- About this privacy notice
This notice applies to the NSS. To view the privacy notice for the NSS Pilot 2020 please click here.
This notice sets out information about who processes your information, what they use it for, the legal bases for this processing, and your rights under data protection legislation.
This notice is regularly reviewed and sometimes updated, for example when organisations change their name, or to clarify how your information is used. Updates may be made at any time and you will always find the most up to date version at https://www.officeforstudents.org.uk/advice-and-guidance/student-information-and-data/national-student-survey-nss/contacts-and-privacy/
- Who carries out the National Student Survey and why?
The NSS is being carried out by Ipsos MORI, an independent research agency, on behalf of the Office for Students (OfS) and UK funding and regulatory bodies.
The OfS is the regulator of the higher education sector in England and has certain statutory functions set out in the Higher Education and Research Act 2017. The NSS forms part of OfS's legal requirement under this Act to ensure the quality of higher education in the providers it funds.
The OfS, the Department for Economy Northern Ireland (DfENI), the Higher Education Funding Council for Wales (HEFCW), and the Scottish Funding Council (SFC) have a statutory role in ensuring the quality of teaching in higher education is assessed. The OfS and its partners believe that students' views should form an important part of the assessment.
You can find more information about OfS and the work that they do on our website: https://www.officeforstudents.org.uk/.
The OfS has commissioned the survey on behalf of the UK funding and regulatory bodies – DfENI, HEFCW and the SFC. The NSS is a key component of the wider regulatory landscape in UK higher education and these bodies are responsible for funding the survey. The OfS may share student information, or parts of it, with these bodies who also use the survey results in the exercise of their statutory functions.
The commissioners of the survey are operating as controllers in common of the NSS dataset. The OfS is the 'data controller' of any personal information collected within scope of this privacy notice.
Ipsos MORI is a 'processor' working on behalf of the OfS to administer the NSS.
Both the OfS and Ipsos MORI are registered with the Information Commissioner's Office and you can check the entry details here: https://ico.org.uk/about-the-ico/what-we-do/register-of-data-controllers/
The OfS has also appointed a data dissemination provider, currently Texuna Technologies Ltd, to disseminate the results of the survey to participating universities/colleges and students' unions.
- What is the purpose of the NSS and what is the legal basis for processing my personal information?
The NSS is an annual survey that gives students the opportunity to provide feedback on their learning experience.
The NSS also aims to assist future generations of higher education students in their choices of what and where to study, by allowing them to see anonymous feedback on subjects and universities/colleges. It surveys students at higher education providers in England, Wales, Northern Ireland and Scotland and students studying higher education courses in directly-funded further education colleges in England, Northern Ireland and Wales. Results are publicly available each year via the Discover Uni website.
Under data protection legislation, a legal basis is required to be able to process your information. In this case the legal basis is:
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller (see GDPR Article 6(1)(e)) and for statistical and research purposes (see GDPR Article 89).
Processing of Special Categories of data is necessary for statistical and research purposes in accordance with Article 89(1) and Schedule 1 part (4) of the DPA 2018 (see GDPR Article 9(2)(j)).
- Who sees my personal information and how are my contact details obtained?
The OfS may, from time to time, engage other non-statutory bodies or agents to carry out functions on their behalf. The OfS has appointed Ipsos MORI to carry out this survey (NSS). Student information is initially collected by the Higher Education Statistics Agency (HESA) and the Education and Skills Funding Agency (ESFA) and supplied to the OfS. The OfS then requests student contact details from Higher Education Providers, Further Education Colleges and Alternative Providers to be passed to Ipsos MORI to conduct the survey. The OfS, the statutory authority, will retain control of any personal data transferred under contract with non-statutory bodies.
For the purposes of the NSS, Ipsos MORI is acting as a 'data processor' on behalf of the OfS. The OfS has a data protection agreement in place with Ipsos MORI, which provides the necessary protection to safeguard students' information. For example, they are forbidden under contract with the OfS from using the NSS data they have for any other purpose.
The OfS also has a data protection agreement in place with Texuna Technologies Ltd, the organisation that currently disseminates the results of the survey to Universities and Colleges and who receives parts of your survey data in a non-identifiable form. The agreement provides the necessary protection under the law to safeguard students' information.
The OfS is committed to protecting your personal information and being clear about what information we hold about you and how we use it. The OfS is the "data controller" of any personal information collated and transferred under contract with these survey agents. Your personal information will be kept strictly confidential by all parties involved, will be stored securely within the European Economic Area and will not be transferred outside that territory without the explicit written consent of the OfS and then ensuring suitable safeguards compliant with the requirements of data protection legislation are in place (whether in accordance with GDPR Article 46 or LED Article 37) as determined by the OfS. In the event of this occurrence each record of text will only be identifiable internally to Ipsos MORI by a serial number.
- What personal information do you collect about me?
The OfS or DfENI provide Ipsos MORI with the following categories of personal data for each eligible student:
- Date of birth
- Course details
- Unique identifiers
Universities and colleges provide Ipsos MORI with the following categories of personal data for each eligible student:
- Email addresses
- Telephone numbers
- Unique identifiers
- Language preference (Welsh)
This information is used purely for the purpose of delivering the survey and will not be shared with any external organisation.
In addition, your survey responses are collected through the survey instrument. Ipsos MORI collect metadata such as screen resolution, method of participation and time taken to complete the survey. This information is supplied to the OfS and is used only for survey development and evaluation purposes.
We can assure you that you will NOT be identifiable in any published results.
Special category data
The OfS will also match this data with the following special category data received from HESA and students' ILR:
- Religion (if applicable)
- Disability (if applicable)
- How will the information I provide be used?
Your responses to the NSS will be used solely for research purposes, which includes providing information to allow the UK funding and regulatory bodies to fulfil their statutory roles. The results of this research will be anonymous and provided in the form of statistical information only. We can assure you that you will NOT be identifiable in any published results.
Your participation in this research, together with your individual responses to the questions, will be kept strictly confidential in line with information security requirements and standards as agreed between Ipsos MORI and the OfS. We can also assure you that your individual responses and open text comments will NOT be used for marketing. However, universities/colleges are permitted to paraphrase open text comments in marketing materials from the core NSS questions, as long as the text does not identify any individuals, and the comments are not attributed to the NSS. We will not sell your information to any third parties.
If you have any questions about the NSS, please contact the research team at firstname.lastname@example.org.
- How long will my personal information be held for?
Your personal data will be used for the purposes of the NSS only. All student contact details will be destroyed soon after the survey is complete, and Ipsos MORI will securely remove all other student data from their computer systems and transfer it to the OfS. All data held by Texuna Technologies Ltd will be securely deleted at the end of the contract period.
Responses to the NSS will be retained indefinitely by the OfS for use in producing statistical analysis and research into quality and student experience, and trends in higher education. The information will not be used to make any decisions about individuals and any reports we publish will not include individualised data.
- How do the OfS and Ipsos MORI ensure my personal information is held securely?
The OfS and Ipsos MORI take responsibilities to keep your personal information secure very seriously. As such, we take every reasonable precaution to ensure your information is protected from loss, theft or misuse. These precautions include appropriate physical security of our offices, controlled access to computer systems and use of secure, encrypted internet connections when collecting personal information.
The OfS has a number of security measures in place to protect your personal information, including accreditation to the Cyber Essentials PLUS standard for cyber security, and mandatory staff training in data protection and information security on joining OfS and then on an annual basis.
Ipsos MORI has regular internal and external audits of its information security and is registered to the International Standard for Information Security, ISO 27001. Ipsos MORI is a member of the Market Research Society, which means we sign up to carrying out market research in an ethical and compliant way.
- How do I opt out of being contacted by Ipsos MORI to complete the survey?
You can ask Ipsos MORI to remove your details from the contact list being used for this survey. Ipsos MORI will ask you to confirm your details to ensure that the correct records are removed from the database. It is important that students verify their identity so the NSS provides robust data for potential students and their advisors to make informed choices. If a student opts out at any stage, all personal information (contact details, date of birth, etc.) will be securely and permanently deleted from the contact list used for this survey and they will not be contacted by Ipsos MORI again. Students may do this using the 'opt out' form on the thestudentsurvey.com website, or by contacting Ipsos MORI or the OfS. In exceptional circumstances, it may be necessary for the OfS to analyse student-level data relating to refusals or opt outs. In this case, Ipsos MORI will securely transfer data to the OfS about students who have actively opted out of the survey.
Please note some providers send their own communications to students regarding the NSS. Neither the OfS nor Ipsos MORI are responsible for these provider communications.
For further information, please contact the research team at email@example.com.
- How will the results of the survey be used?
The OfS and the UK funding and regulatory bodies will use the results of the survey to publish aggregated and anonymised results of the survey in the following ways:
- Published 'in context' on the websites of universities/colleges via a 'widget'. This is a small web application that displays information from the Discover Uni website for the course which the user is viewing.
- Published on the Discover Uni website that enables users to search and compare information about courses and universities/colleges.
- Data are also envisaged to be available via the UCAS course search tool (Course Finder), so users can view the data at the same time as viewing the courses to which they are interested in applying.
- For analysis. This may result in the UK funding and regulatory bodies undertaking research or the release of data, including any open comments that you may make, to OfS-approved users (on behalf of the other UK funding and regulatory bodies), such as academic researchers and sector organisations for the purpose of conducting analysis or research. The OfS will retain control of the data under contract with such users or if that user is subcontracting, we will require they have the same controls. Reports will only present anonymised and aggregated data. These reports will have certain Special Category data appended, provided to the UK funding and regulatory bodies by HESA. These categories are ethnicity, religion (for Northern Ireland only), and disability (if applicable).
- To provide summary feedback to individual universities/colleges. These data will be provided to universities/colleges to help them identify where their strengths lie and also how they can make improvements. This summary feedback will be aggregated and anonymised, ensuring no individual student can be identified. These results may include the text of any comments that students provide at the end of the questionnaire. This text will not be attributed to individuals and students are advised to avoid making comments that: could enable them to be individually identified; name individuals; or make references that could identify an individual. Although names are removed from the NSS feedback, it may still be possible for those working at a university/college to identify themselves and colleagues. Therefore, such information may be personal data and universities/colleges are asked to bear this in mind when processing the data. These data will have certain Special Category data appended, provided to the UK funding and regulatory bodies by HESA. These categories are ethnicity, religion (for Northern Ireland only), and disability (if applicable).
- Universities/colleges may use their NSS results in marketing materials, to promote particular courses or the provider as a whole. This is permitted, but there are several restrictions depending on the type and quality of the data being shared.The publication thresholds (a minimum 50 per cent response rate and at least 10 students) must be adhered to at all levels. Any results below this threshold must not be published.NSS results from published data may be used in marketing materials and attributed to the NSS, providing the above-mentioned publication thresholds are met. NSS results from unpublished data such as optional bank questions or provider specific questions may also be used in marketing materials, but these may not be attributed to the NSS. However, free text comments should not be used in publicly available materials in order to preserve the anonymity of students. The above-mentioned publication thresholds must be met for the cohort whose results are being published. The anonymised open text comments are only shared with the relevant university/college or UK funding and regulatory body, or with OfS-approved researchers of sector organisations. Therefore, universities/colleges may not quote open text comments in marketing materials. However, open text comments from the core NSS questionnaire may be paraphrased in marketing materials, as long as the text does not identify any individuals, and the comments are not attributed to the NSS. Open text comments from the optional bank questions or the provider-specific questions may not be used in any form. Although names are removed from the NSS feedback, it may still be possible for those working at a university/college to identify themselves and colleagues. Therefore, such information may be personal data and universities/colleges are asked to bear this in mind when processing the data.
- Optional questions
Some universities/colleges ask their students optional or university/college-specific questions. These questions are asked via the online survey only and provide additional confidential feedback to universities/colleges. The OfS and the UK funding and regulatory bodies use the information for the following purposes:
- To provide summary feedback to individual universities/colleges. These data will be provided to universities/colleges to help them identify where their strengths lie and how they can make improvements.
- For statistical analysis. This may result in the release of data to other approved users, which may include academic researchers. The OfS will retain control of the data under contract with such users or if that user is subcontracting, we will require they have the same controls. Reports will only present anonymised and aggregated data.
- These data will not be published on the Discover Uni website.
- How can I exercise my rights under the data protection legislation?
All information is used in compliance with data protection legislation (the General Data Protection Regulation and the Data Protection Act 2018). Once your personal information has been collected, you have certain rights in relation to that personal information that may be exercised, including the right to:
- A copy of your personal information, via a process known as a Subject Access Request
- Correct inaccurate personal information held about you
- Ask for your personal information to be deleted (within certain limits)
- Restrict processing of your personal information
All these rights have certain limitations depending on the request and the purpose for which we are holding your personal information.
If you have any concerns about the use of data for these purposes or would like to exercise one of your rights above, including making a Subject Access Request, please contact the Data Protection Officer at the OfS by emailing firstname.lastname@example.org, or by visiting https://www.officeforstudents.org.uk/contact/how-to-request-information-from-us/. You may also make this request by post, by writing to the following address:
Data Protection Officer
Lime Kiln Close
A Subject Access Request will be fulfilled within one month of receipt of the request. The OfS will determine if any of the relevant exemptions apply, so information may be redacted accordingly. This includes any content that: contains the personal data of a third party or otherwise identifies a third party; would prejudice the prevention or detection of a crime; contains legal advice; contains data that, if disclosed, would adversely affect the ability of the UK funding & regulatory bodies to carry out their public functions. Please note that this is not an exhaustive list, and the OfS will apply any exemptions on a case-by-case basis.
Any requests to rectify or delete personal information will be processed as soon as possible after receipt of the request. Please note that not all personal data can be deleted where this would adversely affect the ability of the UK funding & regulatory bodies to carry out their public functions.
To ensure that any of the above processes are applied to the correct data subject, the OfS may require some further identifying information. This may include a date of birth, or a copy of a data subject's passport or driving licence.
Further information can be found about these rights and our processes for handling such requests on the OfS website at:
If we are not able to resolve the issue to your satisfaction, you can also make a complaint to the data protection supervisory authority. In the UK, this is the Information Commissioner's Office (ICO) and they can be contacted at:
Information Commissioner's Office
Tel: 0303 123 1113
- How can I obtain further details about this privacy statement or our compliance with it?
If you have any questions or require further information about this privacy statement, Ipsos MORI's compliance with data protection laws or the information held about you for this research; please contact the OfS using the details above or Ipsos MORI's Compliance Department. They can be contacted by email sent to: email@example.com with 19-050405-01 NSS 2020 as the subject or by letter sent to: Ref: 19-050405-01 NSS 2020, Compliance Department, Ipsos MORI UK Ltd, 3 Thomas More Square, London, E1W 1YW.
- Can I provide feedback on the NSS?
Yes. Ipsos MORI, the OfS and the UK funding and regulatory bodies are committed to continuously improving the NSS. Should you have a question, comment and/or complaint about this research please contact Ipsos MORI at firstname.lastname@example.org or the OfS at email@example.com, or by letter sent to: National Student Survey, Ipsos MORI, Kings House, Kymberley Road, Harrow, HA1 1PT