be deleted. We will then consider this request in accordance with our obligations under UK data protection law.

15. Request the restriction of processing of your personal data:

You have a right to block or suppress the processing of your personal data in certain circumstances. If for example you contest the accuracy of the personal data, processing may be restricted until the accuracy of the personal data has been verified. This may also apply where you contest that the processing is unlawful.

If you would like to exercise this right, you must submit a request specifying the personal data on which you would like us to impose a processing restriction.

16. Request the transfer of your personal data to another party:

You have a right to obtain and re-use your personal data for your own purposes across different services – this is referred to as the right to data portability. This allows you to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way.

If you would like to exercise this right, you must submit a request specifying the personal data which you wish to be transferred. Where the right applies, we are obliged to comply with any such request within one month.

17. Object to us processing your personal data:

You have the right to object to the processing of your personal data if it is based on the performance     of a task carried out in the public interest. You also have a right to object where we process your personal data for research purposes or where we carry out automated processing (see section 6 above on Automated Decision Making).

If you would like to exercise this right, you must submit a request outlining the grounds upon which you object. We will consider any request in accordance with our obligations under UK data protection law.

18. Right to Withdraw Consent:

If you have consented to us processing your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time.

If you would like to exercise this right, you must submit a request and once we have received this  notification, we will no longer process your personal data for the purpose or purposes you originally agreed to, unless we are required to do so by law, or have another legitimate basis for doing so in law.

19. What if you do not provide any personal data

You are under no statutory or contractual obligation to provide personal data to SLC during the recruitment process, however, if you do not provide all of the information we require, we may not be able to process your application.

20. Data Protection Officer and the Right to Complain

We have appointed a Data Protection Officer (“DPO”) to oversee compliance with this Notice. If you have any questions about this privacy notice or how we handle your personal data, please either write to:

Data Protection Officer 

10 Clyde Place

Glasgow

G5 8DF

or email: DPO@slc.co.uk 

You also have the right to make a complaint at any time to the Information Commissioner’s Office (“ICO”), the UK supervisory authority for data protection issues about the way in which we process (or have processed) your personal data. You can contact the ICO by writing to:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

SK9 5AF

or by emailing: icocasework@ico.org.uk  

or calling: 0303 123 1113 

21. Changes to this Notice

We reserve the right to update this Notice at any time. We may also notify you in other ways from time to time about the processing of your personal data.

August 2025