Privacy Notice - For NFER Reporting Tool customers

Created on Wednesday 23 September

1 Why are we processing this data?

1.1 NFER as the data processor

1.2 NFER as the data controller

2 What is the legal basis for processing activities? 

2.1 Legal basis where establishments are the data controller

2.2 Legal basis where NFER is the data controller

3 What personal data is being collected?

4 How will personal data be obtained?

5 Who will personal data be shared with?

6 Is personal data being transferred outside of the UK?

7 How long will personal data be retained?

8 What are the rights with respect to personal data?

9 Are any decisions taken about me based on the automated processing of my data?

10 Who can I contact about this Privacy Notice?

11 Updates

12 Definitions

Public 2

1 Why are we processing this data? 

The NFER Reporting Tool allows Establishments that have purchased NFER Assessments –

NFER Tests (paper) and NFER Online Assessments – to use the Reporting Tool for the 

purpose of analysing assessment results and viewing reports. Where Establishments use 

NFER Online Assessments, the Tool is also used to administer the tests. 

Where Establishments use the NFER Reporting Tool for this purpose, they are the data 

controller and are responsible for all personal data. Establishments should ensure that they 

follow the requirements of data protection legislation (UK GDPR and the Data Protection Act 

2018) and provide appropriate privacy information to staff, Learners and their parents and 

guardians to explain its use. We are the data processer in such an arrangement. 

NFER may also use personal data for its own purposes – described under the NFER as the 

data controller heading below. 

1.1 NFER as the data processor

NFER acts as the data processor when we process the Establishment’s personal data for the 

following purposes:

• To create and administer Establishment Admin and Teacher User accounts. 

• To provide access to the NFER Reporting Tool:

o Any data uploaded to the NFER Reporting Tool is at the discretion of the 

Establishment. 

o The Establishment is responsible for the creation of any additional 

Admin/Teacher User accounts including provision of relevant user data (as 

defined below). The Establishment can also add, edit, and delete users’ 

accounts and Learners’ details provided this done via Admin User of the 

Reporting Tool. 

o The Establishment is responsible for adding Learner data (as defined below). 

Establishments must have the appropriate permissions in place before 

uploading any sensitive data to the Reporting Tool in accordance with data 

protection legislation.

• To administer NFER Online Assessments 

• To communicate updates to Establishments regarding the software and technical 

support and troubleshooting 

• In anticipation of continued use of this service by the Establishment, “user data” and 

“Learner data” will be stored securely to allow progress measures to be shown.

• If the Establishment no longer intends to use the NFER Reporting Tool and informs 

us, its account will be deleted by NFER 45 days after this point in time. Retention of 

data extracted from the Reporting Tool or research purposes is covered in section 7 

below.

Public 3

1.2 NFER as the data controller

When acting as the data controller, NFER may use user and learner personal data and 

operational data relating to learners collected in relation to the use of the NFER Reporting 

Tool for the following purposes:

• Managing NFER’s research and products 

o To inform the Establishment about related NFER research projects, products 

and services for sales and marketing purposes.

• Research and assessment improvement

o For NFER’s own research to inform education policy and practice for the 

public good. For example, analysis of Learner data to allow reporting of 

education standards and attainment year on year, attainment gaps across the 

country, and the impact of Government or local education policies. This 

supports NFER’s charitable aims, details of which are available on NFER’s 

website. Learner’s personal data will be used to allow matching to data held in 

the National Pupil Database1 (or other administrative datasets), where 

necessary for the relevant research. 

o On completion of a piece of research, NFER may deposit the dataset in the 

UK Data Archive (managed by UK Data Service) or for the Education 

Endowment Fund (EEF) Data Archive (managed by FFT Education). This 

supports NFER’s commitment to open science and methodological 

developments. 

o Any deposited Learner data would have been pseudonymised with names 

and unique Learner numbers replaced by another numeric identifier. 

Establishment identifiers would be included.

• For NFER’s own research to support the development and improvement of NFER’s 

research and assessment tools including the re-standardisation of assessments. 

• If the Establishment has agreed, NFER will also extract some historical data from the 

NFER Reporting Tool so NFER can undertake research looking at a wider data set, 

which looks at the learning loss associated with the Covid-19 pandemic, or to analyse 

the types of questions children commonly get wrong historically across all 

establishments to help inform teaching and the curriculum. 

• To inform the Establishment about published research based on data extracted from 

the NFER Reporting Tool.

1 The National Pupil Database (NPD) is a collection of data relating to education in England compiled by the Department for Education (DfE). The 

NPD is used by the Department for Education to inform policy and approved users can apply for extracts of it “for the purpose of promoting the 

education or wellbeing of children in England”. If an application is approved, pupil data extracted from the tool is shared with the NPD team and 

matched to the requested datasets. The NPD team then send the matched set to the Office for National Statistics (ONS) (Trusted Research 

Environment) where NFER’s approved researchers perform their analysis. Prior to exporting the outputs of this analysis, it is checked to ensure 

that no individual pupil can be identified in the output. Neither the DfE’s NPD team nor ONS hold any pupil data uploaded by NFER for future use. 

Further information about this process is available here.

Public 4

2 What is the legal basis for processing activities?

2.1 Legal basis where establishments are the data controller

Where Establishments use the NFER Reporting Tool to collate Learner and assessment data 

for the purpose of analysing test results and viewing reports, and/or administering NFER 

Online Assessments, they are the data controller and are responsible for data uploaded to 

the service and for the identification of a legal basis. 

Depending on the categories of personal data uploaded they will need to identify the legal 

basis for the processing of both general and special category personal data. 

This legal basis and any conditions of processing special category personal data will be 

covered in the privacy information they provide.

2.2 Legal basis where NFER is the data controller

NFER relies on the following legal basis for the different activities it undertakes when 

processing personal data.

To fulfil orders for NFER Tests and NFER 

Online assessments placed by 

establishments we process user data 

(defined below) and provide access to the 

services purchased

UK GDPR Article 6 (1) (b) Performance of a 

contract

To inform the establishment about related 

NFER research projects and their outputs 

and other NFER products and services for 

which we process user data

UK GDPR Article 6 (1) (f) – legitimate 

interest NFER has carried out a legitimate 

interest assessment; sharing information 

about related research fulfils one of NFER’s 

core business purposes (developing 

research products and services to improve 

learning outcomes). 

Sharing research outputs has wider societal 

benefits as it contributes to improving 

teaching practice. Personal data is required 

to share the research outputs, but 

processing does not override the data 

subject’s interests. To mitigate the risks to 

the rights and freedoms of the individual 

data subjects, as far as possible, NFER has 

put in place the technical and organisational 

measures set out in this privacy notice.

Public 5

To carry out its own research which informs 

policy and practice for the public good 

including research on historical data which 

looks at the learning loss associated with 

the Covid-19 pandemic, or to analyse the 

types of questions children commonly get 

wrong historically across all establishments 

to help inform teaching and the 

development of the curriculum for which we 

process learner data (defined below)

UK GDPR Article 6 (1) (f) legitimate interest

NFER has carried out a legitimate interest 

assessment. The research fulfils one of 

NFER’s core business purposes 

(undertaking research, evaluation, and 

information activities). It has broader 

societal benefits as the output of the 

research will contribute to a strong evidence 

base and help to improve the lives of 

learners. The research cannot be done 

without processing personal data, but 

processing does not override the data 

subject’s interests. To mitigate the risks to 

the rights and freedoms of the individual 

data subjects, as far as possible, NFER has 

put in place the technical and organisational 

measures set out in the Terms & 

Conditions.

To support development and improvement 

of NFER’s assessments and research tools 

for which we process learner data and user 

data

UK GDPR Article 6 (1) (f) legitimate interest

NFER has carried out a legitimate interest 

assessment. The research fulfils one of 

NFER’s core business purposes 

(developing, trialling, and delivering 

assessments). It has broader societal 

benefits as it will help maintain the accuracy 

and rigor of NFER tests. The research 

cannot be done without processing personal 

data, but processing does not override the 

data subject’s interests. To mitigate the 

risks to the rights and freedoms of the 

individual data subjects as far as possible, 

NFER has put in place the technical and 

organisational measures set out in this 

privacy notice.

If NFER’s research includes processing of special category personal data, NFER relies on 

GDPR Article 9 (2) (j) which states:

Archiving, research and statistics (with a basis in law): processing is necessary for 

archiving purposes in the public interest, scientific or historical research purposes or 

statistical purposes in accordance with Article 89(1) (as supplemented by section 19 

of the 2018 Act) based on domestic law which shall be proportionate to the aim 

pursued, respect the essence of the right to data protection and provide for suitable 

Public 6

and specific measures to safeguard the fundamental rights and the interests of the 

data subject.

The research should not cause damage or distress to the data subjects. Its outcomes will 

drive decision making across the education sector and will not result in the creation of 

measures or decisions being made about any particular learner.

3 What personal data is being collected?

Account creation 

To create Admin or Teacher User accounts: the name (forename and surname), role, and 

email address of members of staff are used. We refer to this as “user data". 

Establishment use of the NFER Reporting Tool 

Learner name, date of birth, class, and sex are required fields in the NFER Reporting Tool. 

Additional learner data can be helpful for reporting purposes. Establishments can choose 

how much additional Learner data (for example, unique pupil numbers (UPN) free-school 

meal status, any special education provision and ethnicity) they upload. We refer to this as 

“Learner data.”

NFER research

NFER will take, at least, an annual extract of learner and operational data from the NFER 

Reporting Tool to allow it to undertake its own research and assessment improvement 

activities. It will extract all Learner data uploaded by the establishments. 

Additional information (background characteristics, for example) may be requested from the 

National Pupil Database or other administrative datasets and matched against the learner 

data uploaded by the establishment.

4 How will personal data be obtained?

NFER collects the name and contact details of the ‘delivery contact’ for the 

establishment/MAT Head Office selected by the Establishment when purchasing a NFER 

Assessments product. This named contact is then setup with an Admin User account for the 

NFER Reporting Tool where they can add/edit/delete either/both Admin User and Teacher 

User accounts. We refer to this data as “User data.” 

Learner data is uploaded by establishments (we refer to this as “Learner data”).

5 Who will personal data be shared with?

Establishments are expected to cover the sharing of any data from NFER’s Reporting Tools 

in the privacy materials they provide for Learners. 

Public 7

If your school is part of a Multi-Academy Trust (MAT), your MAT may be given access to 

pupil-level data. 

When NFER uses Learner Data to carry out its own research, in most cases, it will be 

matched to the National Pupil Database. Once the research activity for this matching is 

complete, nothing is held by DfE or the Office of National Statistics for their future use. 

NFER may also want to match Learner data to other administrative datasets (such as the 

School Workforce Census and the Longitudinal Education Outcomes both controlled by the 

DfE) in the education and labour market to support NFER’s work in answering important 

policy and practice questions. 

The following processors are used to support the delivery of NFER Assessments: 

• Learnosity acts as the software host for all online assessments. They are provided 

with pseudonymised data for each learner. 

• Freshdesk provides our customer helpdesk. They are provided with contact data for 

each Establishment. 

• Spirit, provided by the Education Company Ltd will be used to hold and manage 

personal data for customer relationship management 

• Dotdigial provide NFER’s email marketing platform. User data will be shared with 

Dotdigital to send marketing emails. 

• Microsoft Azure is used to host the reporting tool on servers within the UK, managed 

by NFER’s hosting partner Dudobi. 

• B&B Press supply paper tests, and may be used for marketing activities. They will be 

provided with establishment and contact details.

6 Is personal data being transferred outside of the UK?

No personal data is stored or transferred to any organisation outside of the UK.

7 How long will personal data be retained?

Establishments can delete some or all the personal data stored in the NFER Reporting Tool 

whenever they wish to do so, provided they have Admin User access.

NFER will retain personal data for the following durations:

• After 24 months of an Establishment being inactive 

o Establishments will be prompted to review any data they have uploaded to the 

NFER Reporting Tool. If, at that point, the establishment no longer intends to 

use the system and informs NFER, the data stored in the Reporting Tool will 

be deleted by NFER 45 days after NFER is informed. Establishments who do 

not activate their account following this prompt will have their data deleted 90 

days after the date the prompt is sent.

Public 8

• Research and assessment improvement 

o Any data that NFER has extracted for its research and assessment 

improvement purposes will be kept for 25 years to allow us to look at how 

outcomes during primary education compare with outcomes in later life. Any 

Learner data which is linked with NPD or other administrative database for 

matching purposes is not retained by the DfE or ONS once the matching and 

analysis is complete.

• Year 6 data

o This will be removed from NFER Reporting Tool, extracted, and securely 

archived for research purposes when those learners reach the end of Year 13.

8 What are the rights with respect to personal data?

Data protection legislation gives certain rights to data subjects, under certain circumstances 

they have the right:

• To request access to information that is held about them (a data subject access 

request). 

• To have personal data rectified if it is inaccurate or incomplete. 

• To request the deletion or removal of personal data where there is no compelling 

reason for its continued processing. 

• To restrict processing of personal data (for example, permitting its storage but no 

further processing). 

• To object to processing. 

• To data portability. 

• Not to be subject to decisions based purely on automated processing where it 

produces a legal or similarly significant effect.

The NFER Reporting Tool is designed to allow for the exercise of these rights. To exercise 

any of these rights, data subjects should contact their establishment. Establishments may act 

on such requests themselves. The Helpdesk is available if Establishments require support to 

handle rights requests. 

For the establishment or data subject to contact to exercise any of these rights on data 

extracted from the Reporting Tool by NFER for research purposes, please contact NFER’s 

Helpdesk in the first place. 

You can exercise these rights at any time. Should you withdraw your data, NFER will ensure 

that your personal data is not used for future research but may be unable to remove it from 

completed and in progress research projects. 

Public 9

9 Are any decisions taken about me based on the 

automated processing of my data?

Where an establishment uses the NFER Reporting Tool to analyse and view assessment 

results, they remain responsible for data uploaded to the service, that is, the Establishment 

remains the Controller. If the Establishment uses the tool to make automated decisions, it 

remains responsible for informing learners and parents of this, and any impact on any 

individuals. 

When NFER uses Learner data for research, no decisions are made about any 

individual, based on automated processing of that individual’s personal data. NFER’s 

research informs policy across the education sector. 

10 Who can I contact about this Privacy Notice?

For general queries about NFER products please contact the Helpdesk. 

If you have concerns about the way NFER processes personal data, please raise your 

concern with NFER by contacting the Compliance Officer: compliance@nfer.ac.uk or you can 

make a complaint as outlined in our Complaints Policy.

If you remain dissatisfied, you can contact the Information Commissioner’s Office, the body 

responsible for enforcing data protection legislation in the UK, at https://ico.org.uk/concerns/

If you are in the European Union, NFER’s EU data representative is Rickert 

Rechtsanwaltsgesellschaft mbH. You can contact them to raise queries about the use of your 

personal data:

Rickert Rechtsanwaltsgesellschaft mbH 

National Foundation for Educational Research in England and Wales (NFER) 

Colmantstraße 

15 53115 Bonn 

Germany 

art-27-rep-nfer@rickert.law

11 Updates

We may need to update this privacy notice periodically, so we recommend that you revisit 

this information from time to time. This privacy notice was created in September 2026.

Public 10

12 Appendix

Definition of Terms Used in This Document 

“Establishment Administrator” – a user with full access and permissions to the NFER 

Reporting Tool who can add, edit, and delete Admin/Establishment Teachers and Learners 

from within their Establishment. They can also allocate Learners to online assessments, print 

passcodes, launch assessments, and view the reports. 

“Establishment” – this refers to either the School or MAT of which the NOA account will 

belong to. 

“KS2” – Key Stage 2 

“Learners” – this term refers to the Establishment’s pupils who will be undertaking (or 

currently are/have already undertaken) one or more NFER Assessment. 

“NFER Reporting Tool" – the online platform where Admin and Establishment Teachers can 

upload assessment data and view reports for NFER Tests (paper). They can also administer 

all purchased NFER Online Assessments products, including adding new and amending 

existing users (in the case of Establishment Administrators), uploading class lists, launching 

assessments, and viewing assessment data and reports. 

“Products and Services” refers to resources available for purchase, collectively Products and 

Services, available to establishments and/or MATS ordered via the NFER Resources Shop 

“Test” – an individual test being a component of an Assessment e.g., Maths Test 2 

Reasoning. 

“Establishment Teacher” – a user with access to the NFER Reporting Tool who can allocate 

Learners to assessments, print passcodes, launch assessments, and view the reports. They 

will not be able to add/amend/delete Establishment Administrators or Teachers or Learners. 

“We”, “Us”, “Our”, “NFER” - refers to The National Foundation for Educational Research 

(NFER) in England and Wales. Head office and registered address: The Mere, Upton Park, 

Slough, Berkshire, SL1 2DQ. Registered charity number 313392. Registered number 900899 

(England and Wales). A company limited by guarantee. 

“You” or “Your” - refers to the individual visiting our website or NFER Resources Shop to buy 

Products from us