Guidance

STEP programme: privacy notice

This privacy notice explains how and why we use your personal data within the STEP programme.

• From: Ministry of Housing, Communities and Local Government and Department for Levelling Up, Housing and Communities
• Published: 15 August 2023
• Last updated: 3 November 2025 — See all updates

The Ministry of Housing, Communities and Local Government (MHCLG) is offering an English language and employment support programme (also known as STEP) for up to 4,000 individuals comprising of 50% Ukrainians and 50% Hong Kong British Nationals (Overseas) (HK BN(O)) visa holders in England.

The aim of the programme is to assist Ukrainians and resettled HK BN(O)s in entering or gaining higher-paid employment. The programme is delivered by World Jewish Relief in partnership with the British Council.

This Privacy Notice explains how and why we use your personal data within the STEP programme.

1. The identity and contact details of the Ministry of Housing, Communities and Local Government (MHCLG) and our Data Protection Officer   

MHCLG is the ‘data controller’ for your personal data where you take up the offer of English language training, and/or employment support within the STEP programme, and we need to collect and use your data to deliver this to you. ‘Data controller’ means that we are responsible for your personal information under UK data protection law (UK GDPR).

EnglishScore is another data controller whose role is to deliver English language tests and exams for Ukrainian and HK BN(O) participants, after you complete English language training. This means that they will be separately responsible for your data at the stage that you seek to take these exams See the EnglishScore privacy notice.

MHCLG’s Data Protection Officer can be contacted at dataprotection@communities.gov.uk.

2. Why we are collecting and using your personal data

We require your personal data to be able to provide you with English language training and / or to help facilitate employment support. If you choose to participate in the STEP programme. EnglishScore also needs to use your personal data in its role of providing and invigilating your language exams.

3. What data we are collecting

To administer and deliver English language training we will collect and use the following information about you:

1. Name, address, email address, telephone number 
2. Date of birth and age 
3. Visa details 
4. To provide eVisa share code details, including nationality.  
5. Employment status  
6. Information about technical equipment and access to wifi 
7. Access to DWP coach 
8. Childcare needs 
9. Qualifications 
10. Photo  
11. Resume (education and career summary) 
12. Student unique identification numbers 
13. National insurance numbers 
14. Application numbers 
15. Enrolment numbers 
16. Region 
17. Sex 
18. Duration in UK     
19. Course stage – enrolled, initial assessment completed; active/inactive, mid-course assessment complete/incomplete, final assessment complete/incomplete    
20. Attendance levels (days and hours attended) 
21. Dropout levels and reasons as to why learners left the programme 
22. English proficiency of attendees including assessment scores (initial, mid and final) 
23. Employment outcomes (employment levels pre and post intervention)  
24. The changes in the attitudes of learners to employment prospects/English language ability 
25. Attitudes of attendees to employment prospects/language acquisition (through pre and post intervention surveys)

EnglishScore - who are entirely separate from MHCLG - will provide testing and certification of your English language proficiency. They will need to use:

1. Your name, including to provide you with exam certificates if you pass
2. Your student unique identification number
3. Your English language scores
4. Information relating to photos of you and/or facial recognition – to verify that the student taking a test online or remotely, is really you
5. Recordings of your voice (to test your speaking skills)
6. English proficiency including assessment scores

Further details of data collected by EnglishScore can be found in the EnglishScore privacy notice.

To administer and deliver employment support, and continually monitor the effectiveness of STEP English Language Training and Employment Support assistance to Ukrainians and HK BN(O)s collect and use the following information about you:

1. Name
2. Address
3. Email address
4. Telephone number
5. Date of birth and age
6. National insurance numbers
7. Region you live in
8. Sex
9. Languages
10. Family information
11. Disability and accessibility needs
12. Childcare needs
13. Recent Photograph of you
14. eVisa share code details, including nationality
15. Duration spent in UK
16. Employment status, employment history and qualifications (including Resumé)
17. If you have used a work coach from the Department for Work and Pensions (DWP)
18. Student unique identification numbers, application numbers and enrolment numbers
19. Dropout levels and reasons as to why learners left the programme
20. Employment outcomes (employment levels pre and post intervention)
21. The changes in the attitudes of learners to employment prospects/English language ability
22. Attitudes of attendees to employment prospects/language acquisition (through pre and post intervention surveys)
23. Technical data from use of our online services – for example your Internet Protocol address, cookie session data

4. Lawful basis for processing the data 

We must have a lawful basis under UK data protection law to use your personal data lawfully. The relevant lawful basis for processing personal data is:

• UK GDPR Article 6(1) (e) - processing is necessary for the performance of a task carried out in the public interest,
• Data Protection Action 2018 (DPA) – Part 2, Chapter 2, Section 8 - processing of personal data that is necessary for the exercise of a function of the Crown, a Minister of the Crown or a government department.

We may process personal data that is more sensitive about you, which is called ‘special category data’. This can include biometric information (such as biometric residence permits and information on disability). We require an additional lawful basis to do this which is the following:

• UK GDPR Article 9(2)(g) processing is necessary for reasons of substantial public interest;
• DPA 2018 – Schedule 2, Part 1, section 6 – processing necessary for the exercise of a function of the Crown, a Minister of the Crown or a government department.

We also treat any nationality data about you as special category data

Please note that EnglishScore explain their own lawful basis in the EnglishScore privacy notice.

5. With whom we will be sharing the data

World Jewish Relief - are our main “data processor” delivering the STEP programme. They will only process personal data under strict terms we have put in place with them. World Jewish Relief are using the following providers to help them deliver English language and employment support:

1. The British Council – who are facilitating the English language support offer to you, training for which will be provided by trainers provided by the British Council
2. CaseWorthy - for data recording and storage of your personal data.

HM Revenue and Customs (HMRC) – World Jewish Relief will also share your National Insurance Number with HMRC. This is for the purpose of monitoring the effectiveness of the programme – from National Insurance number sharing, HMRC will be able to tell MHCLG how many participants in total have been successful in gaining employment or had changes in employment. Data returned from HMRC to MHCLG will be anonymised, so we cannot identify you or other participants when monitoring outcomes from the scheme. 

EnglishScore – who are the provider of English language tests and exams relating to your training.

Microsoft Corporation – MHCLG uses this company for its own IT services.

MHCLG may also publish anonymised data from this programme on GOV.UK.

6. For how long we will keep the personal data, or criteria used to determine the retention period

The World Jewish Relief and the British Council will delete personal data within one year of the contract ending and, in any event, at the point it is no longer needed for the delivery and monitoring of the programme effectiveness.  

Upon secure deletion, the suppliers will provide written confirmation to MHCLG that deletion has taken place, along with any supporting evidence.

7. Your rights, e.g. access and rectification

The data we are collecting is your personal data, and you have rights that affect what happens to it. Generally, you have the right to:

• know that we are using your personal data
• see what data we have about you
• ask to have your data corrected, and to ask how we check the information we hold is accurate
• complain to the Information Commissioner’s Office (see below)

If you wish to use any of these rights you should first contact dataprotection@communities.gov.uk.

8. Sending data overseas

MHCLG has ensured that appropriate UK GDPR safeguards have been put in place by World Jewish Relief to ensure that your data is processed securely and safely while in the USA. The applicable safeguard in this instance is the Data Protection Framework that provides for UK-US adequacy decisions for the parties signed up to the framework which allows for the safeguarding of data held in the US by WJR’s third party sub-contractor CaseWorthy (dataprivacyframework.gov).

Please note that EnglishScore are separately responsible for any personal data they may send overseas when administering your English language test exams; please refer to the EnglishScore privacy notice.

Apart from survey results which will be stored in the UK The supplier will store and manage all of the personal data listed above in CaseWorthy servers located in the United States (state of Utah) until September 2028.

9. Automated decision making

We will not use your data for any automated decision making.

10. Storage, security and data management

Your personal data will be stored securely. Where data is shared with third parties, as set out in section 5 above, we require third parties to respect the security of your data and to treat it in accordance with the law. All third parties are required to take appropriate security measures to protect your personal information in line with our policies.

11. Complaints and more information

When we or our supplier ask you for information, we will keep to the law, including the Data Protection Act 2018 and UK General Data Protection Regulation.

If you are unhappy with the way the Department has acted, you can make a complaint.

If you are not happy with how we are using your personal data, you should first contact dataprotection@communities.gov.uk.

If you are still not happy, or for independent advice about data protection, privacy and data sharing, you can contact:

The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113 or 01625 545 745
https://ico.org.uk/

Published 15 August 2023

Last updated 3 November 2025 + show all updates

1. 3 November 2025

   Updated privacy notice.

2. 15 August 2023

   First published.