1. Why are we processing this data?
The NOA Establishment Portal allows Establishments that have purchased NOA products to use the Portal’s Reporting Tool for the purpose of analysing assessment results and viewing reports. Where Establishments use the NOA Reporting Tool for this purpose they are the data controller and are responsible for data uploaded to the service. Establishments should ensure that they follow the requirements of data protection legislation (UK GDPR and the Data Protection Act 2018) and provide appropriate privacy information to staff, Learners and their parents and guardians to explain its use. We are the data processer in such an arrangement.
NFER as the data processor
NFER acts as the data processor when we process the Establishment’s personal data for the following purposes:
- To create and administer Establishment Admin and Teacher User accounts.
- To provide access to the NOA Establishment Portal:
- Any data uploaded to the NOA Establishment Portal is at the discretion of the Establishment.
- The Establishment is responsible for the creation of any additional Admin/Teacher User accounts including provision of relevant user data (as defined below). The Establishment can also add, edit, and delete users’ accounts and Learners’ details provided this done via Admin User of the Establishment Portal.
- The Establishment is responsible for adding Learner data (as defined below). Establishments must have the appropriate permissions in place before uploading any sensitive data to the Establishment Portal in accordance with data protection legislation.
- To communicate updates to Establishments regarding the software and technical support and troubleshooting.
- In anticipation of continued use of this service by the Establishment, “user data” and “Learner data” will be stored securely to allow progress measures to be shown.
- If the Establishment no longer intends to use the Establishment Portal and informs us, its account will be deleted by NFER 45 days after this point in time. Retention of data extracted from the Establishment Portal for research purposes is covered in section 7 below.
NFER as the data controller
When acting as the data controller, NFER may use user and learner personal data and operational data relating to learners (e.g. time taken to respond to questions) collected in relation to the use of the NOA Establishment Portal for the following purposes:
- Promoting NFER’s research and products
- To inform the Establishment about related NFER research projects, products and services for sales and marketing purposes.
- Research and assessment improvement
- For NFER’s own research to inform education policy and practice for the public good. For example, analysis of Learner data to allow reporting of education standards and attainment year on year, attainment gaps across the country, and the impact of Government or local education policies. This supports NFER’s charitable aims, details of which are available on NFER’s website. Learners’ personal data will be used to allow matching to data held in the National Pupil Database (or other administrative datasets), where necessary for the relevant research.
- On completion of a piece of research, NFER may deposit the dataset in the UK Data Archive (managed by UK Data Service) or for the Education Endowment Fund (EEF) Data Archive (managed by FFT Education). This supports NFER’s commitment to open science and methodological developments.
- Any deposited Learner data would have been pseudonymised with names and unique Learner numbers replaced by another numeric identifier. Establishment identifiers would be included.
- For NFER’s own research to support the development and improvement of NFER’s research and assessment tools including the re-standardisation of assessments.
- If the Establishment has agreed, NFER will also extract some historical data from the Establishment Portal so NFER can undertake research looking at a wider data set, which looks at the learning loss associated with the Covid-19 pandemic, or to analyse the types of questions children commonly get wrong historically across all establishments to help inform teaching and the curriculum.
- To inform the Establishment about published research based on data extracted from the NOA Establishment Portal.
2. What is the legal basis for processing activities?
NFER relies on the following legal basis for the different activities it undertakes when processing personal data.
Legal basis when NFER is the data controller
To fulfil orders for its tests placed by establishments we process user data (defined below) | UK GDPR Article 6 (1) (b) Performance of a contract |
To inform the establishment about related NFER research projects and their outputs and other NFER products and services for which we process user data | UK GDPR Article 6 (1) (f) – legitimate interest NFER has carried out a legitimate interest assessment; sharing information about related research fulfils one of NFER’s core business purposes (developing research products and services to improve learning outcomes). Sharing research outputs has wider societal benefits as it contributes to improving teaching practice. Personal data is required to share the research outputs, but processing does not override the data subject’s interests. To mitigate the risks to the rights and freedoms of the individual data subjects, as far as possible, NFER has put in place the technical and organisational measures set out in this privacy notice. |
To carry out its own research which informs policy and practice for the public good including research on historical data which looks at the learning loss associated with the Covid-19 pandemic, or to analyse the types of questions children commonly get wrong historically across all establishments to help inform teaching and the development of the curriculum for which we process learner data (defined below) | UK GDPR Article 6 (1) (f) legitimate interest
NFER has carried out a legitimate interest assessment. The research fulfils one of NFER’s core business purposes (undertaking research, evaluation, and information activities). It has broader societal benefits as the output of the research will contribute to a strong evidence base and help to improve the lives of learners. The research cannot be done without processing personal data, but processing does not override the data subject’s interests. To mitigate the risks to the rights and freedoms of the individual data subjects, as far as possible, NFER has put in place the technical and organisational measures set out in this privacy notice. |
To support development and improvement of NFER’s assessments and research tools for which we process learner data [and user data] | UK GDPR Article 6 (1) (f) legitimate interest
NFER has carried out a legitimate interest assessment. The research fulfils one of NFER’s core business purposes (developing, trialling, and delivering assessments). It has broader societal benefits as it will help maintain the accuracy and rigor of NFER tests. The research cannot be done without processing personal data, but processing does not override the data subject’s interests. To mitigate the risks to the rights and freedoms of the individual data subjects as far as possible, NFER has put in place the technical and organisational measures set out in this privacy notice. |
Archiving, research and statistics (with a basis in law): processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) (as supplemented by section 19 of the 2018 Act) based on domestic law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
The research should not cause damage or distress to the data subjects. Its outcomes will drive decision making across the education sector and will not result in the creation of measures or decisions being made about any particular learner.
Legal basis where establishments are the data controller
Where Establishments use the NOA Reporting Tool to collate Learner and assessment data for the purpose of analysing test results and viewing reports they are the data controller and are responsible for data uploaded to the service and for the identification of a legal basis.
Depending on the categories of personal data uploaded they will need to identify the legal basis for the processing of both general and special category personal data.
This legal basis and any conditions of processing special category personal data will be covered in the privacy information they provide.
3. What personal data is being collected?
- Account creation
- To create Admin or Teacher User accounts: the name (forename and surname), role, and email address of members of staff are used. We refer to this as “user data.”
- Establishment use of the NFER Establishment Portal
- Learner name, date of birth, class, and gender are required fields in NOA. Additional learner data can be helpful for reporting purposes. Establishments can choose how much additional Learner data (for example, unique pupil numbers (UPN) free-school meal status, any special education provision and ethnicity) they upload. We refer to this as “Learner data.”
- NFER research
- NFER will take, at least, an annual extract of learner and operational data from the NFER Establishment Portal to allow it to undertake its own research and assessment improvement activities. It will extract all Learner data uploaded by the establishments.
Additional information (background characteristics, for example) may be requested from the National Pupil Database or other administrative datasets and matched against the learner data uploaded by the establishment.
4. How will personal data be obtained?
NFER collects the name and contact details of the ‘delivery contact’ for the establishment/MAT Head Office selected by the Establishment when purchasing a NOA product. This named contact is then setup with an Admin User account for the Establishment Portal where they can add/edit/delete either/both Admin User and Teacher User accounts. We refer to this data as “User data.”
Learner data is uploaded by establishments (we refer to this as “Learner data”).
5. Who will personal data be shared with?
- To carry out its own research, in most cases, Learner data will be matched to the National Pupil Data base. Once the research activity for this matching is complete, nothing is held by DfE or the Office of National Statistics for their future use.
- NFER may also want to match Learner data to other administrative datasets (such as the School Workforce Census and the Longitudinal Education Outcomes both controlled by the DfE) in the education and labour market to support NFER’s work in answering important policy and practice questions.
- Learnosity acts as the software host for all assessments. However, identifiable learner data will not be shared with Learnosity. They are provided with pseudonymised data for each learner.
- Establishment contact data will be shared with Freshdesk the software used to host the Helpdesk customer support platform.
- User data may also be shared and stored on ‘Spirit,’ NFER’s Customer Relationship Management software, provided by The Education Company Ltd.
- NFER will host the data on servers within the UK which are currently operated by NFER’s service provider, Microsoft Azure).
- For marketing activities, B&B Press may be used and will be provided with establishment and contact details.
6. Is personal data being transferred outside of the UK or European Economic Areas (EEA)?
No personal data is stored or transferred to any organisation outside of the UK.
7. How long will personal data be retained?
Establishments can delete some or all the personal data stored in the Establishment Portal whenever they wish to do so, provided they have Admin User access.
NFER will retain personal data for the following durations:
- After 24 months of an Establishment being inactive
- Establishments will be prompted to review any data they have uploaded to NOA. If, at that point, the establishment no longer intends to use the system and informs NFER, the data stored in the NOA will be deleted by NFER 45 days after NFER is informed. Establishments who do not activate their account following this prompt will have their data deleted 90 days after the date the prompt is sent.
- Research and assessment improvement
- Any data that NFER has extracted for its research and assessment improvement purposes will be kept for 25 years to allow us to look at how outcomes during primary education compare with outcomes in later life. Any Learner data which is linked with NPD or other administrative database for matching purposes is not retained by the DfE or ONS once the matching and analysis is complete.
- Year 6 data
- This will be removed from NOA, extracted, and securely archived for research purposes when those learners reach the end of Year 13.
8. What are the rights with respect to personal data?
Data protection legislation gives certain rights to data subjects, under certain circumstances they have the right:
- To request access to information that is held about them (a data subject access request).
- To have personal data rectified if it is inaccurate or incomplete.
- To request the deletion or removal of personal data where there is no compelling reason for its continued processing.
- To restrict processing of personal data (for example, permitting its storage but no further processing).
- To object to processing.
- To data portability.
- Not to be subject to decisions based purely on automated processing where it produces a legal or similarly significant effect.
The NOA Establishment Portal is designed to allow for the exercise of these rights. To exercise any of these rights, data subjects should contact their establishment.
The NOA Helpdesk is available:
- If Establishments require support to handle rights requests.
- For the establishment or data subject to contact to exercise any of these rights on data extracted from the Establishment Portal by NFER for research purposes.
You can exercise these rights at any time. Should you withdraw your data, NFER will ensure that your personal data is not used for future research but may be unable to remove it from completed and in progress research projects.
9. Are any decisions taken about me based on the automated processing of my data?
Where an establishment uses the NOA Reporting Tool to analyse and view assessment results, they remain responsible for data uploaded to the service, that is, the Establishment remains the Controller. If the Establishment uses the tool to make automated decisions, it remains responsible for informing learners and parents of this, and any impact on any individuals.
When NFER uses Learner data for research, no decisions are made about any individual, based on automated processing of that individual’s personal data. NFER’s research informs policy across the education sector.
10. Who can I contact about this Privacy Notice?
For general queries about NFER products please contact the NOA Helpdesk
If you have concerns about the way NFER processes personal data, please raise your concern with NFER by contacting the Compliance Officer: compliance@nfer.ac.uk.
If you remain dissatisfied, you can contact the Information Commissioner’s Office, the body responsible for enforcing data protection legislation in the UK, at https://ico.org.uk/concerns/
If you are in the European Union, NFER’s EU data representative is Rickert Rechtsanwaltsgesellschaft mbH. You can contact them to raise queries about the use of your personal data:
Rickert Rechtsanwaltsgesellschaft mbH
National Foundation for Educational Research in England and Wales (NFER)
Colmantstraße
15 53115 Bonn
Germany
11. Updates
We may need to update this privacy notice periodically, so we recommend that you revisit this information from time to time. This privacy notice was created in July 2024.
12. Appendix
Definition of Terms Used in This Document
- “Establishment Administrator” – a user with full access and permissions to the NOA Establishment Portal who can add, edit, and delete Admin/Establishment Teachers and Learners from within their Establishment. They can also allocate Learners to assessments, print passcodes, launch assessments, and view the NOA Reporting Tool.
- “Establishment” – this refers to either the School or MAT of which the NOA account will belong to.
- “KS2” – Key Stage 2
- “Learners” – this term refers to the Establishment’s pupils who will be undertaking (or currently are/have already undertaken) one or more NOA assessments.
- “NOA Demo Account” – A version of the NOA Establishment Portal (see below definition) where users can try out sample tests and the NOA Reporting Tool (see below definition).
- “NOA Establishment Portal” – the online platform where Admin and Establishment Teachers of NOA can administer all purchased NOA products, including adding new and amending existing users (in the case of Establishment Administrators), uploading class lists, launching assessments, and viewing assessment data and reports via the NOA Reporting Tool.
- “NOA Reporting Tool” – this refers to the assessment reporting function that sits within the NOA Establishment Portal and where Establishment Administrators/Teachers Users can view data and reports based on completed NOA assessments. Note, this is not to be confused with the “NFER Tests Analysis Tool” which is a separate platform used to record results and view assessment data and reports for NFER’s paper-based assessments.
- “Products and Services” refers to resources available for purchase, collectively Products and Services, available to establishments and/or MATS ordered via the NFER Resources Shop
- “Test” – an individual test being a component of an Assessment e.g., Maths Test 2 Reasoning.
- “Establishment Teacher” – a user with access to the NOA Establishment Portal who can allocate Learners to assessments, print passcodes, launch assessments, and view the NOA Reporting Tool. They will not be able to add/amend/delete Establishment Administrators or Teachers or Learners.
- “We”, “Us”, “Our”, “NFER” - refers to The National Foundation for Educational Research (NFER) in England and Wales. Head office and registered address: The Mere, Upton Park, Slough, Berkshire, SL1 2DQ. Registered charity number 313392. Registered number 900899 (England and Wales). A company limited by guarantee.
- “You” or “Your” - refers to the individual visiting our website or NFER Resources Shop to buy Products from us.
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article