Privacy notice

How we protect your data

About the organisations carrying out the Five to Twelve study
How we got your personal contact details for this study
How your personal data will be used
Where will my data be stored and how will it be accessed?
Giving and withdrawing your permission to take part in the Five to Twelve study
Lawful basis for processing your data
Who will have access to your personal data?
How do you keep my data secure?
How long will we keep your data for?
Your data protection rights
Who should I contact about my data protection rights?
Complaints
Get in touch with the study team

About the organisations carrying out the Five to Twelve study

The Department for Education (DfE) has commissioned the National Centre for Social Research (NatCen), in collaboration with the National Children’s Bureau (NCB) and National Foundation for Educational Research (NFER) to collect data for the Five to Twelve study. More information about the study can be found at https://fivetotwelve.org.uk/.

The Department for Education (DfE) is the government department responsible for education policy and childcare. The DfE has commissioned the Five to Twelve study and is ultimately responsible for the safe keeping of your data.
The National Centre for Social Research (NatCen) is a registered charity and is the largest independent and not-for-profit social research organisation in the UK. NatCen is responsible for collecting data for this study.
The National Children’s Bureau (NCB) is a non-profit organisation that works with children, and for children, to reduce the devastating impact of childhood inequalities. NCB is not directly involved in the main data collection with families in this study but provide advice on aspects of the study including accessibility.

How we got your personal contact details for this study

The information used to select and make contact with people for the study is predominantly from the National Pupil Database (NPD), which is maintained by DfE and includes information about pupils in state schools, such as their name, date of birth, and address.

Personal data we collect about you

The study will collect personal data or personal information which means any information about an individual from which that person can be identified. Access to personal data is strictly controlled. The data that we hold for the study includes:

Information from DfE education records to invite you to take part in the study (for state school pupils only):

We use information that helps us to invite a diverse group of children to participate in the study that represent all children living in England (e.g. pupil postcode).

Information that you share with us during surveys:

Most of the personal data that we hold comes directly from you. We will collect:

Information that directly identifies you such as your name (and names of other family members), contact details (for you and others, such as family members) and other personal information (e.g. sex, date of birth)
Sensitive or ‘special category personal data’ about you and in some cases a family member (e.g. details about your or a family member’s race or ethnicity, religious or philosophical beliefs, information about your health)

Information provided by other organisations:

We would like to add information to your survey responses from administrative records held by DfE and external sources (government departments and agencies such as the NHS) to your survey data, if you agree to this. Further information about how we link your data can be found on the study website: fivetotwelve.org.uk/linking-your-data

How your personal data will be used

The table below outlines the different types of data we will be collecting and processing as part of this study, and why.

Type of data	Why are we processing this?
Your contact details	As this is a study that takes places across several years, we collect your contact details (e.g., your name, address, telephone number and email address) to keep in touch with you and to invite you to take part in future surveys and activities that relate to this research. Your address is also used to match data on your local neighbourhood to your survey data. Your contact details are shared securely with organisations that provide services to assist with the research study (explained in the 'who will have access to your personal data?' section).
Other people's contact details	Where applicable, we may also ask you to provide us with contact details of other household members, of the child's other parent(s), and of one of the child's teachers. This is so we can also ask them to take part in Five to Twelve surveys.
Keeping your records up to date – contact tracing	We ask you for contact details of someone else, usually outside of your household (known as your ‘stable contact’) so that if you move to a new home and we’re not able to contact you, we can contact that person to try to find out where you have moved to.
Survey data	We collect your survey data for research, analysis, and statistic purposes. Your survey data includes your survey answers as well as personal details (name, sex, address, and date of birth). Personal details for parents and carers will be used to link your survey answers to administrative education records held by DfE (for children taking part in the study we will likely use their Pupil Record Number to undertake the linkage). With your permission, we will also use these personal details to link your study answers to health (NHS) and economic records, and statistical authorities. In order to do this, your personal details will be shared with national organisations who link data for research purposes. These processes are governed by Data Sharing Agreements with these organisations to ensure that your information is kept secure. Further information about how we link your data can be found on the study website: fivetotwelve.org.uk/linkingyourdata

We will use your personal data and survey answers solely for research purposes and your personal details will be treated in strict confidence in accordance with the Data Protection Act 2018 and UK General Data Protection Regulation (GDPR). However, like all professional organisations, we are required by law to notify relevant authorities if we believe a child or adult is at serious risk of harm.

Your or your family will not be identifiable in any published reports resulting from this study. The data will be used to better understand the relationships between children’s experiences as they go through primary school and their outcomes, including their educational outcomes and their wellbeing.

Where will my data be stored and how will it be accessed?

Your data will be combined with data from thousands of other study participants and deposited in secure repositories to enable approved researchers to use your study data for research purposes for the public good. The NHS, Office for National Statistics and UK Universities have worked together to build a network of Trusted Research Environments (TREs). These have been created to keep research data confidential while they are used for public benefit research. They are secure systems where approved researchers can access data, but can never take data out of the system.

Trusted Research Environments work to the ‘Five Safe’s’ ethical and security principles, where:

Safe People – Only trained and specifically accredited researchers can access the data
Safe Projects – Data is only used for ethical, approved research with the potential for clear public benefit
Safe Settings – Access to data is only possible using secure technology systems – the data never leaves the TRE
Safe Data – Researchers only use data that have been de-identifed to protect privacy
Safe Output – All research outputs are checked to ensure they cannot be used to identify subjects

Copies of your study responses and, where you agree, your linked study data will be stored both at the DfE for department researchers to work on and in the UK’s national Trusted Research Environments where external researchers can access the data. These are likely to include:

The Office for National Statistics system which is designed for research using government routine records
The UK Longitudinal Linkage Collaboration (ukllc.ac.uk) which has been built by UK longitudinal studies, like Children of the 2020s for this type of research
The UK Data Archive which keeps research data secure and provides access for public benefit research.

In all of these systems, your data will be always kept inside the TRE and researchers will not be able to move your data to any other location. These TREs are all controlled by UK public authorities.

Giving and withdrawing your permission to take part in the Five to Twelve study

Five to Twelve is a voluntary research study. You will always be provided with full information about what taking part involves at each stage of the study and how your data will be used. We do this so that you know what to expect when you choose whether you would like to take part.

You are under no statutory or contractual obligation to take part. You can decide whether to take part, or continue to take part, or not, and you can change your mind at any time. You can also decide whether you give us permission to add information from administrative records (such as your health records) to your study data. You are free to change your mind about this as well (more information here: fivetotwelve.org.uk/linking-your-data).

You can contact us using the details at the end of this privacy notice to withdraw from the study at any time if you wish to or to exercise any other of your individual information rights under UK GDPR.

You can withdraw from participating in a particular element of the study, from adding information from administrative records, or from the study as a whole.
If you withdraw from the study, any data already collected will continue to be used unless you explicitly request that we delete it.
You can request to have your answers to the survey questions deleted and not deposited. Please make this request within 6 months of taking part in the study. After that date it may not be possible to remove your study answers. Note that once your study answers have been processed for use by researchers it will not be possible to remove your data from the study..
You can also request that we delete information that specifically identifies you (such as your name and contact details), without deleting your answers to the survey questions.

Withdrawing from Five to Twelve, or what you decide to give us permission for, will not affect the health and wider government services you or your family receive.

Consent is not our UK GDPR lawful basis for processing study data for research purposes. The lawful basis section below gives information about this.

Lawful basis for processing your data

For the purposes of the UK General Data Protection Regulation (GDPR), the DfE is the Data Controller as it is the organisation that decides how and why your personal data are processed. NatCen is the Data Processor for this study. NatCen’s collaborators and sub-contractors are acting as sub-processors.

The legal basis for processing study data from Five to Twelve is GDPR Article 6(e) ‘Public task’ because the data is collected to help inform DfE policy development and service delivery in the future Section 83(1)(a) of the Children Act 1989 grants the Secretary of State the power to ‘conduct, or assist other persons in conducting, research into any matter connected with his functions’ under various children’s legislation’. This legislation includes Children and Young Persons Act 2008 whose section 7 places a general duty of the Secretary of State to promote the wellbeing of children (persons under the age of 18) in England.

Sensitive or special category personal data is processed for research purposes under Schedule 1, Paragraph 4 of the DPA 2018. Consent is not the UK GDPR lawful basis for processing study data for research purposes.

Who will have access to your personal data?

Personal data collected during the study will be stored securely and will only be accessed by relevant staff from NatCen and DfE or their subcontractors who need to see it for the purpose of conducting the study. Personal data will be processed by NatCen and companies working on their behalf. We will only share data that identifies you (e.g. name, sex, address, date of birth) with a few organisations who are helping us to run the Five to Twelve study. We only share minimum information needed for them to complete their work.

These organisations include an external print company, Formara, who print documents to support the survey process and to keep study members up to date; Pure 360, who handle e-mail and text communications sent as part of the study; Artax, who host the study web surveys, and Rackspace, a hosting/cloud service.

All third-party processors have been vetted, and signed contracts and agreements are in place to ensure that strict data security arrangements are followed. The relationship between DfE, NatCen and the organisations that we share your data with is set out in the contracts between these organisations. These contracts are in place to ensure that your personal data is protected. The data may only be used for the purposes of public benefit research.

We can assure you that any information you provide during this research will not be used for marketing, nor will we sell or pass on your information to any third party without your permission for purposes other than those of conducting this study. Your information will not be added to the administrative records held by government departments or public bodies.

How do you keep my data secure?

We will keep your personal data and responses in strict confidence in accordance with this Privacy Notice. We take our information security responsibilities seriously and apply various precautions to ensure your information is protected from loss, theft or misuse. Security precautions include appropriate physical security of offices and controlled and limited access to computer systems.

We have regular internal and external audits of our information security controls and working practices, and we are accredited to the International Standard for Information Security, ISO 27001.

Personal data collected during the study will be stored securely and will only be accessed by researchers and interviewers from NatCen and DfE or their subcontractors who need to see it for the purpose of conducting the study.

NatCen will store the survey responses separately from identifiable information (e.g. names and addresses of participants).

How long will we keep your data for?

DfE, NatCen, or another equivalent, suitable organisation contracted by DfE will retain identifiable information (names and contact details) for the lifetime of the study for the purpose of making contact for future surveys.

After removing your personal details, at the end of each round of surveys NatCen will share the data collected as part of the study with the DfE through a secure transfer route for research purposes. At the end of the study NatCen will destroy their copy of the data in accordance with standards and procedures set out in ISO 27001. Destruction of data held by NatCen will take place within 12 months after the end of the contract between NatCen and DfE (scheduled for end of 2029) to allow time to consolidate the data and check for any errors.

DfE will retain your data indefinitely, so researchers can make use of the information for many years to come. This will be subject to regular review.

Your data protection rights

Under UK GDPR, you have the right:

to access your information within the limited period that NatCen hold it (contact details below). If you want to contact the DfE about data they hold about you, please see the contact details below;
to withdraw your consent and to object to our processing of your personal data at any time;
to rectify any inaccurate or incomplete personal data about you which we may hold (e.g. to correct incorrect contact details);
to request the erasure (deletion or removal) of personal data where there is no compelling reason for its continued processing. If we receive a deletion request from you, we will stop collecting, linking and depositing your data from that point onwards;
to restrict processing of your personal data (i.e. permitting its storage but no further processing) by DfE;
to object to direct marketing (including profiling) and processing for the purposes of scientific/historical research and statistics;
not to be subject to decisions based purely on automated processing where it produces a legal or similarly significant effect on you.

Who should I contact about my data protection rights?

You can get in touch with us about this study and how we are using your personal data using the details below. Please include “Five to Twelve” in the subject line when contacting us.

	NatCen	DfE
By email	fivetotwelve@natcen.ac.uk	dp.enquiries@education.gov.uk
Phone	0800 652 4568
By post		Office of the Data Protection Officer Department for Education (B2.28), 7 & 8 Wellington Place, Wellington Street, Leeds, LS1 4AW

For more information about how the DfE processes personal data, please see its Personal Information Charter: Personal information charter - Department for Education - GOV.UK (www.gov.uk)

Complaints

If you wish to make a complaint about the conduct of the study or our use of personal data, you can lodge a complaint to the Information Commissioner’s Office (ICO; the UK data protection regulator). For information on how to complain to the ICO, please see the ICO website ico.org.uk.

Get in touch with the study team

If you would like any further details about the study, you can email us at fivetotwelve@natcen.ac.uk or call us on 0800 652 4568 (Monday to Friday, 9am-5pm). Please quote your unique reference number (this can be found at the top of any letter you have received from us).

Version control

This privacy notice is updated regularly and was last updated on 03/11/2023.