Please find a shorter version suitable for young people here. Please find a version for learners (aged 16+), parents, staff at education settings and employers below.
Introduction
Ofsted has commissioned the Behavioural Insights Team (BIT) to undertake a research project on ways to improve Ofsted’s engagement with key stakeholders, including children, learners, parents, carers, and provider staff. We are trying to learn how to give these groups better opportunities to make their voices heard during inspection.
This privacy notice sets out how we, Behavioural Insights Ltd (the legal name of the Behavioural Insights Team (BIT)), as a data controller, will collect and use the personal data of the people who participate in the research (you and / or your child).
Contact details
Behavioural Insights Ltd (the legal name of Behavioural Insights Team) is the controller and is responsible for your personal data collected in connection with this project. This notice applies to the personal data we collect directly from you and personal data which is provided to us by third parties. Where we collect personal data from you directly, please make sure that any personal details you provide are accurate and up to date, and let us know about any changes as soon as possible.
We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights in relation to your and /or your child’s personal data, please contact the DPO:
Post: Behavioural Insights Ltd, 58 Victoria Embankment, London, EC4Y 0DS
Email: [email protected].
You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.
What personal data will we collect and what will we do with the information we collect?
BIT is collecting and processing your personal data to understand how Ofsted can improve engagement with key stakeholders and give these groups better opportunities to make their voices heard during inspection.
The processing of SEND information (which could be health data and therefore special category data) is necessary to establish how Ofsted can improve engagement for individuals with a range of characteristics.
In addition to what you and / or your child say in the interview / focus group, we will also collect the following information about participants:
Learners aged <16: children and young people
As part of collecting your consent and their assent
- First Name
- Last Name
To help us make sure we speak to a range of different people:
- Age and year group
- Gender
- Provider name (e.g. school name)
- English as an Additional Language (EAL) status
- Free School Meal eligibility where available (postcode where not available)
- Additional needs (e.g. SEND) and any adjustments they may want / need
Age, additional needs and requested adjustments will be used to adapt the interview / focus group to meet the participant’s needs.
Parents and carers:
For arranging the interview / focus group with you and / or your child:
- Phone number(s)
- Email address(es)
As part of collecting your consent:
- First name
- Last name
To help us make sure we speak to a range of different people, if you are participating yourself we will collect:
- Age
- Gender
- English as an Additional Language (EAL) status
- Postcode
- Child’s provider name (e.g. school name)
- Child(ren)’s age(s) and year group(s)
- Child(ren)’s free school meal eligibility (or postcode, if this is not available)
- Child(ren)’s English as an Additional Language (EAL) status
- Child(ren)’s additional needs (e.g. SEND)
- Your additional needs (e.g. SEND) and any adjustments you may want / need
Your additional needs and requested adjustments will be used to adapt the interview / focus group to meet your needs.
Learners aged 16+
For arranging the interview / focus group with you
- Phone number(s)
- Email address(es)
As part of collecting your consent:
- First name
- Last name
To help us make sure we speak to a range of different people:
- Age and year group
- Gender
- Provider name (e.g. school or college name)
- Free School Meal eligibility (or postcode, if this is not available)
- English as an Additional Language (EAL) status
- Additional needs (e.g. SEND) and any adjustments you may want / need
Your additional needs, requested adjustments and age will be also used to adapt the interview / focus group to meet your needs.
Staff at education settings and employers:
For arranging the interview / focus group with you:
- Phone number(s)
- Email address(es)
As part of collecting your consent:
- First Name
- Last Name
To help us make sure we speak to a range of different people:
- Age
- Gender
- Role
- Years experience
- Employer name
- Additional needs (e.g. SEND) and any adjustments you may want / need
If your child is participating, and if our initial contact with you was via your child’s school / provider, some of the personal information about your child will be collected from their school / provider: the information listed above in the applicable learners section.
What is our lawful basis for processing your personal data?
Data protection laws require us to meet certain conditions before we are allowed to use your and / or your child’s personal data in the manner described in this notice, including having a lawful basis for the processing.
For all information collected:
Our lawful basis for processing your personal data is consent (as per Article 6 (1) (a) of the GDPR).
For special category data:
You have provided your explicit consent to the processing of special category personal data for the purposes set out in this privacy notice.
Who has access to your information?
Your and / or your child’s information will be accessed by a limited number of researchers in BIT’s project team working on this project.
Under limited circumstances, BIT may disclose your and / or your child’s information to third parties in connection with the purposes of processing your and / or your child’s personal data set out in this notice. These third parties may include:
- regulators, law enforcement bodies and the courts, in order to comply with applicable laws and regulations, assist with regulatory enquiries, and cooperate with court mandated processes, including the conduct of litigation; and
- suppliers, research assistants and sub-contractors who may process information on behalf of BIT [e.g. cloud services to store data, SMS providers to send text messages]. These third parties are known as data processors and when we use them we have contractual terms and policies and procedures in place to ensure that your personal data is protected. This does not always mean that they will have access to information that will directly identify you as we will share anonymised or pseudonymised data only wherever possible. We remain responsible for your personal information as the controller;
We may also disclose your and / or your child’s personal information if required by law, or to protect or defend ourselves or others against illegal or harmful activities.
International Transfers
Your and / or your child’s personal information will not be transferred outside of the European Economic Area (“EEA”). References in this notice to the EEA include the UK, even where the UK is no longer a member of the European Union / European Economic Area.
Security
We take reasonable steps to protect your and / or your child’s personal information and follow procedures designed to minimise unauthorised access, alteration, loss or disclosure of your and / or your child’s information.
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing.
We ensure that those who have permanent or regular access to personal data, or that are involved in the processing of personal data, are trained and informed of their rights and responsibilities when processing personal data. We provide such access on a need-to-know basis, and have measures in place which are designed to remove that access once it is no longer required.
Physical personal devices used by BIT are encrypted to protect your data.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
Data Retention
We will only retain your and / or your child’s personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. When it is no longer necessary to retain your personal data, it will be securely deleted.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
We will delete all of your / your child’s personal data within a month of the end of the project. The anticipated date for the end of the project is 3rd September 2025.
Your legal rights
Under certain circumstances, you have rights under data protection laws in relation to your and / or your child’s personal data, including rights to:
- Request access to your and / or your child’s personal data: this enables you to receive a copy of the personal data we hold about you and / or your child to check we are lawfully processing it.
- Request correction of your and / or your child’s personal data: this enables you to have any incomplete or inaccurate data we hold about you or your child corrected.
- Request erasure of your and / or your child’s personal data: this enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it.
- Object to processing of your and / or your child’s personal data: for example, you can object where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms.
- Request restriction of processing your and / or your child’s personal data: This enables you to ask us to suspend the processing of your and / or your child’s personal data.
- Data portability: Where the processing takes place on the basis of your consent or contract, and is carried out by automated means, you have the right to request that we provide your and / or your child’s personal data to you in a machine-readable format, or transmit it to a third party data controller, where technically feasible.
- Right to withdraw consent to the processing of your and / or your child’s personal data: This applies where we have relied on consent to process personal data. Please note that withdrawal of consent will not affect the lawfulness of any processing carried out before withdrawing your consent.
- If you would like to withdraw consent after the interview / focus groups, please contact our Data Protection Officer on [email protected], giving your name and saying you would like to withdraw consent for data processing on the Ofsted project. If you do this, BIT will delete information that can be linked to you / your child. Please note that anonymised data (e.g. quotations) from the interview / focus group may still appear in reports if you withdraw consent at a stage when we can no longer identify what data has been collected from/about you / your child.
- Right not to be subject to decisions based purely on automated processing where it produces a legal or similarly significant effect on you. Please note that BIT does not engage in automated decision making without manual intervention in its research projects.
If you wish to exercise any of the rights set out above, please contact the Data Protection Officer with your specific request by email to: [email protected].
It is important to understand that the extent to which these rights apply to research will vary and that in some circumstances your rights may be restricted.
Ordinarily, you will not have to pay a fee to access your and / or your child’s personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your and / or your child’s personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
Please also note that we can only comply with a request to exercise your rights during the period for which we hold personal information that directly identifies you or your child. If we have only collected pseudonymised information (e.g. where we have not collected any names or contact details) or personal data has been irreversibly anonymised and has become part of the research data set, it will not be possible for us to comply.
Changes to this Notice
We may change this Privacy Notice from time to time. If we make any significant changes in the way we treat your and / or your child’s personal information we will make this clear by outlining (in this document) what these changes are, and at what date these changes were made. We will also provide you with a link to this updated privacy notice by contacting you directly.