The SOFA is an assessment program designed by The Australian Council for Educational Research Ltd (ABN 19 004 398 145) (“ACER Ltd”) and is licensed for commercial use by ACER International Ltd (ACER UK) for use within the United Kingdom (UK) and the European Economic Area (EEA) for students in years 3 to 10 or P3 to S1 in Scotland.
The SOFA seeks to measure students’ levels of proficiency in English literature, reading, writing and/or performance against Curriculum for Excellence, and allows comparisons to be made in relation to other school students at the same year level with similar students or other socio-economic factors taken into consideration (“the Aims“). De-identified or anonymous data from the Assessments may be used for the purpose of Scientific Educational Research by ACER Ltd.
The above sets out the purpose (“the Purpose“) for which a pupil’s personal data may be collected and processed by ACER UK from their respective institution. This privacy notice details the data collected, what ACER UK processes and why, and where it obtains this data from.
Your privacy is very important and ACER UK takes great care to ensure your personal data is protected. ACER UK is based in London UK. The following information is set out to comply with applicable privacy and data law including:
- The Data Protection Act (2018) which incorporates the UK modified "General Data Protection Regulation" (EU) 2016/679 (GDPR).
- The UK Privacy in Electronic Communications Regulation (PECR) or e-Privacy Regulation.
In pursuit of the Purpose, ACER UK gathers the following data (‘The Data’) directly from the pupil’s school by virtue of the institution participating within the SOFA project:
- Date of birth;
- English as a second language;
- School ID number (Unique Pupil Number);
- Tags (any useful category the teacher adds);
- School year;
- Gifted and talented indicator;
- Free School Meals and associated socio-economic data as requested from the school
- Child ethnicity;
- Type of disability;
- Raw test data;
If a pupil attends a school participating in the project, they may or will have held meetings to explain the project prior to commencement. Depending on the legal basis the school has chosen to share the participant personal data with ACER UK, they may have asked every parent/guardian to sign explicit consent for their child to participate within the project, or informed you that the school is treating this project as normal curriculum activities in line with their legal authority as educators. In any event they will have provided you with this parental privacy guide to explain the role of ACER UK as a data processor for the programme.
The Data Processing Act
To the extent of the applicability of the DPA 2018 to the Data:
- the collection of pupil Data by ACER UK was not a mandated requirement by Education Law, but was required by the participation of the School/Institution into the SOFA Programme. The only consequence of a pupil’s data not being collected is that s/he will not be able to participate in the SOFA project and assist in achieving the Aims;
- ACER UK is a processor in this programme and therefore only discloses pupil’s data and assessment results to:
- The pupil’s School/Institution who provided the data originally and they will subsequently distribute to parents and guardians and pupils as required
- ACER UK contractors assisting ACER UK in pursuing the Purpose with the School/Institution;
- if the pupil’s Institution is not within the UK or EEA, ACER UK will take steps to ensure the Institution complies with the DPA 2018, as if it was within the jurisdiction, but in any event ensure the following as a minimum:
- The School/Institution has provided the legal basis upon which it has entered into the SOFA project, and if it has chosen consent, then it will have obtained explicit consent (as defined within the DPA 2018) to the disclosure of pupil’s data to ACER UK and has completed the required safeguarding mechanism for the transfer to the EEA or UK jurisdiction, and provided parents or guardians with the required privacy and project information as required.
- They also acknowledge their role in receiving the assessment data and subsequent reports derived from the assessment data and its distribution back to the required parties.
- They take responsibility to providing your data subject rights afforded to you under the DPA 2018, and ACER UK will assist in connection with the provision of these rights by facilitating access where required with the data collected.
- Each individual School/Institution is responsible for compliance with its own jurisdictional data protection requirements and shall ensure ACER UK is held indemnified against any breaches in this legislation.
- ACER Ltd may use the assessment data once anonymised for the pursuance of Scientific Educational Research for the benefit of the public interest/good.
Your rights as a data subject
Under the Data Processing Act a Data Subject (individual) has the following rights:
- Inspect his or her personal information; request the legal basis of processing; request to whom the data has been shared (if anyone), and request to know any safeguarding mechanism if the data is allowed outside the EEA.
- Request amendment of personal information if believed to be in error; and request right to be forgotten if the legal basis was explicit consent.
- Request restriction of processing or additional information in regards to any profiling activities carried out with the data.
- You have the right to withdraw consent at any time, if you were asked to provide it.
- You can make a complaint in respect of a breach of your privacy if you believe this has occurred and you have the right to complain to your supervisory authority if you believe your School/Institution or ACER UK have not complied with your correctly requested data subject rights.
The Processing Activities by ACER UK
As mandated within the DPA 2018 the controller of the data (Institution) must make sure it’s processing activities are legal; transparent and accountable with regard to the legislation. Thus, the extent of the processing is as follows:
- The Data is processed by ACER UK (acting as Processor) solely to for the Purpose above and no other ancillary processing is carried out.
- The legal basis for the Institution to share and allow processing of the data in this regard has been chosen by itself on entering into the programme; however, ACER UK legal basis for the use of anonymised data for research purposes is performance of a task carried out in the public interest.
- ACER UK will only share the collected data with your Institution, or any contractors working for ACER UK in supplying the service to the Institution (e.g., printers for papers if required; trainers for staff at schools; report designers for output requests, Service Desk for help and support etc.)
- ACER Ltd in Australia may carry out scientific educational research on anonymised data, thus this is for the public benefit or interest and is outside of DPA 2018 as data is not able to identify any individual at this point. However, ACER Ltd has a standard contractual clause agreement in place with ACER UK to comply fully with foreign transfer safeguards in any event.
- ACER UK has an appointed DPO within the UK and can be contacted in regards to this processing at either phone number +(44)7989 305294 or DPO@acer.org.
Cross-Border Data Transfers
The Data is transferred to ACER’s UK main office and it is in turn stored within the secure EEA or UK data centres in line with DPA 2018. There are no data transfers outside the UK or EEA allowed, except in a specific situation; the institution supplying the data initially resides outside of the UK/EEA, in which case ACER UK will ensure the transfer to and from the institution is compliant with required safeguarding methods as part of the project initiation process. If ACER Ltd in Australia is going to process anonymised data for scientific educational purposes for the public interest then although this data transfer is outside of the scope of DPA 2018, ACER Ltd already has a safeguarding arrangement in place with its subsidiary based on the EU’s Standard Contractual Clauses, thus all safeguards for data subject rights are maintained. As described above ACER UK is a controller for that purpose only (Scientific Research). The transfer of participant personal data to ACER (UK) occurs to satisfy your Institution’s contract with ACER UK. As controller in respect of the transfer your Institution should ensure such transfer is compliant with the GDPR or any other applicable local law.
Data Retention Periods
Unless otherwise requested by the Institution utilising the SOFA, the Data is retained in accordance with the table below:
Type of Data
Physical exam booklets (if used)
Eight months after the testing date.
The test booklets are shredded. Scanned images of the test booklets are retained as per below.
Electronic scans and copies of any data files.
Ten years after the testing date.
This timeframe allows ACER UK to provide your school with longitudinal data analysis allowing your school to track student progress as they move through each year level.
Electronic individual reports
Eight years after the testing date.
This timeframe covers the eight years of the SOFA assessment (Primary 2 to Secondary 1) and allows ACER UK to provide copies of reports to schools and respond to queries regarding student performance.
Electronic class and school reports
Eight years after the testing date.
This timeframe covers the eight years of the SOFA assessment (Primary 2 to Secondary 1) and allows ACER UK to provide copies of reports to schools and respond to queries regarding their performance.