Guidance

Whistleblowing privacy notice

Published 6 March 2025

Applies to England

Why we need your information and how we use it and how we use it

It’s our job to tell you how we will collect and use your information, why we need it and what your rights are. We do this to comply with the data protection legislation and to protect your privacy. Here is an explanation of the key terms that we use throughout this document:

• Personal data: any information that can be used to identify a living individual, such as your name, address and date of birth
• Anonymised data: information which cannot identify a living individual
• Data Processor: third parties that work on behalf of Ofqual to provide elements of services for us and any other organisation that will process personal data on behalf of Ofqual

Ofqual’s whistleblowing policy enables you to raise concerns about your employer’s role in delivering a qualification that is regulated by Ofqual. This might be a concern about wrongdoing or risk relating to exams, key stage tests (SATs), assessment of regulated qualifications or the activities of awarding organisations we regulate.

You may contact us anonymously to make a whistleblowing complaint if you prefer. Where you provide your personal data, Ofqual collects and holds personal information about you in order to investigate your concerns. We will hold the information you provide to us confidentially and securely and use it to help us to handle and process your whistleblowing disclosure.

Ofqual will process your personal data in order to carry out our statutory functions. In relation to whistleblowing, this will specifically enable Ofqual to:

• consider and investigate concerns relating to the development, delivery or award of regulated qualifications
• carry out investigations of regulated awarding organisations and regulated qualifications, for the purposes of considering their compliance with Ofqual’s regulatory requirements
• take regulatory action against an awarding organisation (for example we might direct an awarding organisation to take certain actions)

The lawful basis we rely on to process your personal data is article 6(1)(e) of the UK GDPR which allows us to process personal data when this is necessary to perform our public tasks as a regulator.

If the information you provide us in relation to your report contains special category data, such as health, religious or ethnic information the lawful basis we rely on to process article 9(2)(g) of the UK GDPR, which also relates to our public task, and Schedule 1 paragraph 2(6) of the Data Protection Act 2018 which relates to statutory and government purposes.

What personal data we collect and who has access to it

We will ask for your name and an email address (as we will email you a copy of the form you have completed for your records). We will also ask you for your organisation’s name and your telephone number, although these are not mandatory.

If you are worried about being identified as a whistleblower, you can make a disclosure to Ofqual anonymously. We treat anonymous disclosures just as seriously as those made openly. However, if you do make a disclosure anonymously, we may not be able to investigate your concerns as effectively.

We will also ask for further information so that we can investigate your concerns, such as the qualifications affected, awarding organisations and/or schools, colleges or centres involved, number of candidates affected and your report of the incident, along with any supporting documents or evidence.

We recognise that the personal information in a whistleblowing report can relate to the whistleblower, the accused, witnesses or others that are mentioned. We rely on Article 6(1)(e) of the UK GDPR as our lawful basis to process this personal data and Article 9(2)(g) of the UK GDPR and Schedule 1 paragraph 2(6) of the Data Protection Act 2018 to process special category data.

For more information about how Ofqual processes personal data, please refer to our personal data protection policy.

To ensure Ofqual deals with your allegation equally and fairly, all disclosures, including those sent to other departments in Ofqual, including the Chief Regulator or board members, will be forwarded to the complaints investigation team for action.

Your information will be shared internally with Ofqual staff in relevant departments in order that we can handle, investigate and respond to your disclosure. Internal access to information processed as part of the investigation is granted to limited individuals who need to have access to the information. Our aim at all times is to ensure as far as possible the confidentiality of the information received and to protect the whistleblower’s identity and all other persons involved.

In certain situations, we might need to share the information you send to us with third parties, such as awarding organisations, in order to gather information about your disclosure. Where we do so, we will ensure that any request for confidentiality and anonymity is respected wherever possible. We will look into whistleblowing disclosures given anonymously and pass these on to the relevant awarding organisations where appropriate. However, please be aware that it may not always be possible to investigate anonymous disclosures fully.

We may also share your information with other organisations, such as government departments, enforcement agencies and the police if we think it is necessary to do so. There may also be certain circumstances where we are required, by law, to share your information.

We use a platform called GOV.UK Forms. This is provided by the Government Digital Service (GDS), which is part of the Cabinet Office. The GOV.UK Forms platform lets UK government teams create online forms to collect information from people and organisations. GDS is a data processor. Where Ofqual uses data processors we have agreements in place. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will hold it securely and retain it for the period we instruct.

For more details of how GOV.UK Forms processes your personal information including sharing information with Ofqual, please see Privacy notice: how we use your data – GOV.UK Forms.

Ofqual publishes an annual summary of activity in relation to whistleblowing. However, this will not include any individual’s details or personally identifiable information.

Where your personal data is stored and how long we keep it

Your personal data will be stored securely in Ofqual’s case management, document management and email systems. Access to this information is strictly controlled and reviewed.

Ofqual will hold details of your whistleblowing disclosure, including your personal data, for 5 years.

How Ofqual protects your personal data

Ofqual takes the security of your personal data seriously. Ofqual has internal policies and controls in place to protect your data from loss, accidental destruction, misuse or disclosure. Some of the ways in which Ofqual protects your personal data include:

• implementing appropriate technical and organisational measures to protect the confidentiality, integrity and availability of personal data and information
• regular review of Ofqual information assurance and security policies and procedures
• ongoing training and awareness for staff on information assurance and security
• alignment with codes of conduct, certification schemes and government guidance, including the HMG Security Policy Framework, government baseline security standards, and the National Cyber Security Centre (NCSC)
• use of the government Supplier Assurance Framework and Crown Commercial Services frameworks when working with suppliers and third parties
• regular review of security and cyber risks

Your rights

Ofqual is committed to being transparent about how it collects and uses your personal data and to meeting its data protection obligations. Ofqual is a Data Controller under data protection legislation and we comply with the data protection principles when processing your personal information.

Under data protection legislation, you have a number of rights. You can:

• access and obtain a copy of your personal data
• require Ofqual to rectify or change incorrect or incomplete personal data
• require Ofqual to delete or erase your personal data
• request Ofqual restrict the processing of your personal data (in certain circumstances)
• request your personal data in a portable format
• object to the processing of your personal data

If you would like to exercise any of these rights, please contact Ofqual’s Data Protection Officer:

Data protection requests

Data protection officer, Ofqual
2nd floor, 1 Friargate
Station Square
Coventry
CV1 2GN

Email dp.requests@ofqual.gov.uk

Contact form https://ofqual.citizen...

For queries about personal data Ofqual holds about you.

The Information Commissioner’s Office

The Information Commissioner’s Office (ICO) is the UK’s independent body set up to uphold information rights. If you would like to know more about your rights under data protection legislation, and what you should expect from us, please visit the ICO website.

If you believe that Ofqual has not complied with your data protection rights, please contact Ofqual’s Data Protection Officer in the first instance. You can also complain directly to the Information Commissioner:

Information Commissioner's Office

Email icocasework@ico.org.uk

Contact form https://ico.org.uk/glo...

Telephone 0303 123 1113

Textphone 01625 545 860