STEP programme: privacy notice
Source: gov.uk (2025-11-03)

This privacy notice explains how and why we use your personal data within the STEP programme.

The Ministry of Housing, Communities and Local Government (MHCLG) is offering an English language and employment support programme (also known as STEP) for up to 4,000 individuals comprising of 50% Ukrainians and 50% Hong Kong British Nationals (Overseas) (HK BN(O)) visa holders in England.

The aim of the programme is to assist Ukrainians and resettled HK BN(O)s in entering or gaining higher-paid employment. The programme is delivered by World Jewish Relief in partnership with the British Council.

This Privacy Notice explains how and why we use your personal data within the STEP programme.

1. The identity and contact details of the Ministry of Housing, Communities and Local Government (MHCLG) and our Data Protection Officer

MHCLG is the ‘data controller’ for your personal data where you take up the offer of English language training, and/or employment support within the STEP programme, and we need to collect and use your data to deliver this to you. ‘Data controller’ means that we are responsible for your personal information under UK data protection law (UK GDPR).

EnglishScore is another data controller whose role is to deliver English language tests and exams for Ukrainian and HK BN(O) participants, after you complete English language training. This means that they will be separately responsible for your data at the stage that you seek to take these exams See the EnglishScore privacy notice (https://www.englishscore.com/privacy-policy/).

MHCLG’s Data Protection Officer can be contacted at xxx@xxx.xx (mailto:xxx@xxx.xx).

2. Why we are collecting and using your personal data

We require your personal data to be able to provide you with English language training and / or to help facilitate employment support. If you choose to participate in the STEP programme. EnglishScore also needs to use your personal data in its role of providing and invigilating your language exams.

3. What data we are collecting

To administer and deliver English language training we will collect and use the following information about you:
- Name, address, email address, telephone number
- Date of birth and age
- Visa details
- To provide eVisa share code details, including nationality.
- Employment status
- Information about technical equipment and access to wifi
- Access to DWP coach
- Childcare needs
- Qualifications
- Photo
- Resume (education and career summary)
- Student unique identification numbers
- National insurance numbers
- Application numbers
- Enrolment numbers
- Region
- Sex
- Duration in UK
- Course stage – enrolled, initial assessment completed; active/inactive, mid-course assessment complete/incomplete, final assessment complete/incomplete
- Attendance levels (days and hours attended)
- Dropout levels and reasons as to why learners left the programme
- English proficiency of attendees including assessment scores (initial, mid and final)
- Employment outcomes (employment levels pre and post intervention)
- The changes in the attitudes of learners to employment prospects/English language ability
- Attitudes of attendees to employment prospects/language acquisition (through pre and post intervention surveys)
EnglishScore - who are entirely separate from MHCLG - will provide testing and certification of your English language proficiency. They will need to use:
- Your name, including to provide you with exam certificates if you pass
- Your student unique identification number
- Your English language scores
- Information relating to photos of you and/or facial recognition – to verify that the student taking a test online or remotely, is really you
- Recordings of your voice (to test your speaking skills)
- English proficiency including assessment scores
Further details of data collected by EnglishScore can be found in the EnglishScore privacy notice (https://www.englishscore.com/privacy-policy/).

To administer and deliver employment support, and continually monitor the effectiveness of STEP English Language Training and Employment Support assistance to Ukrainians and HK BN(O)s collect and use the following information about you:
- Name
- Address
- Email address
- Telephone number
- Date of birth and age
- National insurance numbers
- Region you live in
- Sex
- Languages
- Family information
- Disability and accessibility needs
- Childcare needs
- Recent Photograph of you
- eVisa share code details, including nationality
- Duration spent in UK
- Employment status, employment history and qualifications (including Resumé)
- If you have used a work coach from the Department for Work and Pensions (DWP)
- Student unique identification numbers, application numbers and enrolment numbers
- Dropout levels and reasons as to why learners left the programme
- Employment outcomes (employment levels pre and post intervention)
- The changes in the attitudes of learners to employment prospects/English language ability
- Attitudes of attendees to employment prospects/language acquisition (through pre and post intervention surveys)
- Technical data from use of our online services – for example your Internet Protocol address, cookie session data
4. Lawful basis for processing the data

We must have a lawful basis under UK data protection law to use your personal data lawfully. The relevant lawful basis for processing personal data is:
- UK GDPR Article 6(1) (e) - processing is necessary for the performance of a task carried out in the public interest,
- Data Protection Action 2018 (DPA) – Part 2, Chapter 2, Section 8 - processing of personal data that is necessary for the exercise of a function of the Crown, a Minister of the Crown or a government department.
We may process personal data that is more sensitive about you, which is called ‘special category data’. This can include biometric information (such as biometric residence permits and information on disability). We require an additional lawful basis to do this which is the following:
- UK GDPR Article 9(2)(g) processing is necessary for reasons of substantial public interest;
- DPA 2018 – Schedule 2, Part 1, section 6 – processing necessary for the exercise of a function of the Crown, a Minister of the Crown or a government department.
We also treat any nationality data about you as special category data

Please note that EnglishScore explain their own lawful basis in the EnglishScore privacy notice (https://www.englishscore.com/privacy-policy/).

5. With whom we will be sharing the data

World Jewish Relief - are our main “data processor” delivering the STEP programme. They will only process personal data under strict terms we have put in place with them. World Jewish Relief are using the following providers to help them deliver English language and employment support:
- The British Council – who are facilitating the English language support offer to you, training for which will be provided by trainers provided by the British Council
- CaseWorthy - for data recording and storage of your personal data.
HM Revenue and Customs (HMRC) – World Jewish Relief will also share your National Insurance Number with HMRC. This is for the purpose of monitoring the effectiveness of the programme – from National Insurance number sharing, HMRC will be able to tell MHCLG how many participants in total have been successful in gaining employment or had changes in employment. Data returned from HMRC to MHCLG will be anonymised, so we cannot identify you or other participants when monitoring outcomes from the scheme.

EnglishScore – who are the provider of English language tests and exams relating to your training.

Microsoft Corporation – MHCLG uses this company for its own IT services.

MHCLG may also publish anonymised data from this programme on GOV.UK.

6. For how long we will keep the personal data, or criteria used to determine the retention period

The World Jewish Relief and the British Council will delete personal data within one year of the contract ending and, in any event, at the point it is no longer needed for the delivery and monitoring of the programme effectiveness.

Upon secure deletion, the suppliers will provide written confirmation to MHCLG that deletion has taken place, along with any supporting evidence.

7. Your rights, e.g. access and rectification

The data we are collecting is your personal data, and you have rights that affect what happens to it. Generally, you have the right to:
- know that we are using your personal data
- see what data we have about you
- ask to have your data corrected, and to ask how we check the information we hold is accurate
- complain to the Information Commissioner’s Office (see below)
If you wish to use any of these rights you should first contact xxx@xxx.xx (mailto:xxx@xxx.xx).

8. Sending data overseas

MHCLG has ensured that appropriate UK GDPR safeguards have been put in place by World Jewish Relief to ensure that your data is processed securely and safely while in the USA. The applicable safeguard in this instance is the Data Protection Framework that provides for UK-US adequacy decisions for the parties signed up to the framework which allows for the safeguarding of data held in the US by WJR’s third party sub-contractor CaseWorthy (dataprivacyframework.gov).

Please note that EnglishScore are separately responsible for any personal data they may send overseas when administering your English language test exams; please refer to the EnglishScore privacy notice (https://www.englishscore.com/privacy-policy/).

Apart from survey results which will be stored in the UK The supplier will store and manage all of the personal data listed above in CaseWorthy servers located in the United States (state of Utah) until September 2028.

9. Automated decision making

We will not use your data for any automated decision making.

10. Storage, security and data management

Your personal data will be stored securely. Where data is shared with third parties, as set out in section 5 above, we require third parties to respect the security of your data and to treat it in accordance with the law. All third parties are required to take appropriate security measures to protect your personal information in line with our policies.

11. Complaints and more information

When we or our supplier ask you for information, we will keep to the law, including the Data Protection Act 2018 and UK General Data Protection Regulation.

If you are unhappy with the way the Department has acted, you can make a complaint (https://www.gov.uk/government/organisations/ministry-of-housing-communities-local-government/about/complaints-procedure).

If you are not happy with how we are using your personal data, you should first contact xxx@xxx.xx (mailto:xxx@xxx.xx).

If you are still not happy, or for independent advice about data protection, privacy and data sharing, you can contact:

The Information Commissioner’s OfficeWycliffe HouseWater LaneWilmslowCheshireSK9 5AF

Telephone: xx-xxxx-xxxx or xx-xxxx-xxxx https://ico.org.uk/