Guidance

Contacting or working with Ofsted: privacy notice

Updated 1 November 2024

Applies to England

Ofsted is the Office for Standards in Education, Children’s Services and Skills, a non-ministerial government department. We inspect and regulate services that care for children and young people, and inspect services providing education and skills for learners of all ages.

Ofsted was established by the Education and Inspections Act 2006. As a non-ministerial government department, we are required to process personal data for a wide range of purposes.

Ofsted is the data controller for the personal data described in this notice.

This privacy notice is about the personal data we get when you:

Contacting Ofsted about its work

Why we process this information

We collect, use, share or process the information we have about you for various reasons. These include:

• where necessary for providing the services you want to use and for us to fulfil any of our ‘terms of use’ (for example, we won’t be able to keep you updated about our work unless you have given us your email address)
• where necessary to use our legal powers or our authority to carry out tasks in the public interest – sometimes we need to use your personal data and what you tell us to help us decide what to inspect, which regulatory issues to check, or to carry out research and analysis
• other legal obligations such as complying with court orders or to help deal with legal disputes
• when you have specifically consented to us processing your information (for example, when you tick a box to receive email newsletters and can change your mind at any time)

• to protect the vital interests of you or others, such as in emergencies

• when you have made the information public
• when it is necessary in the public interest

For more information, please see Ofsted’s other privacy notices.

How we will use information about you

You may use a lot of different ways to contact us about our work. When you do so, we will usually collect basic identifying information such as your name and email or other address, so that we can look into the things you want to talk about and then reply to you.

If you contact us via our general enquiries email address, phone number, correspondence address or social media, we may pass on your query to be dealt with by our specialist teams.

Depending on the nature of your enquiry, we may link information that you provide us with something we already know about, such as a school or childcare provider.

Below are some of the ways you may contact us:

Phoning Ofsted

If you phone our contact centre on our advertised numbers, we record the conversation you have with your initial call adviser. We keep these recordings for 90 days and only for the purposes of training and monitoring the performance of our staff.

Our systems will also hold basic information about calls received, including the telephone number used, for one year.

Calls transferred from our contact centre to other staff within Ofsted are not recorded.

Often, the information you provide to our contact centre advisers over the phone will also be noted by them and the note of that conversation will then be passed to the appropriate team for handling your enquiry.

Emailing Ofsted

Any emails you send to us will either be replied to directly or passed on to relevant business areas in Ofsted to deal with your enquiry. How we use the information and the length of time we then hold it will depend on the subject of your enquiry. All emails will be held for at least 90 days.

We use a type of encryption called TLS to protect email traffic. If your email service does not support TLS, you should be aware that any emails we send or receive may not be protected when they move between our email accounts.

We will also monitor any emails sent to us, including file attachments, for viruses or malicious software. Please be aware that you are responsible for ensuring that any email you send to us does not infringe any law or regulation.

Visiting any of Ofsted’s websites

We use a service called Google Analytics to collect information about visits to our different websites. This helps us track information like the number of visitors to pages on our sites. Some of our websites may collect IP addresses. See each of our individual websites for specific information on what data they collect.

Some of our websites put small files (‘cookies’) onto your computer to collect information about how you browse the website. Cookies are used to measure how you use the website so it can be updated and improved based on your needs.

Contacting Ofsted to register as a provider of early years or social care

View our childcare privacy notice or our social care privacy notice for more information if you want to register to provide an early years or social care service.

Subscribing to receive information from Ofsted

Some people subscribe to be kept updated about our work. In order to do this, we ask you to provide an email address.

We only hold this information for as long as you want to receive updates from us. You can ‘unsubscribe’ at any time.

We only use this information to keep you informed about our services or to seek your feedback on how well we are doing.

Completing surveys or answering consultations

We invite people to complete surveys or consultations about their opinions and experiences. We do this to help us improve our own services, to carry out research or to find out about the services provided by those we inspect or regulate.

Each survey or consultation will explain to you how your information will be used.

Making a complaint about Ofsted

You can submit complaints about Ofsted (CAO) using an online form. Complainants sometimes write directly to us or correspondence may be passed to our CAO team from elsewhere in Ofsted.

When we receive a complaint from someone, we create a file to contain the details of the complaint. This normally includes the identity of the complainant and any other individuals involved in the complaint. This information will be kept securely and access to it will be restricted to only those who may need to know the information.

We will use the personal information that we collect to process the complaint and to check on the quality of service we provide. We do gather and sometimes publish statistics showing information like the number of complaints we receive, but not in a way that identifies anyone.

Information received by the CAO team, including the identity of the complainant, will be shared internally with:

• people whose actions you are complaining about and their managers
• those involved in the investigation/handling of the complaints
• other teams in Ofsted (such as legal advisors or staff processing requests for information) who need it to do their jobs

Complaints information provided to us can also be shared with the Independent Complaints Adjudication Service for Ofsted (ICASO) and/or the Parliamentary and Health Service Ombudsman (PHSO) if the complainant decides to escalate the complaint to these bodies.

All complaints information is held for a period of 12 months after a case has finished and then it will normally be destroyed. Complaints information will be held for longer when complainants decide to continue their complaint. In these circumstances, our staff will review the information that is kept, depending on the circumstances of each case.

Writing to us by post

If you write to us by post, it is likely that the letter will be opened, scanned into an electronic file and logged against your name. This is to help teams responsible for answering your query share your letter within Ofsted and reply to you.

Requesting information from us

If you request information from Ofsted, for example under the Freedom of Information Act, we will keep a record of your identity and contact details. We will create a file to contain the details of your request and the resulting correspondence. This normally includes the identity of the requester and other individuals associated with the requested information. This information will be kept securely and access to it will be restricted to only those who may need to know the information.

If you ask for your own information under data protection legislation, we will also ask for confirmation of your identity, such as a copy of a passport or driving licence. This is to help us ensure that we only provide personal data to the person it is about.

We will use the personal information we collect to process each request and to check on the quality of service we provide. We do gather and sometimes publish statistics showing information like the number of requests we receive, but not in a way that identifies anyone. We may need to share your correspondence with the Information Commissioner or Information Tribunal, which regulate both the Freedom of Information Act and data protection laws.

Using social media

Ofsted uses social media accounts. The personal data you post to those accounts will be managed in line with the terms and conditions established by the provider of those social media services. On some occasions, we will pass the information or questions we receive via social media to relevant internal teams to deal with your enquiry.

Types of personal data that we might hold

When you get in contact with us, we will hold the personal data that you provide. This will normally include any contact details you give to us so that we can reply to you.

We may also collect limited information about you when you visit our websites.

Who we might share personal data with

When you contact us, we will only pass your information to our staff who can answer your questions or deal with your concerns. This will depend on what you are contacting us about. The law allows us to use information obtained in one area of our work to be used in connection to other areas of our work.

Our other privacy notices explain in more detail when specific types of information are shared to help our inspection and regulation work.

We may also share your information with other public authorities, if we need to do this to keep people safe or to check that they are running any provision properly. We also have duties to keep the Secretary of State for Education informed about the things we do and this may include the information you provide to us about yourself or other people or information we use in our research and analysis.

We share information with child protection agencies in line with our legal duties and other statutory guidance issued by the government.

We might use also third parties to process data on our behalf. Where possible, we use standard government contracts that reinforce your data protection rights. This might include:

• IT companies that support our website or other business systems
• operational companies, such as delivery couriers
• companies that help us manage our electronic communications with you

How long we keep personal data and how we decide this

Whenever we collect or process your personal data, we’ll only keep it for as long as is necessary for the purpose for which it was collected.

These periods of time will vary, depending on what you have to tell us or what we may need to do in response to your information. For example:

• recordings of calls made to our enquiries telephone number are held for 90 days
• Freedom of Information requests are held for at least 3 years
• complaints about Ofsted are held for 12 months, unless the complainant wants to appeal Ofsted’s decision

Our other privacy notices provide details of the length of time personal data might be held if it relates to, or is used for, our inspection or regulatory work.

Ofsted contractors

Why we process this information

We collect, use, share or process the information we have about you when we have contractual obligations – we sometimes need your personal data to help manage our contracts with you. For example, if you agree a contract to work with us, we will need your details to contact you and pay you.

How we will use information about you

We process personal data relating to those who are contracted to provide services to, or on behalf of, Ofsted. This is to make sure that all parties’ contractual obligations are kept.

The information Ofsted may collect about you includes:

• contact details to ensure that we can contact you or verify your identity when you undertake work on our behalf
• details of your bank account, where that is needed to pay you
• information you may provide when tendering to provide services to, or on behalf of, Ofsted
• information about the quality of the work you provide, including references about you from other people
• information necessary to show your suitability to work in certain roles, for example in the presence of children –this can include criminal records or medical information
• the terms and conditions of any contractual relationship you have with us
• where necessary, details of your availability to undertake work on our behalf
• details of where you live to help us plan inspections and/or training
• information about your use of our information and communications systems

We may share some of your details if you are visiting any external body on our behalf or when we are doing checks of your suitability to work in certain roles.

Ofsted may hold information about you for up to 6 years after our contractual relationship has ended.

Types of personal data we might hold

For individuals who provide services for Ofsted under contract, we collect information:

• about how they perform those services
• that helps us to pay them and keep in contact with them

How long we keep personal data and how we decide this

We hold information about contracted services for 6 years.

Recruitment

This section describes how we handle and protect your personal data in connection with Ofsted’s recruitment processes. It applies to the personal data of job applicants and potential candidates for employment. It does not apply to our employees, contractors or clients, or anyone else whose personal data we collect for other purposes.

Why we process this information

We process personal data when recruiting employees because it is a necessary part of Ofsted’s official authority, as set out in legislation. This means that we must process personal data to fulfil our requirements to recruit appropriate staff to undertake Ofsted’s work.

We process special categories of personal data such as data on ethnicity, health, philosophical beliefs and sexual orientation. There is a legal reason for this, where it is necessary for Ofsted to carry out its obligations or for job applicants to exercise their rights under employment law.

Types of personal data we might hold

We will get information that identifies job applicants and potential candidates for employment with us, submitted as part of an online application, from a CV and/or through alternative channels (such as email via professional recruiting firms).

We usually collect this personal data directly from you when you apply or register an interest for a role with us. Data may also come from third parties (see where the personal data comes from).

The data may include your name, address, contact information, work and educational history, achievements and test results.

We may collect special categories of personal data including ethnicity, health, philosophical beliefs, sexual orientation, as well as other categories as allowed by law. We do not seek to obtain and will not collect this type of data about a candidate unless permitted or required to do so in law. For example, Ofsted is subject to a legal duty to make reasonable adjustments to the recruitment process for disabled applicants.

How we will use information about you

We collect and use your personal data for legitimate human resources and business management reasons, to carry out our obligations and exercise specific rights in relation to employment. These might include:

• identifying and evaluating candidates for potential employment, as well as for future roles that may become available
• record-keeping in relation to recruiting
• to make reasonable adjustments to the recruitment process for disabled candidates
• ensuring compliance with other legal requirements, including diversity and inclusion requirements and practices
• carrying out criminal history checks as permitted by law. Ofsted has to seek certain information about criminal convictions and offences, where this is necessary to determine applicants’ suitability for particular posts

We may also analyse your personal data or aggregated data to improve our recruitment process and our ability to attract successful candidates.

In some cases, we may wish to keep your personal data to consider you for future employment opportunities. In this case, we will seek your consent either before or after you formally apply for a job opportunity.

We take appropriate measures to ensure that all personal data is kept secure, including security measures to prevent personal data from being accidentally lost, used or accessed in an unauthorised way. We limit access to your personal data to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality. Only authorised personnel of Ofsted and of our third-party providers are given access to personal data. These employees and third-party providers are required to treat this information as confidential.

Who we might share personal data with

We may share your personal data with other third-party service providers that may help us to recruit talent, administer and evaluate pre-employment screening and testing, and improve our recruiting practices.

We maintain processes designed to ensure that any processing of personal data by third-party service providers is consistent with this privacy notice and protects the confidentiality, availability and integrity of your personal data.

How long we keep personal data and how we decide this

We will always ensure that we have a clear business need if we keep your information after completion of the recruitment process.

If you accept an offer of employment from us, any relevant personal data that has a bearing on the employment relationship and was collected during your pre-employment period will become part of your personnel records. This will be kept in accordance with the applicable laws.

If we do not employ you, we normally keep your application within a recruitment file. These can be held for up to 2 years for reporting purposes (for example, to show how we meet diversity and inclusion requirements) and so that the Civil Service Commission can check that we select any candidates on merit, on the basis of fair and open competition and to help safeguard an impartial Civil Service.

Where the personal data comes from

We usually collect this personal data directly from you when you apply or register an interest for a role with us.

We also may collect personal data about you from third parties, such as from your referees, prior employers, test providers, Ofsted employees, the Disclosure and Barring Service (DBS) and through social media and internet searches, to the extent this is permitted by law. You will always be informed as part of the application process what checks will or may be undertaken.

The legal requirement to give us this information

We will process your personal data in accordance with this privacy notice, unless this processing conflicts with any legal requirements. By submitting your personal data to us, you acknowledge that:

• you have read and understood this privacy notice and agree to the use of your personal data as set out in it
• you are not required to provide any requested information to us, but failing to do so may result in not being able to continue your candidacy for the job for which you have applied.
• all of your representations to Ofsted are true and correct to the best of your knowledge and belief, and you have not knowingly omitted any related information of an adverse nature; if you have provided any false information or have omitted any relevant information, your application may be rejected or an offer withdrawn
• if, in the future, any incorrect or omitted information relating to your application comes to light, your employment may be terminated
• this privacy notice does not form part of any contract of employment offered to candidates

Your rights and contacting Ofsted

For more about your rights and how to get in touch with us about the information we hold, view the Ofsted personal information charter.