About this privacy notice
This notice applies to the NSS. It sets out information about who processes your information, what they use it for, the legal bases for this processing, and your rights under data protection legislation.
This notice is regularly reviewed and sometimes updated, for example when organisations change their name, or to clarify how your information is used. Updates may be made at any time and you will always find the most up to date version at https://www.officeforstudents.org.uk/advice-and-guidance/student-information-and-data/national-student-survey-nss/contacts-and-privacy/
Who carries out the National Student Survey and why?
The NSS is being carried out by Ipsos MORI, an independent research agency, on behalf of the Office for Students (OfS) and UK funding and regulatory bodies.
The OfS is the regulator of the higher education sector in England and has certain statutory functions set out in the Higher Education and Research Act 2017. The NSS forms part of OfS’s legal requirement under this Act to ensure the quality of higher education in the providers it funds. You can find more information about OfS and the work that they do on their website: www.officeforstudents.org.uk.
The OfS, the Department for Economy Northern Ireland (DfENI), the Higher Education Funding Council for Wales (HEFCW), and the Scottish Funding Council (SFC) have a statutory role in ensuring the quality of teaching in higher education is assessed. The OfS and its partners believe that students’ views should form an important part of the assessment.
The OfS has commissioned the survey on behalf of the UK funding and regulatory bodies – DfENI, HEFCW and the SFC. The NSS is a key component of the wider regulatory landscape in UK higher education and these bodies are responsible for funding the survey.
The commissioners of the survey are operating as controllers in common of the NSS dataset. The OfS is the ‘data controller’ of any personal information collected within scope of this privacy notice.
Ipsos MORI is a ‘data processor’ working on behalf of the OfS to administer the NSS.
Both the OfS and Ipsos MORI are registered with the Information Commissioner’s Office and you can check the entry details here: https://ico.org.uk/about-the-ico/what-we-do/register-of-data-controllers/
The OfS has also appointed a data dissemination provider, Texuna Technologies Ltd, to disseminate the results of the survey to participating universities/colleges and students’ unions.
What is the purpose of the NSS and what is the legal basis for processing my personal information?
The NSS is an annual survey that gives students the opportunity to provide feedback on their learning experience.
The NSS also aims to assist future generations of higher education students in their choices of what and where to study, by allowing them to see anonymous feedback on subjects and universities/colleges. It surveys students at higher education providers in England, Wales, Northern Ireland and Scotland and students studying higher education courses in directly-funded further education colleges in England, Northern Ireland and Wales. Results are publicly available each year via the Discover Uni website.
Under data protection legislation, a legal basis is required to be able to process your information. In this case the legal bases are:
- Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller (see GDPR Article 6(1)(e)) and for statistical and research purposes (see GDPR Article 89).
- Processing of Special Categories of data is necessary for statistical and research purposes in accordance with Article 89(1) and Schedule 1 part (4) of the DPA 2018 (see GDPR Article 9(2)(j)).
Who sees my personal information?
The OfS is the “data controller” of any personal information collated and transferred under contract with survey agents. The OfS may, from time to time, engage other non-statutory bodies or agents to carry out functions on their behalf.
The OfS has appointed Ipsos MORI to carry out this survey (NSS). For the purposes of the NSS, Ipsos MORI is acting as a ‘data processor’ on behalf of the OfS. The OfS has a data protection agreement in place with Ipsos MORI which includes measures for safeguarding your personal information.
The OfS also has a data protection agreement in place with Texuna Technologies Ltd, the organisation that currently disseminates the results of the survey to Universities and Colleges and who receives parts of your survey data in a non-identifiable form. The agreement provides the necessary protection under the law to safeguard students’ information.
The OfS may share student information, or parts of it, with the UK funding and regulatory bodies – DfENI, HEFCW and the SFC who also use the survey results in the exercise of their statutory functions.
The OfS is committed to protecting your personal information and being clear about what information we hold about you and how we use it. Your personal information will be kept strictly confidential by all parties involved. It will be stored securely within the European Economic Area, and will not be transferred outside that territory without the explicit written consent of the OfS and then ensuring suitable safeguards compliant with the requirements of data protection legislation are in place (whether in accordance with GDPR Article 46 or LED Article 37) as determined by the OfS. In the event of a transfer outside of the European Economic Area, each record of text will only be identifiable internally to Ipsos MORI by a serial number.
What personal information do you collect about me and how are my contact details obtained?
Student information is initially collected by the Higher Education Statistics Agency (HESA) and the Education and Skills Funding Agency (ESFA) and supplied to the OfS. The OfS or DfENI provide Ipsos MORI with the following categories of personal data for each eligible student:
- date of birth
- course details
- unique identifiers.
The OfS then requests student contact details from universities and colleges to be passed to Ipsos MORI to conduct the survey. Universities and colleges provide Ipsos MORI with the following categories of personal data for each eligible student:
- email addresses
- telephone numbers
- unique identifiers
- language preference (Welsh).
This information is used purely for the purpose of delivering the survey and will not be shared with any external organisation.
In addition, your survey responses are collected through the survey instrument. Ipsos MORI collect metadata such as screen resolution, method of participation and time taken to complete the survey. This information is supplied to the OfS and is used only for survey development and evaluation purposes.
The OfS will also match this data with the following special category data received from HESA and students’ ILR, but these are not processed by Ipsos MORI:
- religion (if applicable)
- disability (if applicable).
We can assure you that you will NOT be identifiable in any published results.
How will the information I provide be used?
Your responses to the NSS will be used solely for research purposes, which includes providing information to allow the UK funding and regulatory bodies to fulfil their statutory roles. These responses will be retained by the OfS in a pseudonymised format. Pseudonymisation is a technique that replaces or removes information that identifies an individual.
Results of this research made available to universities and colleges, as well as publicly, will be anonymised and provided in the form of statistical information only. We can assure you that you will NOT be identifiable in any published results.
Your participation in this research, together with your individual responses to the questions, will be kept strictly confidential in line with information security requirements and standards as agreed between Ipsos MORI and the OfS. We can also assure you that your individual responses and open-text comments will NOT be used for marketing. However, universities/colleges are permitted to paraphrase open-text comments in marketing materials from the core NSS questions, as long as the text does not identify any individuals, and the comments are not attributed to the NSS. We will not sell your information to any third parties.
How long will my personal information be held for?
Your personal data will be used for the purposes of the NSS only.
- All student contact details will be destroyed by Ipsos MORI within one calendar month of survey closure (by 31st May 2021).
- Within three calendar months of project closure, Ipsos MORI will securely remove all other student data from their computer systems and transfer it in a pseudonymised format to the OfS, by 31st October 2021.
Pseudonymised responses to the NSS will be retained indefinitely by the OfS for use in producing statistical analysis and research into quality and student experience, and trends in higher education. The information will not be used to make any decisions about individuals and any reports the OfS publish will not include individualised data.
How do the OfS and Ipsos MORI ensure my personal information is held securely?
The OfS and Ipsos MORI take responsibilities to keep your personal information secure very seriously. As such, we take every reasonable precaution to ensure your information is protected from loss, theft or misuse. These precautions include appropriate physical security of our offices, controlled access to computer systems and use of secure, encrypted internet connections when collecting personal information.
The OfS has a number of security measures in place to protect your personal information, including accreditation to the Cyber Essentials PLUS standard for cyber security, and mandatory staff training in data protection and information security on joining OfS and then on an annual basis.
Ipsos MORI has regular internal and external audits of its information security and is registered to the International Standard for Information Security, ISO 27001. Ipsos MORI is a member of the Market Research Society, which means they sign up to carrying out market research in an ethical and compliant way.
How do I opt out of being contacted by Ipsos MORI to complete the survey?
You can ask Ipsos MORI to remove your details from the contact list being used for this survey. Ipsos MORI will ask you to confirm your details to ensure that the correct records are removed from the contact list. It is important that students verify their identity so the NSS provides robust data for potential students and their advisors to make informed choices. If a student opts out at any stage, all personal information (contact details, date of birth, etc.) will be securely and permanently deleted from the contact list used for this survey and they will not be contacted by Ipsos MORI again. Students may do this using the ‘opt-out’ form on the thestudentsurvey.com website, or by contacting Ipsos MORI or the OfS. In exceptional circumstances, it may be necessary for the OfS to analyse student-level data relating to refusals or opt-outs. In this case, Ipsos MORI will securely transfer data to the OfS about students who have actively opted out of the survey.
Please note some providers send their own communications to students regarding the NSS. Neither the OfS nor Ipsos MORI are responsible for these provider communications.
For further information, please contact the research team at email@example.com.
How will the results of the survey be used?
The OfS and the UK funding and regulatory bodies will use the results of the survey to publish aggregated and anonymised results of the survey in the following ways:
- Published ‘in context’ on the websites of universities/colleges via a ‘widget’. This is a small web application that displays information from the Discover Uni website for the course which the user is viewing.
- Published on the Discover Uni website that enables users to search and compare information about courses and universities/colleges.
- Data are also envisaged to be available via the UCAS course search tool (Course Finder), so users can view the data at the same time as viewing the courses to which they are interested in applying.
- For analysis. This may result in the UK funding and regulatory bodies undertaking research or the release of data, including any open comments that you may make, to OfS-approved users (on behalf of the other UK funding and regulatory bodies), such as academic researchers and sector organisations for the purpose of conducting analysis or research. The OfS will retain control of the data under contract with such users or if that user is subcontracting, we will require they have the same controls. Reports will only present anonymised and aggregated data. These reports will have certain Special Category data appended, provided to the UK funding and regulatory bodies by HESA. These categories are ethnicity, religion (for Northern Ireland only), and disability (if applicable).
- To provide summary feedback to individual universities/colleges. These data will be provided to universities/colleges to help them identify where their strengths lie and also how they can make improvements. This summary feedback will be aggregated and anonymised, ensuring no individual student can be identified. These results may include the text of any comments that students provide at the end of the questionnaire. This text will not be attributed to individuals and students are advised to avoid making comments that: could enable them to be individually identified; name individuals; or make references that could identify an individual. Although names are removed from the NSS feedback, it may still be possible for those working at a university/college to identify themselves and colleagues. Therefore, such information may be personal data and universities/colleges are asked to bear this in mind when processing the data. These data will have certain Special Category data appended, provided to the UK funding and regulatory bodies by HESA. These categories are ethnicity, religion (for Northern Ireland only), and disability (if applicable).
- Universities/colleges may use their NSS results in marketing materials, to promote particular courses or the provider as a whole. This is permitted, but there are several restrictions depending on the type and quality of the data being shared. The publication thresholds (a minimum 50 per cent response rate and at least 10 students) must be adhered to at all levels. Any results below this threshold must not be published. NSS results from published data may be used in marketing materials and attributed to the NSS, providing the above-mentioned publication thresholds are met. NSS results from unpublished data such as optional bank questions or provider specific questions may also be used in marketing materials, but these may not be attributed to the NSS. However, free-text comments should not be used in publicly available materials in order to preserve the anonymity of students. The above-mentioned publication thresholds must be met for the cohort whose results are being published. The anonymised open-text comments are only shared with the relevant university/college or UK funding and regulatory body, or with OfS-approved researchers of sector organisations. Therefore, universities/colleges may not quote open-text comments in marketing materials. However, open-text comments from the core NSS questionnaire may be paraphrased in marketing materials, as long as the text does not identify any individuals, and the comments are not attributed to the NSS. Open-text comments from the optional bank questions or the provider-specific questions may not be used in any form. Although names are removed from the NSS feedback, it may still be possible for those working at a university/college to identify themselves and colleagues. Therefore, such information may be personal data and universities/colleges are asked to bear this in mind when processing the data.
Please note, in September 2020 the OfS announced a two-stage internal review of the NSS following a request by the universities minister in England. The OfS will consider the outcome of the NSS review to ensure the 2021 NSS results are aligned to any amendments resulting from the review. A decision regarding the publication of results for providers in England will be taken in early 2021 following the outcome of the first phase of the review of the NSS. For providers in other nations, further detailed information and a timetable for publication of the results will follow in April 2021.
Some universities/colleges ask their students optional or university/college-specific questions. These questions are asked via the online survey only and provide additional confidential feedback to universities/colleges. The OfS and the UK funding and regulatory bodies use the information for the following purposes:
- To provide summary feedback to individual universities/colleges. These data will be provided to universities/colleges to help them identify where their strengths lie and how they can make improvements.
- For statistical analysis. This may result in the release of data to other approved users, which may include academic researchers. The OfS will retain control of the data under contract with such users or if that user is subcontracting, we will require they have the same controls. Reports will only present anonymised and aggregated data.
- These data will not be published on the Discover Uni
How can I exercise my rights under the data protection legislation?
All information is used in compliance with data protection legislation (the General Data Protection Regulation and the Data Protection Act 2018). Once your personal information has been collected, you have certain rights in relation to that personal information that may be exercised, including the right to ask:
- for a copy of your personal information, via a process known as a Subject Access Request
- to update or rectify inaccurate personal information held about you
- for your personal information to be deleted (within certain limits)
- for your survey responses to be deleted
- not to be contacted again (do-not-contact request)
- to restrict the processing of your personal information
- to object to the processing and automatic processing of your personal information
Please note that these are not absolute rights and do not apply in all circumstances, depending on the request and the purpose for which we are holding your personal information.
If you have any concerns about the use of data for these purposes or would like to exercise one of your rights above, please contact the Data Protection Officer at the OfS by emailing firstname.lastname@example.org, or by visiting www.officeforstudents.org.uk/contact/how-to-request-information-from-us/.
You may also make this request by post, by writing to the following address:
Data Protection Officer
Lime Kiln Close
A Subject Access Request will be fulfilled within one month of receipt of the request. The OfS will determine if any exemptions apply, so information may be redacted accordingly. Exemptions include any content that: contains the personal data of a third party or otherwise identifies a third party; would prejudice the prevention or detection of a crime; contains legal advice; contains data that, if disclosed, would adversely affect the ability of the UK funding & regulatory bodies to carry out their public functions. Please note that this is not an exhaustive list, and the OfS will apply any exemptions on a case-by-case basis.
Requests to rectify or delete personal information will be processed as soon as possible after receipt of the valid request. Please note that not all personal data can be deleted where this would adversely affect the ability of the UK funding and regulatory bodies to carry out their public functions.
To ensure that any of the above processes are applied to the correct data subject, the OfS may require some further identifying information. This may include a date of birth, or a copy of a data subject’s passport or driving licence.
Please note that in order to fulfil your request and collate all personal information in scope, your details may need to be shared between Ipsos MORI and the OfS, and other organisations processing for the purposes of the NSS.
Further information can be found about these rights and our processes for handling such requests on the OfS website at www.officeforstudents.org.uk/ofs-privacy/individual-rights-under-the-general-data-protection-regulation/
If we are not able to resolve the issue to your satisfaction, you can also make a complaint to the data protection supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO) and they can be contacted at:
Information Commissioner’s Office
Tel: 0303 123 1113
How can I obtain further details about this privacy statement or our compliance with it?
If you have any questions or require further information about this privacy statement, Ipsos MORI’s compliance with data protection laws or the information held about you for this research; please contact the OfS using the details above or Ipsos MORI. Ipsos MORI can be contacted by email sent to: TheStudentSurvey@ipsos.com with 20-033438-01 NSS 2021 as the subject or by letter sent to:
Ref: 20-033438-01 NSS 2021
The National Student Survey
Can I provide feedback on the NSS?
Yes. Ipsos MORI, the OfS and the UK funding and regulatory bodies are committed to continuously improving the NSS. Should you have a question, comment and/or complaint about this research please contact Ipsos MORI at email@example.com or the OfS at firstname.lastname@example.org, or by letter sent to Ipsos MORI to:
National Student Survey
This privacy notice was last updated in October 2020.