Privacy notice – Complaints, EPRS and Whistleblowing

It may be necessary for Qualifications Wales to process information which may identify individuals and information about them when considering the following types of cases:

Complaints about awarding bodies;
Complaints about Qualifications Wales;
Whistleblowing;
Exam Procedures Review Service;
Regulatory Incidents

Qualifications Wales is the Controller of this data and details of how to contact us are provided below.

Our purposes for processing the data are:

To investigate complaints made about Awarding Bodies regulated by Qualifications Wales;
To investigate complaints made about Qualifications Wales;
To investigate whistleblowing cases brought to our attention;
To consider applications made to us for the Exam Procedures Review Service;
To monitor how awarding bodies manage events that could have an adverse effect in Wales.

Our lawful basis for retaining this information is to enable us to fulfil our public task as the regulator for the qualifications system in Wales and in order to exercise our official functions under Qualifications Wales Act 2015. Special category information (ethnicity or health information, for example) will only be processed if there is a legal basis to do so under UK GDPR and the Data Protection Act 2018 for a particular case.

This is to support our Principal Aims:

ensuring that qualifications, and the Welsh qualification system, are effective for meeting the reasonable needs of learners in Wales;
promoting public confidence in qualifications and in the Welsh qualification system.

Access to this information may be given to independent reviewers contracted by Qualifications Wales to review the cases. In some cases it may be necessary to share information with other UK regulators or our appointed lawyers. Appropriate organisational and technological safeguards are in place to ensure security of the data.

Any personal data related to the application will be retained for 5 years and will then be reviewed for disposal.

Freedom of Information

Please note that as a public body, all written information that we hold is subject to Freedom of Information requests. We will comply with the Data Protection Act 2018 and GDPR when considering requests made under the Freedom of Information Act.