Privacy Notice
The General Data Protection Regulation (GDPR) protects the rights of individuals by setting out certain rules as to what organisations can and cannot do with information about people. A key element to this is the principle to process individuals’ data lawfully and fairly. In order to meet the fairness part of this we need to provide information on how we process personal data.
The Institute for Arts in Therapy and Education (IATE) takes its obligations under the Data Protection Act very seriously and will always ensure personal data is collected, handled, stored and shared in a secure manner.
The following statement will outline what personal data we collect, how we use it and with whom we share it. It will also provide guidance on your individual rights and how to make a complaint to the Information Commissioner’s Office, the regulator for data protection in the UK.
IATE’S official contact details are: The Institute for Arts in Therapy & Education
2-18 Britannia Row
Islington
London
N1 8PA
+4420 7704 2534
How and why does IATE use personal data?
The largest volume of personal data IATE processes is in relation to students and former students. The primary purposes for which process information about these individuals include:
- to enable us to administer student-related functions from original applications through to graduation and to provide graduate services;
- to plan and account for the use of the services provided;
- to produce information including statistics for relevant partner or affiliated agencies. These agencies include, but is not limited to, The United Kingdom Council for Psychotherapy (UKCP), The University of East London (UEL), The British Association for Counselling and Psychotherapy (BACP) and The Heath Care Professions Council (HCPC);
- to monitor academic progress over the period of enrolment towards completion of a qualification;
- to carry out assessment, authorise award of qualifications and verification of awarded qualifications post-study;
- to monitor complaints, disciplinary cases and academic appeals;
- to provide student support services, including financial, pastoral and IT/learning resources;
- to monitor, develop and update Institute systems to ensure they continue to operate effectively and securely; and
- to monitor equality and diversity objectives within IATE.
IATE processes personal data in relation to staff, both academic and non-teaching. This is undertaken to facilitate recruitment activity and to administer the requirements IATE must meet as an employer in line with UK law. In addition, it is used to facilitate operational activity within the relevant faculty / professional service.
IATE collects personal data from students at various stages. The volume and nature of the personal data collected is outlined below:
What personal data does IATE collect?
IATE collects personal data from students at various stages. The volume and nature of the personal data collected is outlined below:
- Initial email/telephone enquiry:
- name and address
- contact details (telephone numbers, email addresses)
- Details from application forms:
- name and address
- contact details (telephone numbers, email addresses)
- gender
- date of birth
- nationality / residence / ethnic origin
- disability / additional educational needs
- educational qualifications
- criminal convictions
- language qualifications
- employment history
- mental health care history
- references
- photograph
- funding information
Once a candidate has been made an offer:
- Data collected at enrolment or updated during a student’s time at IATE:
- information needed to provide services in relation to disability, wellbeing or any other type of pastoral support
- course stage details
- attendance, progress and current status
- assessment results
- personal therapy and supervision details
- certain courses also require a DBS compliance check completed
Additional personal data may be collected by IATE where relevant in relation to placements, ongoing continuing professional development (CPD), professional body requirements, extenuating circumstances applications, appeals/complaints/disciplinary cases and any further optional student services.
IATE collects the following information from academic and non-teaching staff which is outlined below:
Initial application:
- name and address
- contact details (telephone numbers, email addresses)
- relevant qualifications or indication of highest qualification held
- professional development / training and membership of any professional body
- employment history
- supporting statement
- referee details
- criminal records disclosure
- data captured for equal opportunity monitoring (gender, date of birth, nationality, marital status, sexual orientation, religious belief, ethnicity)
- declaration about any disability as defined under the Equity Act 2010
Once a candidate has been made an offer of employment:
- bank details
- emergency contact details
- national insurance number
- health information
- passport information
- certain positions also require a DBS compliance check
Further personal data captured about an employee is likely to relate to any performance or appraisal process and any information needed to maintain a sickness/absence record.
Sharing of personal data
IATE is required to share personal data with certain other organisations in order to meet statutory requirements or to provide services to students and graduates. Sharing will always be undertaken in line with the requirements of data protection law, either through the consent of the individual, or another relevant legal gateway. The personal data that is actually shared will always be limited precisely to what the other organisation needs to meet its requirements or deliver its services.
The information below outlines the key partners with whom IATE shares personal data with on a periodic basis:
- The Health Care Professions Council (HCPC)
- The British Association for Counselling and Psychotherapy (BACP)
- The United Kingdom Council for Psychotherapy (UKCP)
- The University of East London (UEL) in order to process the administration of enrolment onto and graduation from the relevant validated/joint programme(s). For further information please see the UEL privacy notice
How long does IATE keep personal data?
IATE takes its obligations under the GDPR very seriously in terms of not holding onto personal data for any longer than is necessary. IATE has a retention schedule in place for the different categories of data it holds. For full details of the data retention timescales please contact the Data Protection Officer (
In some cases, there are good reasons as to why IATE needs to retain data about students and other individuals for a significant period of time. The most important reasons are outlined below:
- in order that student awards can be verified in the long-term;
- to produce transcripts and references;
- for graduate services and ongoing relations with IATE;
- to deal with complaints, appeals and disciplinary cases;
- to produce references on request from previous employees; and
- in order to meet pension obligations
Your rights
An individual has the right to ask IATE what personal data we hold about them, to ask for a copy of that information and to ask how their data is being processed. This is called making a Data Protection Subject Access Request (SAR).
An SAR can be submitted either verbally or in writing. If submitting a SAR in writing, you should direct it to the Data Protection Officer (
IATE reserves the right to ask you to provide proof of identification and for you to clarify your request if it is unclear in the first instance. You will receive a reply no longer than 30 calendar days from the date you make the request.
If you are unhappy with the initial response you can ask IATE to undertake a further search if there is specific information you have good reason to believe exists but that hasn’t been provided.
You also have the right to complain to the UK Regulator the Information Commissioner’s Office (ICO) if you believe you request has not been dealt with properly or you have a complaint to raise against IATE for any other data protection related issue. A complaint can be raised via the ICO website or write to the following address:
The Office of the Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
You also have the right to withdraw consent from the processing of your personal data by IATE at any time, if your consent was sought initially to use your personal data.
Right to rectify
If you believe IATE holds information about you that is factually incorrect, please contact your Academic Officer if you are a student or Sherla Richardson (
Your responsibilities
All students, staff and any other relevant individual who handles personal information of which IATE is responsible must follow the requirements of the Data Protection Policy.
