# DPIA Qualtrics

- Type: Tools
- Source: SURF
- Date: 2026-04-17
- Original: https://vendorcompliance.surf.nl/wp-content/uploads/2026/09/20260417-SURF-DPIA-Qualtrics-DesignXM-v1-Public.pdf
- Canonical: https://overview.legal/posts/615083
- Topics: Controllers, DPIA, AI Information Duties, IP Address, Privacy by Design, Processors, Accountability, Education, Training Data Requirements, Integrity and Confidentiality Principle

## Sections (239)

### ¶1

Dissenting opinion provided by Qualtrics (‘Oplegger’) 4/189 Dissenting opinion provided by Qualtrics (‘Oplegger’) Qualtrics’ Conclusion Qualtrics wants to emphasise that the assessments, opinions, and risk classifications contained within this DPIA are solely those of SURF. Qualtrics disagrees with many of the findings, conclusions, and classifications raised throughout this document, and has provided its feedback on the findings, conclusions and classifications to SURF. SURF ultimately decided on whether or not to incorporate this feedback into this DPIA and to publish this DPIA in its current form. From Qualtrics’ perspective, the responsibility for completing a Data Protection Impact Assessment (DPIA) rests with the Data Controller, which in this context refers to the institutions using Qualtrics services. SURF is not the data controller. Qualtrics, as the vendor providing the platform, typically does not complete DPIAs for organizations using its services.

> Topics: DPIA, Controllers, Processing

### ¶2

This is because the service is self-service in nature, meaning the institution determines what data to collect, from whom, and for what purposes. Since the DPIA must assess the risks specific to the controller's processing activities, and Qualtrics does not dictate these key elements, the institution is the party uniquely positioned to perform the required assessment. Qualtrics provided SURF with information about how our services operate to assist with the completion of this DPIA. Despite repeated clarifications and objections from Qualtrics, we believe SURF have mischaracterised many elements of the DPIA, and have failed to limit this DPIA to Qualtrics’ processing activities as a processor only, instead blurring the lines between where Qualtrics acts as a data controller vs. a data processor. Additionally, Qualtrics firmly disagrees with the risk profiles that SURF has assigned to the various elements that are identified above.

> Topics: Controllers, Processing, Processors, DPIA

### ¶3

Qualtrics delivers services to over 20,000 customers globally and has a robust security and privacy framework designed to ensure that customers can have trust in the processing activities they conduct using our services. Note: The assessments, opinions, and risk classifications contained within this Data Protection Impact Assessment (DPIA) are solely those of SURF. Qualtrics disagrees with many of the findings, conclusions, and classifications raised throughout this document, and has provided its feedback on the findings, conclusions and classifications to SURF. SURF ultimately decided on whether or not to incorporate this feedback into this DPIA and to publish this DPIA in its current form. Dissenting opinion provided by Qualtrics (‘Oplegger’) 13/189 anonymized before use. Qualtrics does not use any “Customer Data” for AI/LLM training. The creation of Analyses is highly common in the SaaS industry.

> Topics: DPIA, Cloud Computing, Processing

### ¶4

Qualtrics employs a comprehensive, multi-step process to anonymize and aggregate data before it is used for Analyses: • Automated Removal of Identifiers: Qualtrics uses a multi-step methodology and various tools to remove personal data and brand-specific references from data sets. • Aggregation: Data points are grouped together to further ensure anonymity while preserving analytical value. • Human-in-the-Loop Verification: We incorporate human review into the anonymization process to validate the outcomes of automated techniques and ensure accuracy and effectiveness. • Stringent Approval: All procedures related to data anonymization and aggregation undergo thorough internal scrutiny by appropriate stakeholders, including legal, privacy, security and engineering, and confidentiality considerations are taken into account as we design and implement our anonymization and aggregation processes.

> Topics: Anonymization, Personal Data, Identification

### ¶5

Qualtrics’ processing of personal data as a data controller is irrelevant here in our opinion. When using the Qualtrics services, the customer always acts as the data controller, and Qualtrics acts as the data processor. Our privacy policy is not applicable to Customers' use of our services and does not apply to the data they collect using the Qualtrics services. Qualtrics provided the following information about the categories of personal data : This risk seems to highlight the fundamental misalignment between the parties’ roles. As the data controller, a Customer is solely responsible for determining what data to collect, from whom, for what purpose, and when to delete data when using the Cloud Service. Qualtrics acts as a data processor. Therefore, Qualtrics cannot provide a list of every category of personal data collected as this is dependent on the customer’s use. Schedule 1 of the Qualtrics DPA clearly details that the categories of personal data are determined by the customer acting as the data controller. 27/189 Summary This document is a DPIA (Data Protection Impact Assessment) on Qualtrics DesignXM.

> Topics: Controllers, Processing, Processors, DPIA

### ¶6

This DPIA is commissioned by SURF, the collaborative organisation for IT in Dutch higher education and research, sometimes abbreviated to ‘The Dutch education sector’ or ‘education institutions’. This DPIA is a reference DPIA which means that the findings may be used for the SURF members and education sector. Qualtrics services Qualtrics XM enables organisations to collect real-time feedback from students, faculty, and staff through channels such as surveys, online reviews, call center interactions, and social media. This feedback offers insights into community experiences and concerns, supporting initiatives to enhance student engagement and improve staff retention in a rapidly evolving academic landscape. The scope of this DPIA This DPIA looks at Qualtrics DesignXM system. Within offered services to the education institutions (SURF members), SURF determined the scope based on the questionnaire which was shared with our educational institutions in February of 2025.

> Topics: DPIA, Education, Social Media

### ¶7

As the result of the questionnaire shared with SURF members, SURF found out the purpose of Qualtrics’ digital services which is mainly for the scientific research in education (application of teaching methods), research (data collection, data processing and analysis) and knowledge exploitation (knowledge marketing). 1 In the subsequent research, SURF aimed to precisely define the scope of institutional activities. It was determined that Qualtrics DesignXM falls within the domain of Experience Management (XM). 2 This service can be used to enhance how education institutions operate and improve overall student and staff experiences. It offers tools for administrators, general users, and researchers to manage surveys, collect data, and perform analysis. General User & Researcher Capabilities: • Project creation using templates or custom surveys • Advanced survey logic and validation features • Survey quality checks via ExpertReview • Collaboration features with customisable permissions • Multiple distribution methods and response tracking • Basic analysis tools and export options (SPSS, Excel, etc.) • Quota setting for representative sampling • Translation support with auto/manual options • Access to training, documentation, and support through XM Basecamp and the Qualtrics Community Administrator Capabilities (Brand Admins): 1 Results of the Qualtrics Questionnaire shared with member institutions on the 15 th February. 2 Qualtrics, ‘Education Experience Management’ (no date) https://www.qualtrics.com/education/ accessed 17 March 2026. 28/189 • Full control over licenses, user creation, and permission settings • Management of data privacy policies (e.g., sensitive data detection, security settings) • Oversight of platform usage (response rates, active users) This DPIA will further explain the purpose of Qualtrics DesignXM as a digital service for the institutions, which features it offers through the explanation of services, personal data processed, processing activities, and the responses of the DSARs (data subject access requests).

> Topics: Representatives, DPIA, Scientific Research, Monitoring

### ¶8

Out of scope This DPIA excludes the services such as Qualtrics CoreXM and Qualtrics AI response. SURF conducts testing within the environment of Qualtrics DesignXM. Outcome of the DPIA This DPIA identified 14 high and 1 low risks associated with the use of Qualtrics Design XM for Education. The mitigating measures proposed in Part D by SURF, education instititions may view the measures that SURF suggested to mitigate some of the risks. These measures correspond to low risks and features that may be disabled by the institutions. The high risks are unlikely to be resolved without firm and concrete commitments from Qualtrics to implement approporiate technical and organisational measures at the vendor level. The high risks identified concern the following: the data agnostic approach, incomplete list of subprocessors, loss of control and transparency due to the incomplete consent collection, incomplete cookie lists and incomplete handling of the DSARs.

> Topics: Transparency, DPIA, Consent

### ¶9

Mitigating measures for the education institutions are found in Part D Description of Proposed Mitigation Measures. The vendor has not committed to implementing mitigating measures and has disputed the SURF’s risk classification. Qualtrics shared the dissenting opinion in the form of ‘Oplegger’ with SURF which is included in the section Dissenting opinion provided by Qualtrics (‘Oplegger’) Qualtrics’ Conclusion SURF’s objective is to ensure that the use of Qualtrics’ products by education customers within the Netherlands is fully compliant with the GDPR. As SURF is at the forefront of conductings and publishing DPIA outcomes of behalf of its members. Given the unresolved high risks identified, SURF urges education institutions to carefully consider the findings of this DPIA before continuing using Qualtrics’ platform. Should Qualtrics provide firm commitments to implement the necessary mitigating measures, SURF will update this assessment accordingly.

> Topics: DPIA

### ¶10

The table below presents the overview of the remaining 14 high risks and 1 low risk. 34/189 Introduction Qualtrics DesignXM provides an experience management platform enabling organisations to develop custom surveys and research studies which are tailored to specific educational objectives. This Data Protection Impact Assessment (DPIA), commissioned by SURF (the Dutch IT cooperative of education and research) examines the personal data processing that occurs when Qualtrics is used by Dutch higher-education and research institutions. About SURF SURF is the collaborative organisation for IT in Dutch education and research, owned by its member universities and research institutes. Through SURF, members jointly procure high-quality digital services, develop and share knowledge, and ensure compliance with data protection regulations. As part of its services, SURF conducts umbrella DPIAs for IT services widely used across the sector.

> Topics: DPIA, Personal Data

### ¶11

What is a DPIA? DPIA stands for Data Protection Impact Assessment and must be performed by data controllers when they process personal data in a way that may “result in a high risk to the rights and freedoms of natural persons”, according to article 35 of the General Data Protection Regulation (GDPR). The assessment is intended to shed light on, among other things, the specific processing activities, the inherent risk to data subjects, and the safeguards applied to mitigate these risks. The purpose of a DPIA is to ensure that any risks attached to the process in question are mapped and assessed, and that adequate safeguards have been implemented to mitigate those risks. Data subjects have a fundamental right to protection of their personal data and some other fundamental freedoms that can be affected by the processing of personal data, such as freedom of expression. The right to data protection is therefore broader than the right to privacy.

> Topics: Processing, Personal Data, DPIA, Controllers

### ¶12

Consideration 4 of the GDPR explains: “This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity.” Umbrella DPIAs versus individual DPIAs In GDPR terms, SURF is not the data controller for the processing of personal data via the use of Qualtrics’ products and services. The data controller is the individual educational or research institutions that uses this service. However, as the Dutch IT cooperative, SURF takes the responsibility to assess the data protection risks for the end users and to ensure the data processing complies with the GDPR.

> Topics: Processing, Controllers, Personal Data, DPIA

### ¶13

Therefore, SURF conducts umbrella DPIAs to assist its members to select a privacy-compliant deployment, and conduct their own DPIAs where necessary. Only the organisations themselves can assess the specific data protection risks, related to the technical privacy settings, nature and volume of the personal data they process and vulnerability of the data subjects. The Dutch DPA has endorsed this approach to improve the 35/189 protection of personal data within the Education sector. 3 This umbrella DPIA is meant to help educational and research organisations with the DPIA they must conduct when they deploy Qualtrics, but it cannot replace the specific risk assessments the organisations must make themselves. Performing one umbrella DPIA on an IT service has benefits for SURF’s members, as well as for the vendors of the products SURF assesses. For the members, it saves the cost of each of them having to do an entire DPIA individually.

> Topics: Personal Data, DPIA, Scientific Research, Supervisory Authorities

### ¶14

They are also able to incorporate their combined knowledge about a product and experiences with a vendor in the umbrella DPIA. Additionally, SURF can more effectively negotiate mitigating measures with the vendors, because it has the combined negotiating power of the entire sector as a representative. For the vendors, it saves time, effort and money as well to not have to assist every institution individually with DPIAs that will likely be very similar. It’s also more efficient for them to be able to implement measures that benefit all members at once. DPIA criteria The Dutch Data Protection Authority (Dutch DPA) has published a list of seventeen types of processing for which a DPIA is always mandatory in the Netherlands. 4 If a processing is not included in this list, an organisation must itself assess whether the data processing is likely to present a high risk. The European national supervisory authorities (hereinafter referred to as the Data Protection Authorities or DPAs), united in the European Data Protection Board (EDPB) have also published a list of nine criteria.

> Topics: Supervisory Authorities, Supervision, Representatives, DPIA

### ¶15

As a rule of thumb, if a data processing meets two of these criteria a DPIA is required. The circumstances of the data processing via Qualtrics DesignXM (‘Design XM’) meet three out of nine criteria from the EDPB’s list. 5 This criteria is overall applicable to the education institutions. 1. Sensitive data or data of a highly personal nature (criterion 4). The EDPB explains: “some categories of data can be considered as increasing the possible risk to the rights and freedoms of individuals. These personal data are considered as sensitive (as this term is commonly understood) because they are linked to household and private activities (such as electronic communications whose confidentiality should be protected).” For example, later in Part A, SURF will mention that Qualtrics processes sensitive information such as bsn (burgerservicenummer). This criterion is relevant when education institutions conduct research or administrative activities involving questionnaires, surveys, or academic studies that collect information on special categories of personal data such as health information, political opinions, religious or philosophical beliefs, etc. These fall under the GDPR's ‘special categories of personal data’. 3 Dutch DPA (in Dutch only), Sectorbeeld Onderwijs 2021-2023, 24 January 2024, p. 5-6, URL: https://www.autoriteitpersoonsgegevens.nl/documenten/sectorbeeld-onderwijs-2021-2023.; https://www.edpb.europa.eu/sme-data-protection-guide/be-compliant_en 4 https://www.edpb.europa.eu/our-work-tools/consistency-findings/register-decisions/2019/netherland-sas-list-kind-processing_en 5 Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679,, page 9. 36/189 2.

> Topics: DPIA, Telecommunications, Supervisory Authorities, Personal Data

### ¶16

Data processed on a large scale (criteria 5). Working Party 29 recommends that the following factors should be considered when determining large scale processing: a. the number of data subjects concerned, either as a specific number or as a proportion of the relevant population. Large-scale data and the ability to organise large scale surveys. 6 b. the volume of data and/or the range of different data items being processed; c. the duration, or permanence, of the data processing activity. The processing of personal data varies from normal categories of data to special categories of data. d. the geographical extent of the processing activity. Since both the USA and Europe are in the geographical scope. 3. Matching or combining datasets (criterion 6): two or more data processing operations performed for different purposes in a way that would exceed the reasonable expectations of the data subject (against the principle of purpose limitation mentioned in Article 5 GDPR).

> Topics: Processing, Personal Data

### ¶17

This is due to the discovered purposes during SURF technical research that Qualtrics processes personal data to train its AI models. 4. The processing involves data relating to vulnerable data subjects (criterion 7). Employees and students whose personal data are processed via Qualtrics DesignXM are in a position of unequal power relative to the educational and research institutions overseeing the processing activities. Furthermore, the surveys may elicit the input of special categories of personal data by end-users. As such, heightened attention to data protection obligations and ethical considerations is required in these contexts. Qualtrics stated that the categorisation applicable to this scenario is not exhaustive because the processing activities are determined by education institions. 7 Hence, education institutions should consider if additional circumstances are applicable. The scope of this DPIA This DPIA looks at Qualtrics DesignXM system.

> Topics: Personal Data, DPIA, Processing

### ¶18

Qualtrics XM for enables organisationscollect real- time feedback from students, faculty, and staff through channels such as surveys, online reviews, call center interactions, and social media. This feedback offers insights into community experiences and concerns, supporting initiatives to enhance student engagement and improve staff retention in a rapidly evolving academic landscape. Within offered services to the education institutions (SURF members), SURF determined the scope based on the questionnaire which was shared with our educational institutions in February of 2025. In this questionnaire, SURF asked which Qualtrics products and features they use and what business processes they fulfil with the product. In addition, the scope was further refined by having meetings with the representatives of the institutions that use Qualtrics to discuss their process of using Qualtrics in day-to-day activities.

> Topics: Representatives, Education, Social Media

### ¶19

The results that institutions presented was that the purpose of Qualtrics’ digital services was mainly for the scientific research in education (application of teaching methods), research (data collection, data processing and analysis) and knowledge exploitation (knowledge marketing). 8 6 https://community.qualtrics.com/survey-platform-54/large-scale-survey-1500-questions-28769?tid=28769&fid=54 7 Qualtrics feedback to the DPIA v0.7 from the 20 th of February 2026. 8 Results of the Qualtrics Questionnaire shared with member institutions on the 15 th February. 37/189 In the subsequent research, SURF aimed to precisely define the scope of institutional activities. It was determined that Qualtrics DesignXM falls within the domain of Experience Management (XM). 9 This service can be used to enhance how education institutions operate and improve overall student and staff experiences. It offers tools for administrators, general users, and researchers to manage surveys, collect data, and perform analysis.

> Topics: DPIA, Scientific Research

### ¶20

General User & Researcher Capabilities: • Project creation using templates or custom surveys • Advanced survey logic and validation features • Survey quality checks via ExpertReview • Collaboration features with customisable permissions • Multiple distribution methods and response tracking • Basic analysis tools and export options (SPSS, Excel, etc.) • Quota setting for representative sampling • Translation support with auto/manual options • Access to training, documentation, and support through XM Basecamp and the Qualtrics Community Administrator Capabilities (Brand Admins): • Full control over licenses, user creation, and permission settings • Management of data privacy policies (e.g., sensitive data detection, security settings) • Oversight of platform usage (response rates, active users) This DPIA will further explain the purpose of Qualtrics DesignXM as a digital service for the institutions, which features it offers through the explanation of services, personal data processed, processing activities, and the responses of the DSARs (data subject access requests).

> Topics: Right of Access, Personal Data, Representatives, DPIA

### ¶21

Out of scope This DPIA excludes the services such as Qualtrics CoreXM and Qualtrics AI response. Methodology This DPIA was developed through a multi-faceted approach combining desk research, technical research, and structured engagement with Qualtrics. The aim was to evaluate both the legal and technical dimensions of personal data processing by insitutions using the Qualtrics services. Desk Research formed the foundation of the legal and policy analysis. This involved systematically reviewing documentation provided by Qualtrics, including data processing agreements, privacy policies, internal procedures, and relevant information security certifications. These documents were assessed against GDPR obligations, with particular attention to the legal basis for processing, data subject rights, international transfers, and roles of the parties involved. In cases where ambiguities or gaps in documentation were identified, SURF issued targeted follow-up questions to Qualtrics.

> Topics: Personal Data, DPIA, Certification, Processing Agreement

### ¶22

Their responses were incorporated into our findings, and their opportunity to clarify positions contributed to the accuracy and fairness 9 Qualtrics, ‘Education Experience Management’ (no date) https://www.qualtrics.com/education/ accessed 17 March 2026. 38/189 of the assessment. The outcomes of this documentation review are integrated throughout the DPIA. Technical Research focused on understanding the data lifecycle within Qualtrics from a systems and architecture perspective. This included evaluating how data is collected, processed, stored, shared, and secured. The investigation drew upon available technical documentation and system design descriptions, alongside real-world and live testing of the system, and interactive discussions with Qualtrics. Specific areas of analysis included data flows, storage methods, system logs, privacy-related settings, and the application of security controls.

> Topics: DPIA

### ¶23

These findings were then cross-referenced with the legal review to assess alignment between stated policies and technical implementation, and to identify any areas of residual risk or non-compliance. The testing scenarios were carried out by SURF in the environment provided by the vendor. The DPIA used a grey box methodology. This allowed SURF to maintain an independent, external perspective while also engaging in focused, informed access to specific parts of the systems. It offered a pragmatic balance. It’s sufficiently thorough to examine high-risk areas in depth, yet not so demanding as to resemble a full system inspection. In practical terms, we started with an external analysis based on observable behaviours and available documentation, then followed up by verifying key findings through direct communication with Qualtrics. The cooperation process was compex and differed from other vendor engagements.

> Topics: DPIA

### ¶24

For the significant part of the project, the communication was conducted though a single person from Qualtrics – there was no direct involvement of legal or technical teams in the beginning of the SURF DPIA research. The importance of the DPIA for the Dutch education sector was communicated to the vendor throughout the DPIA process. Despite SURF’s requests for deeper insight into internal data processing, the lack of technical insights prevented the intended ‘grey box’ approach for the research. When the identified risks were presented to the vendor, Qualtrics acknowlesdged the significance of this DPIA and the broader implications for its education customers in the Netherlands, particularly given that this report is made publicly available. Qualtrics explained this cooperation approach: ‘Qualtrics does not perform DPIAs on behalf of customers. We provided the necessary documentation to enable SURF to complete the DPIA.

> Topics: DPIA

### ¶25

This documentation is the documentation we provide to all customers. As institutions determine what data to collect and for what purposes, Qualtrics cannot opine on significant portions of the DPIA. That being said, Qualtrics is providing more thorough responses to this DPIA because you are considering publishing this document and we believe it categorically contains inaccurate information and misrepresentations.’ 10 Recognising the effect of this DPIA on education institutions, the publicity of this assessment after SURF re-emphasised the importance of this DPIA, Qualtrics eventually became more forthcoming. During a final meeting to fill in the gaps of the first report, Qualtrics provided more 10 Qulatrics’ feedback to the SURF DPIA version0.7 from the 20 th of February 2026. 39/189 granular information and more internal process details the vendor had previously been reluctant to share, allowing SURF to address the issues.

> Topics: DPIA

### ¶26

Outline of this DPIA This DPIA is based on the structure of the Model Gegevensbeschermingseffectbeoordeling Rijksdienst (DPIA), and on the structure developed by SURF Vendor Compliance team. This combination helps to implement the technical investigation results with legal analysis. This DPIA uses a structure of four main divisions, which are reflected here as “parts”. A. Description of the factual data processing B. Assessment of the lawfulness of the data processing C. Assessment of the risks for data subjects D. Description of mitigation measures Part A explains the processing activities using Qualtrics in detail in general terms, based on the tested setup. 11 This part describes the services within the scope of this DPIA, we will look at the purposes of the data processing from the perspective of the vendor as controller and processor, analyse project documentation such as privacy statements, security and privacy certifications.

> Topics: Controllers, Processors, DPIA, Processing

### ¶27

For this part, project documentation has been reviewed, as well as the contracts with Qualtrics. In addition, test scenarios were executed, and a data subject access request was submitted. Part B provides an assessment by SURF of the lawfulness of these data processing activities through Qualtrics. This analysis starts with an analysis of the extent of the applicability of the GDPR and the ePrivacy Directive, in relation to the legal qualification of the role of Qualtrics as provider. Subsequently, SURF has assessed conformity with the key principles of data processing, including transparency, data minimisation, purpose limitation, and the legal ground for the processing, as well as the necessity and proportionality of the processing. Part C assesses the risks to the rights and freedoms of the data subjects created by the processing activities identified in Qualtrics in Part A of this DPIA.

> Topics: Right of Access, Transparency, Retention Period, DPIA

### ¶28

It names specific risks that derive from these processing activities and aims to specifically determine both the likelihood that these risks may occur, and the severity of the impact on the rights and freedoms of the data subjects if the risks occur. Finally, Part D contains concrete measures that can be taken by Qualtrics and the educational institutions to mitigate the risks identified in Part C. These measures might either reduce the chance of the risks to occur, or the impact they might have, or both. Part D also contains an assessment of any residual risk attached to the use of Qualtrics that could not be mitigated by applying the suggested measures. If such unmitigated risks remain, the educational institution implementing Qualtrics might be required to consult the supervisory authority prior to the processing. 11 Find the test scenarios in Appendix 1. 40/189 Part A Description of Data Processing Part A of this DPIA provides an overview of the relevant facts of the data processing operations.

> Topics: Supervision, Processing, Prior Consultation, DPIA

### ¶29

It describes the data processing operations, the processing purposes and the interests in the data processing operations. In addition, Part A provides an overview of the personal data processed, the parties involved, and the techniques and methods of data processing. Also covered are the legal and policy framework and retention periods. A.1 Description of Services This section outlines the architecture of Qualtrics Design XM (‘Qualtrics’), detailing its system design, core components, data flows, and the technologies that ensure its scalability, security, and performance. SURF will explain the rationale behind selecting Qualtrics DesignXM for the DPIA and detail the platform’s core features and capabilities. A.1.1 Qualtrics as a vendor Qualtrics is a US based experience management company headquartered in Provo, Utah. It specialises in experience management (XM). This software enables organisations to collect, analyse, and transform the feedback (raw feedback) into the observable results.

> Topics: Processing, DPIA, Retention Period, Storage Limitation

### ¶30

In the European Union (‘EU’), Qualtrics’ EMEA headquarters office is located in Ireland. A.1.2 Qualtrics XM for Education Before diving into the licenses offered by Qualtrics CoreXM and Qualtrics DesignXM, SURF will firstly identify which services Qualtrics offers to the institutions. ‘Experience management (XM) is the process of listening closely to feedback, understanding what your stakeholders are saying, and then taking action to create the experiences they want.’ 12 Qualtrics XM for Education is a platform designed for schools and universities to gather real-time feedback from students, faculty, and staff across various sources such as surveys, online reviews, call centre interactions, and social media. The usage of the tooling involves the collection of personal data. This is the list of popular cases for Educational institutions to use Qualtrics XM: 13 • Student feedback; • Course evaluations where support may be needed; • 360 employee engagement; • Alumni and donor feedback; • Event and program evaluations; • Research and data collection.

> Topics: Education, Personal Data, Social Media

### ¶31

A.1.3 Qualtrics Core XM Based on the output of the questionnaire shared with SURF’s member, Qualtrics CoreXM is the basic package that education institutions use. Stemming from the questionnaire, Qualtrics CoreXM is the foundational platform of Qualtrics' Experience Management (XM) Suite, designed to help organisations gather, analyse, and act on 12 Qulatrics, Education Experience Management (Qualtrics, accesses 10 March 2026) https://www.qualtrics.com/education/. 13 Qualtrics, Education Experience Management (Qualtrics, accessed 30 July 2025) https://www.qualtrics.com/education/. 41/189 experience data across four key areas: Customer, Employee, Product, and Brand. It provides a flexible, scalable, and secure system for measuring and improving experiences at every touchpoint. 14 Even though Qualtrics Core XM is used by the majority of education institutions in the Netherlands, it has similar features to the DesignXM which is an enhanced digital service.

### ¶32

Although few institutions use it, conducting a DPIA on DesignXM offers a clearer understanding about the features. Qualtrics Design XM is explained in the next section. Before diving more into the differences between the services that Qualtrics offers to education institions, it should be noted that the term ‘customer’, used in the Sections below about Core XM and Design XM, refers to the institution rather than an individual user. A.1.4 Qualtrics Design XM Qualtrics Design XM is a premium component of the Qualtrics Experience Management (XM) platform that empowers organisations to intentionally create and refine experiences based on data-driven insights. 15 Design XM emphasizes proactive experience creation by using research, modelling, and testing tools to shape customer, employee, product, and brand experiences even before they are fully deployed. Design XM is an extension of Core XM, and is more expensive license in comparison to Core XM.

> Topics: DPIA

### ¶33

A.1.5 Overview of Architecture Qualtrics operates as a self-service, cloud-hosted, multi-tenant SaaS platform. This means that the underlying infrastructure and its operational maintenance are managed by Qualtrics, while customers are responsible for their day-to-day programme management and functionality usage. The cloud service is hosted on Amazon Web Services (AWS). Customers have the option to select their preferred data centre region from the available choices. For instance, Dutch educational institution could opt for a primary location in Frankfurt, Germany, with a replication fall-over location in Dublin, Ireland. This DPIA assumes education organisations select EU-based data centres to store their data. Quatrics explained that Dutch educationtion institutions as per customer determine the location of data centre. 16 Qualtrics uses a hot standby (active/passive) configuration. This design ensures geographic resilience using at least two AWS availability zones within the chosen region.

> Topics: Cloud Computing, DPIA, Education

### ¶34

In a disaster recovery scenario, services can be recommenced in a geographically resilient site to restore the cloud service. Each data centre is engineered for high availability, thereby eliminating single points of failure, including redundant communication lines and power supplies. 14 Qualtrics CoreXM Ranked #1 in Survey Platform in G2 Fall 2022 Report (Qualtrics, 28 September 2022) https://www.qualtrics.com/articles/news/g2-fall-report-2022/ accessed 29 January 2026. 15 Qualtrics, Meet our powerful experience design tool – DesignXM (Qualtrics, 8 July 2021) https://www.qualtrics.com/articles/news/experience-design-tool-designxm/ accessed 29 January 2026. 16 Qualtrics feedback from the 20 th of February 2026. 42/189 Within the Qualtrics data centre environment, direct access is protected by internal hardware firewalls and Intrusion Detection and Prevention Systems (IDS and IPS). Load balancers distribute traffic across web and application servers to enhance reliability and performance.

> Topics: Cloud Computing

### ¶35

These application servers are designed to scale rapidly to meet demand, sending processed data to database servers for long-term storage. Wireless networks within Qualtrics' corporate environment are encrypted with WPA2 and require Multi-Factor Authentication (MFA). A.1.6 Educational institutions’ order forms In this chapter, SURF will describe the Qualtrics order form. 17 This Order form is a standard document that specifies the details of a transaction between Qualtrics and Customers (education institutions). The Cloud Services purchased by the Education Institutions are specified in the applicable order form. the following: CoreXM Use-case; CoreXM Users; CoreXM Responses; CoreXM Additional Responses. Order forms mention CoreXM, which is used predominantly in the Dutch educational sector. From the survey responses of our education institutions, SURF determined that in addition to CoreXM, DesignXM is used by our members.

> Topics: Education, Cloud Computing, Access Controls, Encryption

### ¶36

Since CoreXM is the foundational platform for collecting and analyzing experience data, DesignXM is an expanded version of CoreXM providing advanced features for designing and optimizing customer and product experience as stated by Qualtrics. 18 Therefore, the scope of this DPIA is the analysis of the DesignXM since it is an extended version of the CoreXM. CoreXM is outside the scope of this DPIA. Additionally, the Order form is based on the Agreement that Qualtrics and Educational institutions conclude. Data Processing Agreement will be discussed later in this DPIA. It is important to mention that the Order Form is subject to the Qualtrics’ General Terms and Conditions. 19 Order Form does not only mention the services purchased, but also the list of special categories of personal data as referenced in the Schedule 1 of the DPA. 20 The reasoning that Qualtrics provided for including the special categories of personal data in the Order Form is: ‘The primary reasons for listing the intent to collect Special Categories of Personal Data in the Order Form (OF) rather than fixing them definitively in the DPA are to ensure accuracy, future- proof the agreement, and reflect the customer's sole responsibility as the controller. 17 Qualtrics Order Form 006VH00000PUms2YAD (the number of the order form). 18 Qualtrics, Meet our powerful experience design tool – DesignXM (Qualtrics, 8 July 2021) https://www.qualtrics.com/articles/news/experience-design-tool-designxm/ accessed 29 January 2026. 19 Qualtrics Order Form 006VH00000PUms2YAD (the number of the order form). 20 Qualtrics, ‘General Terms and Conditions for Indirect Qualtrics Services (GTC) and Data Processing Agreement (DPA) (for Online) Template’ (23 May 2025) https://success.qualtrics.com/rs/542-FMF- 412/images/Qualtrics%20GTC%20DPA%20%28for%20Online%29%20Template%20250523-MJR.pdf accessed 17 March 2026. 43/189 The DPA is intended to be used across all future orders and for the duration of the agreement between the parties.

> Topics: DPIA, Controllers, Education, Supervisory Authorities

### ¶37

If the Special Categories of Personal Data were exhaustively listed in the DPA, any change in the Customer's data collection practices (e.g., beginning to collect health data when they previously did not) would require amending the DPA itself. By referencing the Order Form, the parties can document the current intention regarding sensitive data collection without undermining the long-term validity of the core DPA.’ 21 From Qualtrics’ perspective, this approach provides better accuracy and allows the Customer to use the services as a self-service platform: ‘Therefore, while the Customer (Controller) is solely responsible for its privacy notice and processing register, the documentation provided via the DPA's Schedule 1 and the Order Form assists the Customer in fulfilling these obligations by clearly identifying the scope of potential high-risk data being processed on the platform.’ 22 A.2 Contractual Framework This section will outline legal documentation between Qualtrics and education organisations.

> Topics: Transparency, Records of processing activities, Controllers, Personal Data

### ¶38

We will further analyse general legal documents such as Qualtrics’ Master Terms and Conditions, General Terms of Use, Privacy Policy, and Cookie Statement Through the contractual framework, we will identify the purposes according to which Qualtrics acts as a Controller and/or Processor. A.2.1 General Terms and Conditions for Qualtrics Services (‘GTC’) This section will describe the obligations and responsibilities of Qualtrics and education institutions mentioned in the General Terms and Conditions. The purpose of this documentation is to establish expectations for using the Qualtrics products and protecting the company from legal liabilities and government user interaction (in case of government requests). Qualtrics directly concludes the GTC with education institutions. SURF reviewed some of the GTC concluded directly with the members (education institutions). The ‘GTC’ mentions the definition of the terms customer data and personal data: • “Customer data” means any content, materials, data, and information that Authorized Users enter or collect into the production system of the Cloud Service or that Customer derives from its use of and stores in the Cloud Service (e.g., Customer-specific reports).

> Topics: Controllers, Processors, Cloud Computing, Personal Data

### ¶39

Customer Data and its derivatives do not include Qualtrics’ Confidential Information. In addition to the GTC, Exhibit A provides a sample Data Processing Agreement for Qualtrics Services. The definition of personal data mentioned in the DPA is provided below: • “Personal Data” means any information relating to a Data Subject that is protected under Data Protection Law. For the purposes of the DPA, it includes only personal data that is (a) entered by Customer or its Authorized Users into or derived from their use of 21 Qualtrics answers shared with SURF on the 9 th December 2025. 22 Qualtrics answers shared with SURF on the 9 th December 2025. 44/189 the Cloud Service; or (b) supplied to or accessed by Qualtrics or its Subprocessors to provide suppor. 23 In the GTC, the roles and responsibilities regarding customer and personal data are defined: • Customer data : as between the parties, Customer is responsible for the content and accuracy of the Customer Data. • Personal data : Customer will collect and maintain all personal data contained in the customer data in compliance with applicable data protection and privacy laws.

> Topics: Personal Data, Cloud Computing, Processing Agreement, Supervisory Authorities

### ¶40

The documentation makes it explicit that Qualtrics, as the data processor, acts only on the documented instructions of the Customer (the data controller) concerning the processing of Personal Data and does not determine the purpose or means of such processing. Clause 3.4 in the GTC grants Qualtrics a right ‘to create analyses by using anonymized and aggregated information related to Customer’s use of the Cloud Service (“Analyses”). Analyses will not include any personal data.’ Although this clause relates to the data processing activity, it is placed outside of the Data Processing Agreement. Regarding the feedback feature, clause 12.12 states that Customer may, at its sole discretion, provide Qualtrics with Feedback, in which case Qualtrics and its Affiliates may retain and freely use such feedback without restriction. Customer is not responsible for Qualtrics’ use of any feedback. This means that the Customer bears no responsibility for how the recipient uses that feedback.

> Topics: Processing, Controllers, Processors, Recipient

### ¶41

This statement clarifies that any further use of the feedback (whether for product development, or other purposes) is solely under Qualtrics’ control. If the feedback includes personal data, the recipient is acting as a separate data controller for the feedback data. Because Qualtrics, according to the abovementioned clause, might use this data for their own purposes such as improving the feedback. Qualtrics’ explains that the feedback does not include the ‘Customer Data’, and it is irrelevant for the DPIA. 24 In clause 12.10 of the GTC, the Governing Law for the disputes arising from the agreement is under the laws of the State of Delaware. ‘The parties submit to the exclusive jurisdiction of, and the exclusive venue for any disputes arising under the Agreement will be in, the courts located in Wilmington, Delaware.’ 25 No alternatives were observed for the jurisdiction; for example, to be placed in the EU. 23 Qualtrics, ‘Qualtrics General Terms and Conditions & Data Processing Agreement Template’ (Qualtrics Success, 25 May 2023) https://success.qualtrics.com/rs/542-FMF- 412/images/Qualtrics%20GTC%20DPA%20%28for%20Online%29%20Template%20250523-MJR.pdf?version=0 accessed 10 October 2025. 24 Qualtrics’ feedback from the 20 th February 2026. 25 https://success.qualtrics.com/rs/542-FMF- 412/images/Qualtrics%20GTC%20DPA%20%28for%20Online%29%20Template%20250523-MJR.pdf?version=0 Section 12.10 of the GTC. 45/189 Potentially, the mentioned jurisidiction choice misleads the customer to believe that only foreign law is appliclable in case of disputes.

> Topics: Recipient, Controllers, DPIA, Processing

### ¶42

Nevertheless, according to the case of the European Court of Justice (‘CJEU’), ‘ the national court power to determine of its own motion whether a term is unfair must be regarded as constituting a proper means both of achieving the result … preventing an individual consumer from being bound by un unfair term. ’ 26 Even though the GTC are governed by the laws of the State of Delaware, the courts should be able to examine the clauses in consumer’s home country. This will be applicable if the clause is misleading for the EU consumers. A.2.2 Data Processing Agreement for Qualtrics Services Exhibit A details the Data Processing Agreement (‘DPA’) for Qualtrics’ customers. This example of the DPA together with the GTC is available publicly. 27 In the Schedule 1 of this agreement, SURF studied the subject matter and details of processing of Qualtrics services. It mentions the details for the processing of the customer, provider (Qualtrics), and details of the processing.

> Topics: Supervisory Authorities, Processing Agreement

### ¶43

For the details of the processing and specification of the categories of data subjects, it is stated in the Schedule 1 that Customers determine the personal data for the specific data processing activities. No specific information was provided about the categories of data subjects and personal data to be processed by Qualtrics except for the personal data mentioned in the next paragraph. Qualtrics mentions its role as only a data processor, and mentions that the data processing scope is determined by Customers or Permitted Controllers 28 : “Determined by Customer or Permitted Controllers. Customer or Permitted Controllers may configure the data fields during implementation of the Cloud Service or as otherwise provided by the Cloud Service. The transferred Personal Data typically relates to the following categories of data: name, phone numbers, email address, address data, system access / usage /authorization data, company name, contract data, invoice data, and any application-specific data that Authorized Users transfer or enter into the Cloud Service.” 29 This approach is determined by the fact that Qualtrics is a data agnostic platform, and Qualtrics communicated to SURF that ‘ the precise categories of Personal Data (which is a subset of 26 Joined Cases C-240/98 to C-244/98 Océano Grupo Editorial SA v Roció Murciano Quintero [2000] ECR I-4941’ https://eur- lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:61998CJ0240, para 28. 27 Qualtrics, ‘Qualtrics General Terms and Conditions & Data Processing Agreement Template’ (Qualtrics Success, 25 May 2023) https://success.qualtrics.com/rs/542-FMF- 412/images/Qualtrics%20GTC%20DPA%20%28for%20Online%29%20Template%20250523-MJR.pdf?version=0 accessed 10 October 2025. 28 ‘Permitted Controller’ means any other Controller authorized by Customer under the Agreement.

> Topics: Controllers, Processors, Processing, Personal Data

### ¶44

See Eshibit A Data Processing Agreement in Section 1 Defintions. 29 Schedule 1 DPA, Qualtrics, ‘Qualtrics GTC DPA (for Online) Template’ (no date) https://success.qualtrics.com/rs/542-FMF- 412/images/Qualtrics%20GTC%20DPA%20%28for%20Online%29%20Template%20250523-MJR.pdf accessed 17 March 2026. 46/189 Customer Data) processed at any given moment depend solely on the Customer's use case and the configuration of the Cloud Service.’ 30 Regarding the purposes of the data processing, the Schedule 1 of the DPA outlines the following ‘nature of the processing’ when transferring personal data: 1. use of Personal Data to set up, operate, monitor, and provide the Cloud Service (including operational and technical support); 2. provision of professional services; 3. communication to Authorized Users; 4. storage of Personal Data in dedicated data centers (multi-tenant architecture); 5. release, development, and upload of any fixes or upgrades to the Cloud Service; 6. back up and restoration of Personal Data stored in the Cloud Service; 7. computer processing of Personal Data, including data transmission, data retrieval, and data access; 8. network access to allow Personal Data transfer; 9. monitoring, troubleshooting, and administering the underlying Cloud Service infrastructure and database; 10. security monitoring, network-based intrusion detection support, and penetration testing; and 11. execution of instructions of Customer in accordance with the Agreement.

> Topics: Personal Data, Processing, Cloud Computing, Processing Agreement

### ¶45

The processing activities mentioned in the DPA involve core data handling actions of Qualtrics for the Customers. It outlines that Qualtrics acts solely as a data processor, operating under the instructions of the customer and within the scope defined by the service agreement, thereby aligning with data protection obligations governing processor responsibilities. Schedule 1 of the DPA states that the purpose of the transfer (the purpose of the processing) is to provide and support the Cloud Service and any associated services. Qualtrics and its Subprocessors may support the Cloud Service data centres remotely. One of the purposes, where the line between the responsibilities of the vendor is blurred is purpose 5: ‘Service development: release, development, and upload of any fixes or upgrades to the Cloud services’. Qualtrics informed to SURF that ‘In summary, for the purpose of "Service Development," Qualtrics only uses a subset of Customer Data (Anonymized and Aggregated Analyses) that no longer constitutes Personal Data, effectively preventing any "intersection" with its controller purpose of "research and development" which uses its own collected data.’ 31 Anonymising the customer data is a processing activity which Qualtrics seems to carry out for its own purposes outside the DPA.

> Topics: Controllers, Processors, Processing, Cloud Computing

### ¶46

In the DPA, the data processes are mentioned, and these purposes are mapped to the purposes which Qualtrics acts as an independent controller, as outlined section A.3.2 Qualtrics’ Purposes as a Controller. This DPA outlines the roles of its customers (educational institutions) and Qualtrics, where customers are the sole data controllers. 30 Qualtrics answers shared with SURF on the 9 th December 2025. 31 Qualtrics answers shared with SURF on the 9 th December 2025. 47/189 At this moment, it is challenging to determine the main purposes of the data processing based solely on the DPA. The agreement mentions general clauses instead of providing more specific information such as: ‘ Determined by Customer or Permitted Controllers. Unless otherwise indicated by Customer or Permitted Controller, transferred Personal Data relates to the Data Subjects having Personal Data (a) stored in the Cloud Service or (b) transmitted to, made available to, accessed by, or otherwise processed by the data importer .’ 32 This statement provides some scope for the Customer to determine the extent of the processing; however, in practice, it offers no specific details about the processing due to the lack of specification of the parties’ roles, categories of personal data and the required level of accuracy.

> Topics: Controllers, Personal Data, Processing, Cloud Computing

### ¶47

The broad applicability of the terms of the agreement should respect GDPR principles including purpose limitation, data minimisation, lawfulness according to Article 5 GDPR and ECJ (European Court of Justice) case-law. 33 For the special categories of personal data, the DPA mentions that: “ If Customer or a Permitted Controller intends to collect Special Categories of Personal Data, it will be specified in the applicable Order Form.” SURF communicated to Qualtrics that this information should be governed by the DPA, however Qualtrics choice was that ‘ Order form is subject to the DPA ’. 34 Additionally, Qualtrics mentioned: ‘SCC Requirements (Template Consistency): Schedule 1 of the DPA follows the same framework as Annex I of the EU Standard Contractual Clauses (SCCs), which requires the parties to identify "special" categories of personal data transferred. Including a section for Special Categories of Personal Data in Schedule 1 is necessary to match the required structure of the EU SCC template.

> Topics: Retention Period, Controllers, Supervisory Authorities, Personal Data

### ¶48

Since the SCC Annex requires this detail, Qualtrics uses the OF as the mechanism to capture that detail for the specific services being purchased.’ 35 The role of Qualtrics during the DPIAs is mentioned in Section 4.6 of the DPA: “If Data Protection Law requires Customer or Permitted Controllers to perform a data protection impact assessment or prior consultation with a regulator, then, at Customer’s request, Qualtrics will provide such documents as are generally available for the Cloud Service (for example, this DPA, the Agreement, and audit reports and certifications). The parties, acting reasonably and in good faith, will agree on any additional assistance.” Overall, the DPA stated that Qualtrics acts solely as a data processor, while education institutions are controllers and convey the use cases and the configuration of the Cloud Service. A.2.3 Data Processing Agreement (DPA) with Educational Institutions (SURF agreement) Educational institutions conclude a DPA with Qualtrics in two ways: 32 Qualtrics, ‘Qualtrics GTC DPA (for Online) Template’ (no date) https://success.qualtrics.com/rs/542-FMF- 412/images/Qualtrics%20GTC%20DPA%20%28for%20Online%29%20Template%20250523-MJR.pdf accessed 17 March 2026. 33 T he ECJ reinforced that data minimisation and purpose limitation are not just guidelines, but enforceable obligations .

> Topics: DPIA, Controllers, Processors, Prior Consultation

### ¶49

Case C-446/21 Maximilian Schrems v Meta Platforms Ireland Limited [2024] EU:C:2024:834. 34 Minutes of the Meeting with Qualtrics MOM from the 2 nd of December 2025. 35 Minutes of the Meeting with Qualtrics MOM from the 2 nd of December 2025. 48/189 1) Have a direct DPA between educational institutions and Qualtrics. This DPA is accessible directly from the Qualtrics website. This is the DPA which was mentioned inA.2.2Data Processing Agreement for Qualtrics Services. 2) A few educational institutions have a DPA through a third-party . The DPA with educational institutions is not concluded between Educational institutions and Qualtrics directly, but between Qualtrics services reseller and Educational institutions. In article 2 of the DPA (via the reseller ), it is stated that the controller (educational institutions) assigns and instructs the processor to process the personal data on behalf of the controller. 36 According to the DPA, not only Qualtrics can be processor, but as well.

> Topics: Controllers, Processors, Education, Supervisory Authorities

### ¶50

In the Qualtrics’ GTC, it is stated that ‘(1) Partner will enter into a data processing agreement with Customer (“Customer DPA”) that, in each case to the extent applicable: (A) allows Partner to use Qualtrics as a sub-processor of Personal Data;". 37 In this contractual relationship, Qualtrics is a subprocessor, and the Reseller is a Processor. In the Annex to the DPA,there is the section where Customers (Controllers) give Qualtrics clear instructions from customers with a detailed description of the data processing including purposes, data subjects and categories, frequency of audits, retention periods of the personal data or the criteria for determining this. The scope of the agreement is determined per Customer’s purposes and the corresponding Processor’s services offered to the Customer. The controller also gives the Processor specific permission for the transfer to third countries or international organisations.

> Topics: Processors, Controllers, Personal Data, Processing Agreement

### ¶51

This information is mentioned on the separate Annex to the agreement. It is stated that ‘ Transfers to Subprocessors will be on the same basis as set out in the DPA ’. 38 Schedule 3 to the DPA mentions the EU transfers which are governed by the EU Standard Contractual Clauses, Swiss transafers and UK transfers (each party will be deemed to have signed the ‘UK Addendum to the EU Standard Contractual Clauses.’ 39 SURF analysed the DPAs available for the review (DPA publicly available and SURF model). Based on the information, it is difficult to map the categories of personal data to the matching specific purposes. The EDPB in their guidelines clearly states: ‘ It should also be noted that, “in accordance with Article 5 GDPR, the controller bears the burden of proving that data are collected, inter alia, for specified, explicit and legitimate purposes and that they are processed lawfully, fairly and in a transparent manner in relation to the data subject ’. 40 36 Data Processing Agreement ‘Online Collaboration tools’ based on SURF Model processing Agreement version 3.0 from January 2019 (date 24 th October 2023), article 2.3. 37 Qualtrics, ‘Qualtrics GTC DPA (for Online) Template’ (no date) https://success.qualtrics.com/rs/542-FMF- 412/images/Qualtrics%20GTC%20DPA%20%28for%20Online%29%20Template%20250523-MJR.pdf accessed 17 March 2026. 38 Schedule 1 to the Data Processing Agreement. 39 Schedule 3 to the Data Processing Agreement. 40 European Data Protection Board, Guidelines 1/2024 on Processing of Personal Data Based on Article 6(1)(f) GDPR (European Data Protection Board, 8 October 2024) https://www.edpb.europa.eu/system/files/2024- 10/edpb_guidelines_202401_legitimateinterest_en.pdf accessed 30 July 2025, page 4. 49/189 The DPA concluded between Educational Institutions and , where Qualtrics is referenced, makes and Qualtrics both processors.

> Topics: Personal Data, Controllers, Processors, Legitimate Interest

### ¶52

Therefore, it might be challenging to determine specific obligations of Qualtrics in the role of a data processor when another third- party reseller is included in the agreement. A.2.4 Qualtrics Privacy policy Qualtrics’ privacy policy explains their data processing purposes. This documentation does not apply to personal information that Qualtrics processes on behalf of its customers, such as information using the Qualtrics XM Platform. 41 The purposes that include the personal information that is processed on behalf of the Education institution is discussed in the section A.2.2. The Privacy Policy identifies processing purposes that Qualtrics acknowledges in its role as a controller. These purposes are specified for the processing of personal data of the business customer representatives, website visitors and other users in connection with Qualtrics’ website and services. Qualtrics states that the personal information that is processed on behalf of customers falls outside this Privacy Policy. 42 According to the Privacy policy, Qualtrics considers itself as the controller for processing activities in service of the following purposes: 1) To provide the services; 2) To communicate with the client about the services; 3) To improve, monitor, personalise, and protect the services; 4) For research and development; 5) For marketing and advertising; 6) For compliance and protection; 7) To train artificial intelligence tools.

> Topics: Processing, Controllers, Processors, Personal Data

### ¶53

The last purpose mentioned in Privacy Policy where Qualtrics might use personal information to train AI models is legally and ethically complex. It is essential to be transparent about the use of these AI tools, apply data minimisation and anonymisation techniques carefully, secure the data properly, and provide opt-out or consent options, where applicable. This will be further discussed in Part B. Regarding marketing and advertising purposes, Qualtrics mentions in the Privacy Policy that: ‘Except where consent is required, we undertake such marketing and advertising on the basis of our legitimate business interests. Where we seek your consent, you may withdraw your consent at any time.’ 43 41 Qualtrics, Privacy Statement (Qualtrics, last updated 11 April 2025) https://www.qualtrics.com/privacy-statement/accessed 30 July 2025. 42 Qualtrics, ‘Privacy Statement’ (Qualtrics, 10 October 2025) https://www.qualtrics.com/privacy-statement/ accessed 10 October 2025. 43 Qualtrics, Privacy Statement (Qualtrics, last updated 11 April 2025) https://www.qualtrics.com/privacy-statement/accessed 30 July 2025. 50/189 This statement reflects that in case the legitimate interest arises, Qualtrics should justify and document when the specific data processing legal basis is permitted.

> Topics: Legitimate Interest, Retention Period, Anonymization, Consent

### ¶54

Furthermore, this claim can be understood as Qualtrics carrying out certain marketing and advertising activities asking for user consent, or not asking for the consent when those actions might be deemed to be in its ‘legitimate business interests’. This interpretation will be further discussed in the analysis of legal basis of the processing of personal data further in this DPIA and assessed if this commercial interest can fall within the legitimate interest. 44 A.2.5 Cookie Statement Qualtrics’ corporate website utilizes cookies and similar tracking technologies to support core site functionality, user experience, and analytics. The use of these cookies is governed by the Qualtrics Cookie Statement , which outlines the types of cookies used, their purposes, and the options available for user control. 45 Scope of cookie use The statement applies specifically to Qualtrics’ corporate websites, not to cookies used within the Qualtrics XM Platform by customers’ users creating surveys or to survey respondents.

> Topics: Legitimate Interest, Personal Data, Cookies, DPIA

### ¶55

User control and consent According to the statement, users can manage their cookie preferences through the site’s cookie banner or browser settings. The lay out of the cookie statement describes the cookie use as compliant with applicable data protection regulations, including GDPR, by offering opt-out mechanisms and clear notice. Nevertheless, Qualtrics states that disabling cookies may impact the availability of certain features. SURF conducted an analysis of the cookies that Qualtrics uses in the Section A.7 Cookie Statement. SURF’s technical research demonstrated that some of the cookies that were encountered were not mentioned in the Cookie Statement. 44 Case C-621/22 Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens [2024] EU:C:2024:858. 45 Qualtrics, Cookie Statement (Qualtrics, last updated 12 March 2024) https://www.qualtrics.com/cookie-statement/accessed 30 July 2025. 52/189 security incidents to an acceptable, predefined level.

> Topics: Personal Data, Cookies, Consent

### ¶56

Informatiemanagement Informatie en Technologiemanagement Shaping, directing, adjusting, monitoring and maintaining the information provision at strategic and tactical levels. Kwaliteitszorg Onderzoek Verantwoording Evaluating whether research meets the quality criteria set for it, and reporting and accounting for this (externally). This includes evaluations in accordance with the Standard Evaluation Protocol as established by VSNU, KNAW and NWO, but also other evaluation frameworks such as the Shanghai index and citation indices. Marktbewerking Deelnemerwerving Carrying out specific actions and campaigns to reach target groups such as organising information days and events for participants. Onderzoeksplanning Onderzoeksontwikkeling Preparing a proposal for a research study and submitting it for approval. Onderzoeksuitvoering Onderzoeksontwikkeling Conducting a careful, verifiable and systematic study of a particular issue to answer research questions.

> Topics: Monitoring, Information Provision Modalities and Communication Methods

### ¶57

Performancemanagement Verbetermanagement Ensuring that the functioning of the organisation is in line with previously set objectives. Table 1 HORA business processes fulfilled with Qualtrics A.3.2 Qualtrics’ Purposes as a Controller It was discussed in section A.2 Contractual that Qualtrics acts as a processor for the personal data and purposes assigned to it by education institutions according to the DPAs. 54/189 A.4 Processed Personal Data A.4.1 Personal Data Definition According to article 4(1)(a) of the GDPR, “‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”

> Topics: IP Address, Controllers, Identification, Personal Data

### ¶58

To explain privacy risks of data processing operation, it is important to consider what types of data of which groups of data subjects are being processed. This section will describe all personal data being processed from different categories of data subjects in Qualtrics’ documentation. In the Section Personal Data in Privacy policy, we will classify these personal data by categories mentioned by Qualtrics. For each category of personal data, we indicate which personal data are collected and processed. This section concludes with a subsection on the DSARs. A.4.2 Personal Data in Privacy policy The Privacy Policy mentions the type of personal data processed by Qualtrics for customer representatives, website visitors, and other users interacting with Qualtrics’ websites and services. 48 The types of personal data categories are within the scope of the this privacy policy. The Privacy Policy does not cover data processed on behalf of customers via the XM Platform and it is outside of the scope of this DPIA.

> Topics: Personal Data, DPIA, Representatives, Processing

### ¶59

However, it was necessary to examine the personal data covered under the Privacy policy to start categorising the known personal data,since Qualtrics refused to provide SURF with this information. 1. Personal Information Provided by a Customer: • Contact and account details such as name, email, phone number. • Financial/payment info: bank details, transaction history. • Communication records: feedback or support inquiries. • Marketing preferences and engagement data. 2. Automatic Data Collection: • Device details such as IP address, OS, browser type, location. • Online activity such as pages viewed, time spent, navigation paths. • IP addresses from survey respondents to prevent fraud and ensure security. • Session replays on Qualtrics’ website (excluding IP addresses and masked text input) to improve user experience. 3. Third-Party and Social Media Sources: • Data from social platforms and other sources like marketing partners or public databases. 48 Qualtrics, Privacy Statement (Qualtrics, last updated 11 April 2025) https://www.qualtrics.com/privacy-statement/accessed 30 July 2025. 55/189 4.

> Topics: IP Address, Personal Data, Direct Marketing, Social Media

### ¶60

Call Recordings: • Certain calls may be recorded to enhance service quality, resolve disputes, train staff, and maintain accurate records. A.4.3 Data Processing Agreement personal data list A DPA applies to all Qualtrics services such as Cloud services, professional services, and research services. 49 The details of the processing and categories of data subjects, personal data, and special categories of personal data are mentioned briefly in the DPA, but in a quite general overview of the possible categories of data processed. Mainly, in the Schedule 1 ‘Subject Matter and Details of Processing’, it is mentioned that Customers determine the nature and scope of personal data transferred or processed in the cloud service. This includes what data is stored, transmitted, or otherwise processed. Additionally, it is stated that it must be explicitly stated in the applicable Order Form if any special categories of personal data are to be processed.Qualtrics further describes that additional measures are implemented by Qualtrics when special categories of data are transferred such as training of personnel, encryption of data in transit and at rest, and system access logging and general data access logging.

> Topics: Personal Data, Security, Cloud Computing, Processing Agreement

### ¶61

3 Qualtrics’ DPA details of processing, SURF shows the details of processing for the Qualtrics services. Categories of data subjects Determined by Customer or Permitted Controllers. Unless otherwise indicated by Customer or Permitted Controller, transferred Personal Data relates to the Data Subjects having Personal Data (a) stored in the Cloud Service or (b) transmitted to, made available to, accessed by, or otherwise processed by the data importer. 49 Qualtrics, ‘General Terms and Conditions and Data Processing Agreement’ (25 May 2023) https://success.qualtrics.com/rs/542- FMF-412/images/Qualtrics%20GTC%20DPA%20%28for%20Online%29%20Template%20250523-MJR.pdfaccessed 30 th January 2026. 58/189 Data storage & Backup Contact data Phone numbers, email address, address data. Customer/Co nsumer Personal Data (Standard; some pseudonymized) User Communication – Communication to Authorised users.

> Topics: Personal Data, Cloud Computing, Controllers, Processing Agreement

### ¶62

Technical data/Usage data/Diagnostic data System access/usage/aut horization data. Consumer May contain personal data, if some of this information may relate to an identified or identifiable person. Service provisioning, Service development; Technical processing; Usage Data Application- specific data that Authorized Users enter into the Cloud Service. Customer data/User data May contain personal data Service provisioning; Professional services. Content data Contract data, invoice data, and any application- specific data that Authorized Users transfer or enter into the Cloud Service. Customer May contain personal data Service provisioning; Professional services. Special categories of peronal data The processing of Special Categories of Personal Data is Determined by Customer or Permitted Controllers. Specifically: includes data concerning health, genetic data, biometric data, data revealing racial or ethnic origin, political opinions, religious Customer Personal data Process in accordance with the Order Form signed between Qualtrics and customer. 59/189 or philosophical beliefs, trade union membership, or data concerning a natural person’s sex life or sexual orientation.

> Topics: Personal Data, Cloud Computing, Controllers, Identification

### ¶63

5 Personal data mapping for Qualtrics as a processor For the personal data processed on behalf of the Customer, Qualtrics clarifies that the Customer is the Data Controller. Education institutions determine what data to collect and for what purposes. Qualtrics could not provide SURF with the list of personal data because of the confidentiality of other customers. Therefore, SURF could not access a more detailed documentation of specific categories of data subjects and personal data to be processed by Qualtrics. All Data are controlled by Customers, who are designated as data controllers. Qualtrics is the data processor. Customers determine the following about the data stored in the Qualtrics platform: • Which type of data to collect • Who to collect data from • Where to collect data • What purpose • When to delete the data SURF requested documentation from Qualtrics to determine what type of data to collect and for what purposes.

> Topics: Controllers, Processors, Processing, Personal Data

### ¶64

Qualtrics responded that they do not share a list of personal data that the vendor received from other customer due to confidentiality reasons. 52 This was the response despite SURF mentioning that as an organisation, SURF represents the members in the educational sector. 52 Qualtrics response from the 11 th of Auust 2025. 61/189 Signature Respondents draw their signature using a mouse or touch screen. Heat Map Respondents click parts of an image; heat maps show popular areas. Hot Spot Respondents select predefined regions within an image. Meta Info Hidden question that captures browser and operating system information. Captcha Verification Prevents bot submissions by verifying the respondent is human. Highlight Allows respondents to highlight and evaluate words in a block of text. Screen Capture Lets respondents upload screenshots of their current screen; available in Website/App Feedback projects.

> Topics: Personal Data

### ¶65

Video Response Respondents can record and submit video or audio responses. Also logs the user’s location information. Unmoderated User Testing Collects respondent-recorded feedback through video or audio while interacting with a product or site. Location Selector Enables respondents to select a geographic location from a predefined list. ArcGIS Map Allows geographic selection from an ArcGIS-integrated map; can pass the data to ArcGIS directly. Solicit Reviews Enables respondents to submit reviews to external platforms (e.g. Google, Facebook) directly from within the survey. Tree Testing Asks respondents to locate a specific web page using a simulated navigation menu; used for evaluating information architecture. Table 6 Question Types available within Qualtrics A.4.6.1 Meta Info SURF analysed the question types. The Meta Info type was noteworthy, so this paragraph will give a bit more context about this question type.

> Topics: Social Media

### ¶66

This feature is designed as a hidden question type that allows researchers to collect technical details about a respondent’s environment without the survey recipient providing this information directly. According to Qualtrics’ technical specifications, the feature captures the following data points: • Browser type and version; • Operating system; • Screen resolution; • User agent strings; In addition, SURF’s technical testing observed that in addition to the above data points, location data is collected and displayed to researchers as well, derived via GeoIP estimation See Figure 1 . 63/189 Because the Meta Info question is hidden by default, respondents are typically unaware that their machine's metadata and estimated location are being collected unless the survey creator explicitly mentions it in a privacy statement or a consent form. During SURF’s technical inquiries, Qualtrics confirmed that they do not provide an automatically generated consent form that details these specific machine-level processes.

> Topics: Recipient, Consent

### ¶67

Institutions or researchers of institutions using Qualtrics must manually configure and write their own notices if they wish. Qualtrics instructs institutions to build a consent form manually using built in logic. 53 53 Qualtrics – Building a Consent Form, URL: https://www.qualtrics.com/support/survey-platform/common-use-cases-rc/building-a- consent-form/ 64/189 A.5 Data Processing Activities This chapter outlines the types of processing activities that may occur within the Qualtrics platform. In accordance with Article 4, Paragraph 2 of the GDPR, “processing” is defined as follows: “’processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;” It is important to bear in mind that the controllers determine the purposes and means.

> Topics: Controllers, Processing, Personal Data, Consent

### ¶68

Therefore, the scope of the processing may vary based on the specific requirements of the institutions. The descriptions below go into more detail and are based on the actual processing operations as found in the research for this DPIA. A.5.1 Identity and Access Management Qualtrics' Identity and Access Management (IAM) framework is designed to provide security and offers various configuration possibilities for education organisations. Qualtrics operates on a principle of least privilege and need-to-know when assigning access rights to both its internal personnel and customer users. A.5.1.1 Authentication Methods and Access Control Qualtrics offers various authentication methods to provide the flexibility in managing user access. Native Login: Users can log in with a username and password. Brand Administrators (BAs; as explained in A.5.1.1.1) can customize password requirements, including minimum length (e.g., 12 characters), complexity (at least three of uppercase, lowercase, number, or special characters), maximum age (e.g., 60 days), and password history (e.g., 12 previous passwords).

> Topics: Access Controls, DPIA, Identification

### ¶69

Account lockout settings can also be configured, such as the number of failed attempts (e.g., 4 attempts) and the lockout period (e.g., at least 30 minutes). This method is not preferred as more secure alternatives exist. Single Sign-On (SSO): Most education organisations utilise SSO, which allows users to log in using their own organisation’s credentials. This can be implemented via a self-service portal or with Qualtrics' assistance. SSO is key to validating user affiliation with the university. SURFconext is one of the supported SSO providers. 54 When SSO is enabled, BAs can choose whether to allow or disable the Qualtrics Login as a fallback, thereby closing a back door for alternative login methods. Multi-Factor Authentication (MFA): MFA is supported and can be enabled or disabled by the BA for the entire brand to provide an additional layer of security for logins. 54 “SURFconext Key Rollover 2023: Procedure for Qualtrics - SURF IAM - SURF User Knowledge Base,” n.d. https://servicedesk.surf.nl/wiki/spaces/IAM/pages/128910221/SURFconext+key+rollover+2023+Procedure+for+Qualtrics. 65/189 • Invitation-Only Access and Password Protection: Surveys can be configured to be available only by invitation or be password-protected to limit access to a known group of individuals. • Referral Website Restrictions: BAs can configure surveys to only be accessible if the user comes from a specified referral website (like surf.nl) to prevent unauthorised access from other domains. • IP Allowlisting: Customers can limit access to their Qualtrics instance to specific IP addresses. • Session Management: BAs can set automatic logout based on inactivity (like 60 minutes) and define the maximum concurrent sessions per user (default 500).

> Topics: Access Controls, IP Address, Data Breaches, Integrity and Confidentiality Principle

### ¶70

They can also view and end active sessions for users. A.5.1.1.1 User Management and Permissions The Qualtrics platform provides a hierarchical structure for user management, segregating administrator and user roles. Administrator roles: • Brand Administrator (BA): This is the highest level of permission within a Qualtrics license. BAs are responsible for moderating user activity, managing account access, setting up teams and divisions, and maintaining organisational and security settings. They have visibility across the entire brand and its divisions. BAs also have the ability to proxy login into user accounts, a feature which can be disabled by the BA but is enabled by default. More on proxy login in A.5.2. • Division Administrator (DA): DAs have full administrative access but are restricted to their specific division only. They can see user activity and reports within their division but not across others.

### ¶71

This allows for decentralised management while maintaining overall control by the main BA. User roles: • User Types: BAs can define custom "User Types", which are predefined sets of permissions outlining what a user can and cannot do. This automates the process of assigning permissions. For example, distinct user types can be created for students, faculty, or administrative staff, each with tailored access rights. Qualtrics also offers default user types that cannot be customised. Education organisations must create new user types to modify permissions. The default list of user types can be seen in Appendix 2. • Groups: User groups are distinct from user types. A group is a collection of two or more users that can share projects, graphics, files, and messages in libraries. They are typically used for cross-collaboration between different divisions. Access to groups is defined by group assignments, not user types.

> Topics: Access Controls

### ¶72

A.5.1.2 Provisioning and Deprovisioning Access When it comes to provisioning users in Qualtrics, several options are available. BAs can manually create accounts by specifying usernames, passwords, divisions, and permissions. This process offers granular control but can be time-consuming at scale and increase the risk of user error. To streamline onboarding, there's a bulk upload feature that accepts CSV files which allows administrators to import multiple users simultaneously. More efficiently, Qualtrics supports automated, just-in-time provisioning when SSO is enabled. In such cases, user accounts are 66/189 created dynamically upon first login, with role and division assignments determined by attributes passed from the SSO provider. This setup reduces the need for ongoing manual input during provisioning. However, deprovisioning and managing role changes present significant gaps. There is no automatic process to adjust or revoke user access when their role changes or they leave the organisation.

### ¶73

If SSO access is lost (say, because someone exits the institution) their Qualtrics account remains active unless manually handled. BAs can either disable the account, which retains all associated data but still counts against license limits, or delete the account entirely after optionally transferring data. While brand settings can be configured to disable inactive accounts after a set period, this is a workaround rather than a robust deprovisioning mechanism. Role changes are also not dynamically reflected. For institutions relying on SSO for user mapping at login, initial provisioning may align with current attributes, but subsequent updates to roles or permissions aren’t automatically synchronised if the user did not need to re-login. Maintaining accurate role-based access requires ongoing manual oversight or the development of custom integrations using Qualtrics' API. The API does support full user lifecycle operations (creating, updating, disabling, and deleting users) and enables automation via external systems.

### ¶74

Education organisations can use this API to build integrations with identity platforms such as SailPoint or Okta for more centralised identity governance. While there is no out-of-the-box connector, the API provides a foundation to build such workflows. A.5.2 Proxy Login Qualtrics incorporates a proxy login functionality, which enables Brand Administrators to access and operate within other user accounts as if they were that user. This capability is enabled by default in the system, though Brand Administrators retain the option to disable it. 55 All actions performed through a proxy login are logged within the platform's activity logs. 56 These logs record details such as the date and time of the event, the user ID of the account into which access was gained and specifically identify the Brand Administrator who initiated the proxy session. 55 The end user whose account is accessed does not receive any notification that a proxy login has occurred.

### ¶75

A.5.3 Incomplete Survey Responses Qualtrics provides functionality to manage incomplete survey responses to allow participants to finish their surveys later. For respondents accessing the survey via a personalised traceable link, if the customer chooses to set it up in this manner, progress is saved on Qualtrics' servers and remains accessible across different devices. This is the default behaviour, but institutions may divert from this behaviour, see Figure 3 . However, for anonymous responses, progress is stored locally in browser cookies and is therefore tied to the specific device and browser used. SURF’s technical testing confirmed this behaviour. 55 Qualtrics. “Security Tab.” Accessed June 27, 2025. https://www.qualtrics.com/support/survey-platform/sp-administration/security- tab/. 56 Qualtrics, “Qualtrics’ Cloud Security & Privacy Framework,” April 2025. 68/189 A.5.3.1 Technical Investigation of Data Flows and Endpoints We conducted a network-level technical investigation based on scripted scenarios in our own testing environment provided by Qualtrics, which in turn are based on real-world usage of educational organisations (see Appendix 1).

> Topics: Cookies

### ¶76

This means that all data flows which were detected between the testing device and Qualtrics’ servers were logged and analysed. All mapped endpoints (servers and devices which any data using Qualtrics’ services flows to and from) can be consulted in Appendix 3. Our technical investigation identified multiple endpoints and their associated registrars, which we then matched against Qualtrics’ disclosed subprocessor list (as described in A.8.3). Qualtrics categorises its subprocessors into four groups: mandatory, optional for technical functionality, optional for professional services, and affiliated entities. Our investigation revealed several important observations that diverge from the documented data processing arrangements, particularly concerning data residency and third-party services. A.5.3.2 Google Analytics and Google Tag Manager While Google, LLC is listed as an optional subprocessor for “AI capabilities, including translation services”, and SURF didn’t opt for these AI capabilities during testing, the mapped endpoints frequently include domains related to Google Analytics (region1.google-analytics.com, www.google-analytics.com) and Google Tag Manager (www.googletagmanager.com).

### ¶77

The specific purpose of web analytics or tag management is not mentioned in Google's listed services, which primarily focus on AI and translation. This suggests an unlisted function for a recognised subprocessor. A.5.3.3 Pendo Qualtrics states that “Pendo is not a subprocessor. It does not process customer data.” 58 However, SURF observed several POST request to data.pendo.io, which represent the transmission of compressed behavioral telemetry and session metadata from the Qualtrics environment to the Pendo analytics platform. Based on the request headers and the structure of the Gzipped JSON payload, SURF observed that the data processed includes technical identifiers such as the user’s operating system (macOS 10.15.7), browser version (Chrome 138), and unique session tokens. Furthermore, the presence of an encoded “events” string indicates the collection of granular clickstream data, such as specific UI interactions, page navigation paths, or time-on- page metrics.

> Topics: Identification

### ¶78

SURF assumes that while the payload identifies the specific application via the API key 1a296aed..., it likely associates these actions with a pseudonymized user ID to track the end- to-end journey within the survey interface. A.5.3.4 Amplitude Qualtrics states that “Amplitude is not a subprocessor. It does not process customer data.” 59 . However, SURF observed many POST requests to Amplitude, which function as high-fidelity event tracking for the Qualtrics TextIQ analytics suite. The data processed through these endpoints is significantly more granular than standard web logs, containing explicit internal identifiers including a persistent User ID (UR_br8tOPIeA4UWi8u) and a unique Device ID. 58 Qualtrics’ review on SURF’s DPIA, 20 February 2026 59 Qualtrics’ review on SURF’s DPIA, 20 February 2026 69/189 The JSON payloads reveal the systematic collection of functional interaction data, specifically documenting user engagement with the TextIQ interface, such as “PageLand” events and “Response.View” actions.

> Topics: DPIA, Monitoring, Identification

### ¶79

Of particular note for this assessment is the processing of operational metadata linked to specific survey responses (responseIds like R_25tDs3LI3TxoJct), sentiment analysis configurations (is5LevelSentiment), and linguistic settings. While the IP address is masked in the payload as $remote (indicating it is captured at the server level rather than the client level), the combination of precise timestamps, session IDs, and the specific survey IDs (e.g., SV_3yljFEIimPrABSK) enables the reconstruction of a highly detailed user behavioural profile. These logs confirm that third-party analytics are being used to monitor not just that a user is present, but the specific data subsets and analytical tools they are interacting with within the Qualtrics platform. A.5.4 Data Subject Access Requests As part of the technical investigation, we conducted a targeted evaluation of Qualtrics’ capacity to support and comply with data subject rights, specifically the right of access under Article 15 of the GDPR.

> Topics: Right of Access, IP Address, Personal Data, Data Subject Rights Exercise Modalities and Procedures

### ¶80

The approach involved the submission of formal DSARs from multiple actors who had interacted with the Qualtrics platform in a variety of scripted testing scenarios, as described in Appendix 1. These actors included test profiles simulating researchers with user accounts, administrative users, and survey participants. Each actor engaged with the platform in ways representative of real-world use cases, such as designing and deploying surveys, responding to survey instruments, managing survey projects, and reviewing analytics. The objective was to establish whether Qualtrics offers adequate mechanisms for facilitating access to personal data held about users and respondents, and to determine the scope of data retrievable under a standard DSAR procedure. A.5.4.1 Submission of DSARs Each DSAR was set up to seek a full disclosure of personal data processed by Qualtrics in connection with the specific identity of each test actor.

> Topics: Representatives, Right of Access, Personal Data

### ¶81

The requests included standard elements typically associated with such submissions, such as the requestor’s name, email address, and IP address. The content of the requests followed GDPR Article 15 requirements and specifically sought: • A copy of all personal data traceable to the data subject, including data stored in Qualtrics systems, logs, and other records • The purposes for which the data is being processed • The categories of personal data concerned • The recipients or categories of recipients to whom the data have been or will be disclosed, particularly in third countries or international organisations • The envisaged retention period or the criteria used to determine such a period • The source of the data if it was not collected directly from the data subject • The available options for rectification, erasure, or objection, and the procedures involved • The existence of any automated decision-making or profiling activities and the logic involved in such processes, along with their consequences for the data subject 70/189 A.5.4.2 Qualtrics' Response to DSARs In response to each DSAR submitted, Qualtrics declined to provide a direct reply to the information requested.

> Topics: Recipient, Profiling, Personal Data, Automated Decision-Making

### ¶82

Their reasoning is that they only provide data subject access support for personal data which they state they are the controller for, even though the DPA does require them to assist the controller (SURF in this scenario) with DSARs. 60 Qualtrics referred the data subject to a publicly available self-service support page hosted on its website. 61 This page provides guidance for users of the Qualtrics platform (typically researchers or administrators) on how to manually export survey response data. The content of the support page pertains exclusively to the export of data collected from survey respondents. The export functionality described permits downloading of structured response data from surveys, including: • Responses to survey questions • Survey metadata (like start and end times, recorded date, IP address) • Contact fields and embedded data submitted by respondents Export options are limited to formats such as CSV, TSV, Excel, XML, SPSS, or Google Sheets.

> Topics: Personal Data, IP Address, Right of Access, Controllers

### ¶83

While this export mechanism allows for the retrieval of basic participant response data, it does not support access to: • Personal data relating to Qualtrics user accounts (like researchers, administrators) • Technical error reports or diagnostic data • Administrative role-based access records • Platform configuration or permission management data • Internal system metadata associated with project use • The retention period of the data types In some cases, certain data are available to Brand Administrators for manual extraction. For example, they may be able to manually search authentication logs for a user’s email address to determine if and when a login occurred. A.5.5 Personal Data Request tool SURF obtained a new Qualtrics testing environment after the prevous testing environment expired after multiple discussions between both parties. The new environment has access to the Personal Data tool, which is designed to assist with compliance regarding data subject access and deletion requests. 62 The tool serves as a centralised search engine to locate personal information associated with specific email addresses across the institution’s Qualtrics platform.

> Topics: Personal Data, Retention Period, Storage Limitation, Right of Access

### ¶84

Records that can be located and/or deleted by email address include: • Survey responses (all recorded responses, including any incomplete survey responses that were closed) • Distributions (excluding personal/unique links) • Partial survey responses (responses in progress) 60 Qualtrics Data Processing Agreement, Article 4.6. 61 Exporting Response Data, URL: https://www.qualtrics.com/support/survey-platform/data-and-analysis-module/data/download- data/export-data-overview/ 62 Personal Data Tool, URL: https://www.qualtrics.com/support/survey-platform/sp-administration/data-privacy-tab/right-to-erasure/ 71/189 • Contacts (original and XM Directory) • Tickets • Participants • Users SURF’s technical testing of the tool revealed a lack of any form of logging. Personal data often resides in logs through technical identifiers like IP addresses, usernames, and email addresses captured during routine server requests or authentication events.

> Topics: Identification, IP Address, Processing Agreement, Personal Data

### ¶85

Application and error logs can be particularly risky, as they may accidentally record sensitive input data like full names, phone numbers, or even session tokens and passwords if a system crashes while processing a form. security audit logs link specific actions (such as survey access or account changes) directly to a user's identity. While the Personal Data tool is used to manage and export specific records, the broader platform infrastructure lacks any form of logging for routine researcher, administrator, or other platform user activity. Specifically, the following findings were noted: • Read Access and Modification Logs: The tool does not export detailed logs showing when researchers or users access, view, or modify survey response data. There is no transparent record of which individuals have interacted with specific data points within a project. • Authentication and Session Logs: Testing indicated that logs for user authentication and active sessions, tracking when and how researchers log in to the Qualtrics platform, are not accessible or provided within the tool.

> Topics: Personal Data, Monitoring, Identification, Access Controls

### ¶86

Example response data of Julian.rill@surf.nl (Brand Administrator) new testing environment (note: does not contain full scenarios as they were not retested): {"julian.rill@surf.nl":{"responses":[{"StartDate":{"Label":"Start Date","Value":"2026-01-15 09:21:48"},"EndDate":{"Label":"End Date","Value":"2026-01-15 09:22:21"},"Status":{"Label":"Response Type","Value":"IP Address"},"IPAddress":{"Label":"IP Address","Value":"178.229.191.249"},"Progress":{"Label":"Progress","Value":100},"Duration (in seconds)":{"Label":"Duration (in seconds)","Value":32},"Finished":{"Label":"Finished","Value":"True"},"RecordedDate":{"Label":" Recorded Date","Value":"2026-01-15 09:22:23"},"ResponseId":{"Label":"Response ID","Value":"R_2DnLj2WEHgY0xop"},"RecipientLastName":{"Label":"Recipient Last Name","Value":"Rill"},"RecipientFirstName":{"Label":"Recipient First Name","Value":"Julian"},"RecipientEmail":{"Label":"Recipient Email","Value":"julian.rill@surf.nl"},"ExternalReference":{"Label":"External Data Reference","Value":""},"LocationLatitude":{"Label":"Location Latitude","Value":52.2975},"LocationLongitude":{"Label":"Location Longitude","Value":5.1587},"DistributionChannel":{"Label":"Distribution Channel","Value":"gl"},"UserLanguage":{"Label":"User Language","Value":"EN- GB"},"Q1":{"Label":"do you want to share all your data with us please?\nhere are the terms:","Value":"Yes"},"Q1_DO_1":{"Label":"do you want to share all your data with us please?\nhere are the terms: - Display Order - No","Value":1},"Q1_DO_2":{"Label":"do you want to share all your data with us please?\nhere are the terms: - Display Order - Yes","Value":2},"Q2_Browser":{"Label":"Click to write the question text - Browser","Value":"Firefox"},"Q2_Version":{"Label":"Click to write the question text - Version","Value":146},"Q2_Operating System":{"Label":"Click to write the question text - 72/189 Operating System","Value":"Mac OS"},"Q2_Resolution":{"Label":"Click to write the question text - Resolution","Value":"1512x982"},"Q2_DO_1":{"Label":"Click to write the question text - Display Order - Browser","Value":""},"Q2_DO_2":{"Label":"Click to write the question text - Display Order - Version","Value":""},"Q2_DO_3":{"Label":"Click to write the question text - Display Order - Operating System","Value":""},"Q2_DO_4":{"Label":"Click to write the question text - Display Order - Screen Resolution","Value":""},"Q2_DO_5":{"Label":"Click to write the question text - Display Order - Flash Version","Value":""},"Q2_DO_6":{"Label":"Click to write the question text - Display Order - Java Support","Value":""},"Q2_DO_7":{"Label":"Click to write the question text - Display Order - User Agent","Value":""},"Q6_Id":{"Label":"sign here, or else... - ID","Value":""},"Q6_Name":{"Label":"sign here, or else... - Name","Value":""},"Q6_Size":{"Label":"sign here, or else... - Size","Value":""},"Q6_Type":{"Label":"sign here, or else... - Type","Value":""}}]}} A.5.5.1 DSAR Service Outcomes While Qualtrics did not provide an answer to the data SURF requested initially, they do operate a DSAR service for data which they identify as a data controller.

> Topics: Recipient, IP Address, Controllers, Processing

### ¶87

SURF submitted three distinct DSARs for the test actors used in our technical analysis. However, the results of these requests were unexpectedly sparse: • The requests for two of the three actors (Johanna Smit and Sander Noord) returned a “no data found” response within 1 day of submission of the request. • The request for the actor Julian Rill yielded only the full name and email address of the data subject. Qualtrics responded exactly one calendar month after the submission of the request. This outcome is concerning when contrasted with the extensive data processing activities outlined in Qualtrics' own documentation for data where Qualtrics acts as the data controller. Namely, the following categories of data were missing: • Website and Service Usage Analytics Data: Qualtrics extensively monitors how users interact with its websites and services for its own analytical purposes. The Cookie Statement explicitly mentions the use of Performance Cookies to “count visits and traffic sources so we can measure and improve the performance of our site”.

> Topics: Processing, Controllers, Personal Data, Cookies

### ¶88

These cookies are linked to unique identifiers that can be considered personal data. Our technical investigation shows evidence of this, showing data requests being sent to third-party analytics services such as: o Amplitude: An analytics platform used to track user behaviour. o Pendo: A product experience platform that analyses user engagement within the Qualtrics application. o Google Analytics: A widely used web analytics service. • Marketing, Advertising, and Profiling Data: Qualtrics engages in marketing and advertising activities that involve the processing of personal data to build user profiles. The Cookie Statement details the use of: o Targeting Cookies: These are used by advertising partners to "build a profile of your interests and show you relevant adverts on other sites". The policy explicitly states these are based on "uniquely identifying your browser and internet device" o Social Media Cookies: These cookies are capable of "tracking your browser across other sites and building up a profile of your interests".

> Topics: Marketing, Personal Data, Identification, Processing

### ¶89

The creation of an 73/189 interest profile for targeted advertising is a clear form of personal data processing that was absent from the DSAR response. • Support, Community, and Training Data: When users interact with Qualtrics' support and learning platforms, they generate personal data for which Qualtrics is the controller. The sources indicate several such platforms: o Qualtrics Support: Users can submit tickets for technical questions, which involves processing contact details and the content of the support query o XM Basecamp: This is an on-demand training portal where users can take courses and obtain certifications. User progress, course completion, and certification status are personal data controlled by Qualtrics. o Qualtrics Community: An online forum where users can ask questions and find answers. This involves user accounts, profile information, and any posts or comments made by the user. o It’s important to note that these platforms were not used by the testing actors as part of our technical analysis, and thus we did not expect to receive this category of data back in the DSAR responses. • General Account Metadata and Browser Information: Qualtrics' own documentation confirms the collection of various types of metadata associated with a user's account and session.

> Topics: Certification, Controllers, Personal Data

### ¶90

The Qualtrics' Cloud Security & Privacy Framework states that for their website, they “collect and analyze information of visitors, including the domain name, visited surveys, referring Uniform Resource Locators (URLs) and other publicly available information”. A.5.5.2 Summary of Observations SURF experienced significant friction in the DSAR process. When requests were submitted directly, Qualtrics declined to provide a substantive response, asserting that they only provide direct support for data where they act as the Controller. Instead, they redirected users to a self-service support page. While this manual export tool allows for the retrieval of basic structured survey data (including question responses, IP addresses, and timestamps) it fails to provide access to critical categories of personal data, such as: • User account metadata and administrative role-based access records. • Technical diagnostic data and error reports. • Internal system metadata and platform configuration logs.

> Topics: IP Address, Controllers, Personal Data

### ¶91

The introduction of the Personal Data Request tool in the newer testing environment offered a centralized search engine to locate records by email address, including survey responses, contacts, and user profiles. However, SURF’s technical testing highlighted a total lack of transparency regarding system logs. The tool does not export read-access or modification logs, meaning there is no record of who viewed or edited specific data points. Furthermore, authentication and session logs (which track when and how researchers access the platform) remain inaccessible. The results of the DSARs processed by Qualtrics in its capacity as a Controller were also notably sparse. Despite extensive documentation detailing the collection of website analytics (via services like Amplitude and Pendo) and the use of targeting cookies for profiling and advertising, the responses provided to test actors were minimal.

> Topics: Marketing, Transparency, Profiling, Controllers

### ¶92

For two out of three actors, Qualtrics returned a “no data found” response within 24 hours. The third actor 74/189 received only their name and email address after a full month of processing. This shows a gap between Qualtrics’ documented data processing activities and the data actually disclosed to subjects during a formal access request. 77/189 Qualtrics maintains a Recovery Time Objective (RTO) of 24 hours to resume normal operations and a Recovery Point Objective (RPO) of 4 hours. Qualtrics aims for minimal data loss through these defined backup and recovery measures for prompt maintenance or restoration of the Cloud Service with minimal disruption to customers. A.6.2.4 Encryption Key Management and Password Security Encryption keys for the platform are stored within a “secure software vault”, where they are themselves encrypted with key encrypting keys of “equivalent strength”. These keys are rotated at least annually or upon any qualifying event, such as a sign of compromise.

> Topics: Encryption, Processing, Security, Cloud Computing

### ¶93

Access to these secrets, including cryptographic keys and passwords, is strictly restricted based on the principles of least privilege and need-to-know, limited only to authorised personnel. Furthermore, passwords are never passed or stored in plain text; instead, they are hashed and salted using “industry-recognized hashing algorithms” to ensure their security. A.6.3 Artificial Intelligence and Machine Learning Qualtrics integrates artificial intelligence (AI) and machine learning (ML) capabilities into its platform to enhance data insights, automate processes, and to ensure data quality. Qualtrics operates under the National Institute of Standards and Technology (NIST) AI Risk Management Framework, which addresses the ethical, legal, and operational challenges posed by AI systems. Qualtrics claims robust governance and a commitment to an ethical AI program through documented policies, ethical guidelines, and rigorous compliance with data privacy and security regulations, such as ISO 42001.

> Topics: Artificial Intelligence, AI Governance Framework, Training Data Requirements, Data Governance for AI

### ¶94

An accountability structure involves key stakeholders and oversight committees to ensure AI systems are responsible and transparent. Qualtrics employs a combination of its own fine-tuned models and third-party models to deliver its Cloud Service. For its AI capabilities, Qualtrics lists several optional third-party sub processors, including Amazon Web Services (AWS), Google, LLC, Microsoft, and OpenAI, LLC, which provide services such as generative AI, data scrubbing, translation, and transcription. Qualtrics explicitly states that it anonymises and aggregates Customer Data before using it for any model training. Qualtrics states that it does not use raw Customer Data to train its own models, and equivalent protections are contractually established with third-party AI sub processors to prevent them from using customer data for their model training purposes. However, SURF has not been able to validate this claim.

> Topics: Processors, Cloud Computing, Controllers, Accountability

### ¶95

Anonymisation processes involve proprietary rules, machine learning techniques, and human intervention to identify and replace personal data with tags, while data points are grouped to further ensure anonymity. Human review is incorporated into this process to verify the accuracy and effectiveness of the anonymised data. For internally tuned models, AI functionality is typically supported within the same region as a Customer’s chosen data centre option, while third-party models are provided from the locations where those relevant sub processors operate. Brand Administrators can enable or disable these AI features for their users within the platform. A.6.3.1 Fraud Detection The Fraud Detection features are specifically designed to identify and mitigate threats to data quality stemming from automated bots and individuals submitting multiple responses, often referred to as "ballot stuffing".

> Topics: Processors, Anonymization, Controllers, Personal Data

### ¶96

Bot Detection uses Google's invisible reCaptcha technology to assign a score (Q_RecaptchaScore) to each response, which indicates the likelihood of it being 78/189 from a bot; a score of 0.5 or greater suggests a human, while less than 0.5 suggests a bot. This process operates without requiring any direct interaction from the respondent. Prevent Multiple Submissions (formerly "ballot box stuffing") utilises a cookie placed on the respondent's browser during their first survey session to identify them as a duplicate if they attempt to submit another response from the same browser and device without clearing cookies. When enabled, this feature sets the Q_BallotBoxStuffing embedded data field. Duplicate Detection further analyses responses after submission by examining device and browser metadata, including the respondent's IP address, to identify probable duplicates. It sets the Q_DuplicateRespondent embedded data field.

> Topics: IP Address, Cookies

### ¶97

To enhance these capabilities, Qualtrics may use Imperium, LLC, as an optional subprocessor, a company based in the USA. Imperium helps assess respondent metadata to detect fraud or repeated entries. In such cases, the system processes metadata like IP address, device/browser information, and bot detection scores. Processing activities like these are defined as fingerprinting, a technique used to uniquely identify a device by collecting and analysing its hardware and software characteristics. However, it is not transparent when this optional subprocessor is actually engaged. There is no clear indicator available to Brand Administrators or researchers about whether Imperium (or any other subprocessor) has been applied to a specific response. While there exists a platform setting “Automatically enable new AI features that utilise third-party processors” which is disabled by default, this only governs the automatic activation of future AI features.

> Topics: Processors, IP Address, Processing, Controllers

### ¶98

It does not clarify the current scope or trigger conditions under which Imperium is invoked. Qualtrics informed SURF that the vendor does not longer use Imperium as a subprocessor. 67 A.6.3.2 ExpertReview (Survey Quality) Beyond sensitive data, ExpertReview's purpose is to measure the overall data quality of survey elements such as questions, logic, and quotas, providing recommendations for improvement and predicting the quality of data that will be collected. This assists researchers in optimising their surveys for better outcomes. The system automatically evaluates the survey as it is being built. It performs checks against methodology best practices, identifies survey errors like impossible logic conditions, ensures compliance with WCAG accessibility requirements, and provides feedback on text clarity, conciseness, and grammatical errors. It can also predict the duration of a questionnaire based on average completion times for different question types.

### ¶99

ExpertReview also flags known issues such as the higher drop-off rates associated with matrix tables or mobile optimisation challenges. Furthermore, it is designed to detect “gibberish” in open text responses, which can indicate poor data quality. The data collected and analysed by ExpertReview includes the survey structure, question types used, logic applied, and text content within the survey. It also processes open text responses for quality assessment. However, it remains unclear whether the system relies on deterministic rule-based logic, more advanced machine learning techniques, or a combination of both. While the functionality 67 Qualtrics’ response from the 20 th of February 2026. 79/189 appears to rely primarily on straightforward logic, which would present minimal data protection concerns, this cannot be confirmed due to the absence of documentation or technical detail from Qualtrics’ end.

### ¶100

A.6.3.3 Text iQ and Natural Language Analysis Text iQ is designed to analyse large volumes of open-ended text responses to extract meaningful insights, primarily through sentiment analysis and automated topic tagging. This functionality helps researchers categorise and interpret qualitative feedback more efficiently. Text iQ uses natural language processing (NLP) to identify commonly co-occurring words and phrases to suggest relevant topics. The system assigns each comment an overall sentiment score (positive, neutral, or negative) and allows users to manually adjust these scores, which in turn can be used to refine the underlying model. In addition to global sentiment scoring, Text iQ can assign sentiment at the individual topic level. The data processed by Text iQ includes the raw open text responses submitted by participants. From this data, derived values such as sentiment classifications and topic tags are generated.

### ¶101

These outputs can be further analysed to assess, for example, the influence of specific themes on customer satisfaction or institutional performance. The NLP capabilities that Text iQ are based on stem largely from Clarabridge, a company acquired by Qualtrics in 2021. 68 Clarabridge is well known for its strength in natural language understanding, and it now operates as a Qualtrics affiliate. Clarabridge, Inc. (USA) is listed as a potential sub processor for personal data and may be involved in delivering NLP-related services within the broader Qualtrics Cloud platform. 69 Clarabridge’s tools support features like speaker identification, video-to-text transcription, and multi-modal analysis. A related functionality supports the analysis of video-based qualitative feedback which enables insights from respondent recordings. This feature includes speech-to-text transcription, speaker identification, sentiment analysis, and the generation of highlight reels summarising video segments.

> Topics: Processors, Controllers, Personal Data, Identification

### ¶102

The data collected includes the raw video itself, from which transcripts, speaker metadata, and sentiment scores are extracted. 70 It is important to highlight that Qualtrics does not disclose technical details about the models or algorithms that power these features. There is no documentation on the training data, model architecture, accuracy rates, or safeguards implemented to prevent bias or ensure robustness. As such, it is not possible to fully evaluate the fairness, explainability, or reliability of the AI or ML methods involved. A.6.3.4 Stats iQ (Statistical Analysis) The purpose of Stats iQ is to provide tools for preliminary statistical analysis within the Qualtrics platform for researchers to quickly understand relationships within their data through descriptive statistics, correlations, and regression analysis. While it does not build AI models 68 Meeting between Qualtrics and SURF on March 23rd, 2025 69 Qualtrics.

> Topics: Statistics

### ¶103

“Subprocessor List - Qualtrics,” October 17, 2024. https://www.qualtrics.com/subprocessor-list/. 70 Qualtrics, Audio & Video Editor, April 8 th 2026, URL: https://www.qualtrics.com/support/survey-platform/data-and-analysis- module/viewing-clipping-video-responses/#TranscriptSentiment 80/189 directly, it performs various statistical tests typically found in dedicated statistical software like SPSS or R. It can calculate the relative importance of different variables on a specified outcome. Qualtrics provides tutorials explaining the methods and steps involved in these analyses, and the results can be exported for further verification or use in other statistical tools. CoreXM offers a basic version of Stats iQ, while DesignXM includes more advanced features such as R integration and cluster analysis. The data collected and utilised by Stats iQ is the survey response data collected directly within the Qualtrics platform and uses quantitative and qualitative data types as determined by the questionnaire.

### ¶104

A.6.3.5 Translation Services By default, Qualtrics uses Google Translate and Amazon Translate translation services to perform automatic translations of survey questionnaires. 71 When a researcher initiates an automatic translation within the platform, such as by clicking the translation button in the survey editor, the content is transmitted to these third-party services for processing. Qualtrics allows enabling and/or disabling of the aforementioned translation services. 72 Although users have the option to upload their own manually translated files, and API-based integration with custom translation workflows is supported, 73 these alternatives require active configuration, are not part of the default experience and are not as easy to use and versatile as the default GUI-based translation services. The user who translates a column has the abilty to rename the new column to a descriptive field, indicating machine translation has happened.

### ¶105

This is the responsibility of the end user of the institution. 71 Translate Survey, URL: https://www.qualtrics.com/support/survey-platform/survey-module/survey-tools/translate-survey/ 72 Automatic Survey Translation, URL: https://www.qualtrics.com/support/survey-platform/survey-module/survey-tools/translate- survey/ 73 Qualtrics Survey API, URL: https://www.postman.com/qualtrics-public-apis/qualtrics-public- workspace/collection/bcd3rug/qualtrics-survey-api 81/189 Figure 5 Column renaming while translating Figure 6 Qualtrics warning for using Google Translate Figure 7 Enabling or disabling translation services (Google Translate, Amazon Translate) 82/189 A.6.3.6 AI Response Task (LLM Workflow Integration) Qualtrics Workflows function as an automation layer that triggers specific tasks based on platform events, such as low satisfaction scores or directory opt-outs. These workflows operate either as project-specific triggers within surveys and employee research or as stand-alone processes in the XM Directory.

### ¶106

The AI Response Task is a specific functional module within this engine that allows for the integration of generative language models into these automated sequences. It is used to summarise text, extract information, classify sentiment, translate content, or any other creative implementation akin to LLMs. Qualtrics discloses the specific Large Language Model (LLM) powering this task, Anthropic’s Claude Sonnet 74 . SURF’s prompt engineering diagnostics conducted for this assessment confirms that the system utilises a variant of Anthropic’s Claude. Technically, the task is executed using AWS (Amazon Web Services) as the subprocessor. Qualtrics maintains that data processed through this task remains within the Qualtrics ecosystem, distinguishing it from their separate OpenAI-based integrations. SURF did not further evaluate or analyse the AI Response task integration due to it being out of scope. 74 Artificial Intelligence Administration, URL: https://www.qualtrics.com/support/survey-platform/sp-administration/artificial- intelligence-ai-administration/#ListofThirdPartyAI 87/189 A.6.4.6 Customer Data For customer data managed within the Qualtrics platform, Brand Administrators have several configurable features aimed at privacy protection: • Anonymity Thresholds : Brand Administrators can set organisation-wide minimum response thresholds for data points and open-ended text comments.

### ¶107

This feature prevents data from appearing in dashboards if the number of collected responses falls below the defined threshold, thereby reducing the risk of identifying individuals when only a few responses are available for a given data point. This is a valuable technique but cannot be defined as anonymisation. It is however a valuable pseudonymisation technique that adds a layer of protection against direct re-identification through aggregation. Re-identification might still be possible if combined with other datasets or external information. • Pseudonymisation for Employee Experience (EX) Projects : Qualtrics offers an explicit option for EX licenses (part of Core XM and Design XM) to automatically pseudonymise all responses from the outset of a project. It is a measure to protect individual identities by masking direct identifiers. • General Anonymisation of Responses : Survey creators can choose to collect responses anonymously, meaning the system does not directly link responses to specific individuals.

> Topics: Pseudonymization, Anonymization, Identification, Security

### ¶108

Additionally, a survey option exists to automatically hide personal identifiable data such as IP addresses, location, and contact information once responses are submitted. This option is not enabled by default, however. Qualtrics' system is designed to scan and detect contact information even within user-defined questions, not solely relying on predefined templates. While Qualtrics states its ability to detect such information in custom fields, the underlying algorithms and their effectiveness against diverse inputs or sophisticated attempts at obfuscation are not fully transparent to the institutions. Please also refer to A.6.5. • Anonymisation Policy : Qualtrics also provides an Anonymisation Policy tool within the platform’s Retention Policy settings, which allows administrators to define rules for the automatic anonymisation of stored responses after several configured days have passed since the creation of the survey or the response.

> Topics: IP Address, Anonymization, Identification

### ¶109

This is a scheduled process distinct from initial survey configuration. This policy can only anonymise built-in survey fields, such as name, email address, contact ID, IP address, and latitude/longitude (location information). 88/189 A.6.5 Sensitive Data Policy The primary purpose of the Sensitive Data Policy feature is to protect respondent’s privacy by identifying and preventing the collection of sensitive data. Qualtrics analyses input text in open text questions to flag detected personal data, such as email addresses or phone numbers. For highly sensitive data, like credit card numbers or Social Security Numbers (BSN), Qualtrics' system is designed to prevent their input or recording, and if such data is somehow collected, it may be automatically redacted (replaced with asterisks), meaning it is hidden and irretrievable. 78 The Sensitive Data Policy is integrated with ExpertReview, a digital survey reviewer that flags questions violating privacy policies established by the Brand Administrator.

> Topics: IP Address, Personal Data

### ¶110

The detection mechanism uses simple regular expressions (RegEx), which is a sequence of characters that forms a search pattern. It is a tool used in computer programming, text processing, and data validation to search, edit, and manipulate text strings based on specific rules. In this case, Qualtrics uses RegEx to detect strings of data corresponding to personal data. It is important to mention that Qualtrics considers itself as a data processor for all the data processed. 78 Qualtrics. “Flag Survey Responses that Provide Sensitive Information.” Accessed July 3, 2025. https://www.qualtrics.com/support/survey-platform/sp-administration/data-privacy-tab/compliance-assist/#FlagSurveyResponses. 89/189 Figure 11 Sensitive Data Policy Set-up Brand Administrators can define specific Sensitive Data Policies by setting up topics and requirements, such as a credit card number being a sequence of 12 to 19 digits.

> Topics: Processors, Controllers, Processing, Personal Data

### ¶111

These policies can be tested before surveys are implemented to ensure they function as intended. Qualtrics also employs a Data Loss Prevention Program that includes email filtering rules designed to block sensitive data. The data collected and processed by this feature includes the input text from open text fields. 90/189 Figure 12 Configuring topics for Sensitive Data Policy The current implementation does not support Dutch-specific identifiers. Our technical testing revealed that Dutch mobile phone numbers and the Dutch BSN (burgerservicenummer) were not flagged or detected. As a result, these identifiers may be collected without triggering any alerts or redactions. However, educational institutions using Qualtrics can create custom topics within the Sensitive Data Policy using RegEx. 79 This allows administrators to manually configure detection patterns for country-specific formats, such as Dutch national identifiers or phone number structures.

> Topics: Education, Identification

### ¶112

Qualtrics does not publish accuracy metrics for its Sensitive Data Policy detection mechanism. This includes the absence of any stated precision, recall, or false positive/false negative rates for their predefined detection policies. As a result, the reliability of the detection system, particularly in edge cases or with domain-specific terminology, remains opaque. SURF is therefore unable to fully assess the risk of false negatives, where sensitive data may go undetected, or false positives, where non-sensitive data may be incorrectly flagged or redacted. Additionally, a process that supports feedback (as part of a feedback loop) or complaints about the accuracy of this service are not provided. 79 Qualtrics. “Importing Custom Topics.” Accessed July 3, 2025. https://www.qualtrics.com/support/survey-platform/sp- administration/data-privacy-tab/importing-custom- topics/?utm_medium=Admin&utm_source=product&utm_campaign=ImportingCustomTopics&utm_content=. 91/189 A.6.6 Logging Policies Qualtrics operates a layered logging framework designed to support the performance, security, and regulatory posture of its cloud-based service.

### ¶113

This framework is bifurcated into two main categories: internal system and performance logs, which are strictly controlled by Qualtrics itself, and user-specific activity logs, which are partially exposed to educational organisations. A.6.6.1 Internal System and Performance Logs At the platform level, Qualtrics maintains a log of internal system and performance events. These logs are designed to capture technical metrics related to infrastructure health, service integrity, and operational anomalies. According to Qualtrics, system logs typically record metadata such as the IP address of the requestor, the protocol used, request and response details, and similar low-level information. Events of interest, such as user logins, account management activities, privilege escalations, and other system-level actions, are also logged. Importantly, Qualtrics states that customer response data is excluded from these logs.

> Topics: IP Address

### ¶114

They are not intended to record or expose user-submitted content or survey data. The logs are ingested into a Security Information and Event Management (SIEM) system configured in a write-once- read-many mode, designed to prevent tampering. Live system logs are retained for a minimum of 90 days, during which they are accessible to Qualtrics' internal teams for incident response. Archived logs are kept for up to eighteen months in a compressed state to support post-incident investigations. However, none of these internal logs are made available to Qualtrics customers and they also haven’t been made available to SURF. Institutions using the platform have no ability to view, query, or retrieve this data, despite the fact that some of it may pertain to their own users and administrative actions. Only a limited subset of activity data is surfaced to customers via the platform’s user interface or API endpoints.

### ¶115

A.6.6.2 User-Specific Activity Logs Within each educational organisation’s Qualtrics environment, the platform has user-specific logging, aimed primarily at Brand Administrators and Division Admins. These activity logs track a range of interactions and user actions to help institutions manage access, monitor use, and audit data operations. Each log entry typically includes a timestamp (recorded in the user's time zone), user ID or username, IP address, session ID, Brand ID, and a categorised event label. In some cases, more granular information is captured. For example, the ID of a permission that was modified or the method of authentication used during login (like SAML-based Single Sign-On). The logs cover a wide range of event types, including but not limited to: • Administrative operations: Proxy logins, permission changes, brand configuration updates, survey approvals, and EX pseudonymisation activities. • Dataset interactions: Exporting recorded or in-progress responses, single response views, and general data section access. • Project and directory actions: Cloning projects, modifying directory settings, and updating EX programmes. • API usage: Calls made to or from the API interface by authenticated users. 92/189 • Authentication events: Session creation, login origin URL, platform (browser and OS), and location data. • User access control and participant management: Password resets, participant imports and exports, and updates to participant metadata.

> Topics: Pseudonymization, IP Address, Access Controls, Security

### ¶116

Brand Administrators can view and export logs across the entire organisation, while Division Admins are confined to their own domain. Logs can be filtered by user, time range, and event category, and are exportable in CSV or TSV format for offline analysis. Logs are retained for 60 days unless the institution takes deliberate steps to extract and preserve them. After this point, the data is deleted from the system entirely. 97/189 SURF technical investigation on Qualtrics revealed several cookies were placed on our end device that were not part of Qualtrics’ cookie notice. After SURF’s request, Qualtrics provided a brief explanation on these cookies 82 : • ASID : In-product cookie used in auxiliary account authentication flows (not website/surveys) • brandID : In-product cookie used in auxiliary account authentication flows (not website/surveys) • FreeAccountFirstLogin : In-product cookie utilized to display an onboarding flow the first time that a user logs into the product after signing up for a free account on the website. • MFAID : In-product cookie that supports the multifactor authentication “Remember Me” feature for product login • UDSBrandID : In-product cookie that stores the BrandID for use across various pages • UDSSessionID : In-product cookie that stores the active logged in sessionId • UDSSessionKey : In-product cookie that stores the active logged in session key • UR_BR8TOPIEA4UWI8U_PORTAL_MODE : In-product cookie that remembers whether a user is in a Purpose-Built App mode or in normal Qualtrics product • userType : In-product cookie that stores the user’s type for quick reference across product areas • XM-CLIENT-LOCATION : In-product cookie that helps direct the logged-in user to the right datacenter when using datacenter-agnostic product URLs • ct0 : Set by Twitter on their domain • guest_id : Set by Twitter on their domain • lang : Set by Twitter on their domain • li_rm : Set by Twitter on their domain • NnqIswCJkgMjUyVQqp7HIFtnTz%2F8M5nq93ROu9bRAIw%3D : <still under Qualtrics’ review> • QST : Intended to help with preventing multiple survey submissions.

> Topics: Cookies, Social Media, Identification, Access Controls

### ¶117

See this page: https://www.qualtrics.com/support/survey-platform/getting-started/browser-cookies • SFA : Secure file access cookie, allows a survey respondent to access their own uploaded files when the secure file access feature is enabled. See this page: https://www.qualtrics.com/support/survey-platform/getting-started/browser-cookies • 6eXYWGWH9v2iggymgaog7oxZi7%2FMPgDIAD07tqZnFZc%3D : <This information was not provided by Qualtrics > • QOGXdEijSK4rWed9l9TiT0CIfwoEgqw7vdkBnn9g9h8%3D : <This information was not provided by Qualtrics > • QualtricsLoginReferer : In-product login cookie, allows the user to be redirected to the page they were trying to access when they reached the login page • TNT-TICKETS-XSRF-SECRET : In-product security cookie for the Tickets feature • TNT-TICKETS-XSRF-TOKEN : In-product security cookie for the Tickets feature • UR_br8tOPIeA4UWi8u-DEFAULT-DASHBOARD-ID : In-product cookie to remember the default dashboard for a user to help with redirecting the user there automatically • WEIGHTING-XSRF-TOKEN : In-product security cookie for the Weighting feature • XSRF-SECRET : In-product security cookie for in-product login sessions 82 Qualtrics’ email correspondence to SURF on December 2 nd , 2025 98/189 Additionally, it was observed that no cookie consent banner was displayed to the users within any testing scenario (as described in Appendix 1).

> Topics: Cookies, Consent

### ¶118

Despite the absence of this consent mechanism, numerous cookies beyond those explicitly categorised as “Strictly Necessary” and “Functional” in the Cookie Statement were found to be placed on our device. This includes: • ak_bmsc : Found on www.xm-apps-static.com. While ak_bmsc is listed as Strictly Necessary for qualtrics.com, its presence on www.xm-apps-static.com means this specific instance is not covered by the Strictly Necessary category based on the statement's host-specific listing. • __cf_bm : Found on api.x.com, syndication.twitter.com, and x.com. Although __cf_bm is listed as Strictly Necessary for success.qualtrics.com, and also as a Social Media Cookie for g2crowd.com and g2.com, and a Functional Cookie for vimeo.com and app- sjp.marketo.com, its presence on api.x.com, syndication.twitter.com, and x.com means these instances are not strictly necessary as per the specified hosts in the statement. • JSESSIONID : Found on surftest.qualtrics.com and www.linkedin.com.

> Topics: Social Media, Consent, Cookies

### ¶119

The Cookie Statement explicitly lists JSESSIONID as a Performance Cookie only from nr-data.net. Therefore, its use on surftest.qualtrics.com and www.linkedin.com is not classified as Strictly Necessary by the statement. • bscookie : Found implicitly with x.com. The Cookie Statement classifies bscookie as a Targeting Cookie from www.linkedin.com. SURF requested more information about the cookies found during the technical research. Qualtrics responded that: ‘Cookie consent is only required for certain types of cookies, for example, those which are essential to the delivery of the service requested by the user do not typically require consent. Depending on how you plan to use the platform, you may need to update your cookie policy or provide additional notices as required in the specific regions within which you use the services. Your cookie policy may already permit the use of cookies in the manner in which the Qualtrics platform uses cookies so you will need to determine what changes/updates are necessary.’ 83 From the information provided by Qualtrics, one type of cookie was explained in the documentation: ak_bmsc. 84 83 Qualtrics feedback to first version of Part A of this DPIA from the 11 th of August 2025; Qualtrics, ‘Browser Compatibility & Cookies’ (Qualtrics Support, 10 October 2025) https://www.qualtrics.com/support/survey-platform/getting-started/browser-cookies/ accessed 10 October 2025’ ; ‘Qualtrics, ‘Website / App Insights Browser Cookies’ (Qualtrics Support, 10 October 2025) https://www.qualtrics.com/support/website-app-feedback/getting-started-with-website-app-feedback/website-app-feedback- browser-cookies/ accessed 10 October 2025. 84 Qualtrics, ‘Browser Compatibility & Cookies’ (Qualtrics Support, 10 October 2025) https://www.qualtrics.com/support/survey- platform/getting-started/browser-cookies/ accessed 10 October 2025. 99/189 A.8 Involved Parties This section includes all parties involved and categorise them by data processing, classifies these parties under the roles: controller, joint controller, processor, sub-processor, provider, data subject(s) and recipient.

> Topics: Cookies, DPIA, Marketing, Consent

### ¶120

When known, also this section will names which officers/departments within these parties will have access to which personal data. A.8.1 The Role of Education Institutions This DPIA examines the data processing in the context of schools and universities. Different from consumer users, educational institutions are data controllers in relation to the data they process about their students and employees, including disclosure of personal data to third parties. DesignXM enables the development of custom surveys and research studies tailored to specific educational objectives, such as curriculum evaluation, digital platform usability, and learning resource feedback. A DPA concluded between educational institutions and Qualtrics regulates the purposes and personal data collected based on the context in which the personal data have been collected. Moreover, institutions should have reasonable expectations of data subjects based on their relationship with the controller as an additional factor to be considered to provide a survey platform for the data subjects. 85 Educational institutions are data controllers, and determine the means and purposes of the data processing.

> Topics: Controllers, Personal Data, DPIA, Processing

### ¶121

This is confirmed by Schedule 1 of the publicly available DPA and Annex A of the SURF model DPA, where educational institutions include the details of data processing. A.8.2 The Role of Qualtrics Under the various documentation of Qualtrics Privacy policy,including the data processing agreements, GTC, Customer is the data controller of personal data inputted into Qualtrics DesignXM by their End-Users. Qualtrics explains that education organisations determine the purpose of using the products and services, and for which the system is used. Qualtrics, on the other hand, acts as a processor and on behalf of the Customer. Qualtrics provides the software and technical infrastructure for the system. According to the clauses outlined in the DPA and Global DPA, the customer acts as a controller with respect to the purposes and means it has determined; Qualtrics is a processor. However, throughout the technical research and documentation findings, SURF observed that Qualtrics processes the Customer’s personal data beyond the instructured purposes from the education institutions: anonymisation and training LLM based on anonymised and aggregated data.

> Topics: Controllers, Processors, Processing, Anonymization

### ¶122

SURF asked for the confirmation from Qualtrics about its role regarding the data processing activities. Qualtrics’ answer is: ‘Qualtrics acts as the data processor at all times, please point them to Schedule 1 of our DPA found in Exhibit A of our terms here - the purpose of our processing is as follows "The purpose of the transfer is to provide and support the Cloud Service and any associated services. Qualtrics and its Subprocessors may support the Cloud Service data centers remotely.’ 86 85 European Data Protection Board, Guidelines 1/2024 on Processing of Personal Data Based on Article 6(1)(f) GDPR (European Data Protection Board, 8 October 2024) https://www.edpb.europa.eu/system/files/2024- 10/edpb_guidelines_202401_legitimateinterest_en.pdf accessed 30 July 2025, page 11. 86 Qualtrics answer to SURF’s question from the 11 th August 2025. 101/189 Genesys USA Contact center support services.

> Topics: Processing, Processors, Controllers, Personal Data

### ¶123

IBM Cloud USA Data hosting facilities. InfoCepts, LLC India Customer Service Centers for Support. Wiz USA Cloud security management. Table 12 Mandatory Subprocessors A.9 Interests in Data Processing This section outlines the (potential) interests of Qualtrics and the educational institutions. However, it does not address the fundamental data protection rights and interests of the data subjects. An analysis of how these rights interact with and relate to the interests of Qualtrics and the education organisations is provided in Part B of this DPIA. A.9.1 Interests of Education organisations Educational institutions have an interest in data-driven decision-making and fostering continuous institutional improvement. They use Qualtrics XM as part of their research and feedback ecosystems to achieve this. The platform enables the efficient distribution of large- scale surveys, facilitates usability testing, and supports the collection and analysis of both qualitative and quantitative data from students, staff, and other stakeholders.

> Topics: DPIA, Education, Personal Data

### ¶124

They also have an interest in improving student engagement, academic satisfaction, and staff well-being, since these things are critical to institutional success. With actionable insights derived from experience data, universities and schools want to identify areas of improvement, respond proactively to concerns, and implement targeted initiatives to improve student retention, academic outcomes, and employee satisfaction. 89 Furthermore, they have an interest in carefully handling personal data, safeguarding privacy and complying with data protection laws. A.9.2 Interests of Qualtrics Qualtrics’ interest in the Dutch education sector is driven by a mix of commercial opportunity, brand positioning, product development, and long-term institutional value. Serving this sector not only brings revenue but also enhances Qualtrics’ credibility and competitive edge in the broader European public and academic markets.

> Topics: Personal Data

### ¶125

In order to determine the scope of the DPIA, SURF sent a survey to education institions. The survey showed that the majority of education institutions use Qualtrics. 89 Qualtrics, ‘Student & Staff Experience Management for Education’ (Qualtrics) https://www.qualtrics.com/education/accessed 30 July 2025. 102/189 A.9.3 Interests of data subjects Data subjects such as students, faculty, and staff have several legitimate interests in the context of data collection and experience management conducted through Qualtrics XM. The most foundational interest is that data subjects have a strong interest in the secure handling of personal data. They expect transparency and control of their personal data. Additionally, the feedback from data subjects contributes to improvements in curriculum design, student services, academic support structures. Additionally, some of the SURF members expressed the concern that this vendor occupying a monopolistic position on the market. 90 90 SURF survey results from February 2025. 103/189 A.10 Processing Locations The GDPR restricts transfers of personal data to countries outside the EEA unless adequate protection is ensured.

> Topics: Legitimate Interest, Personal Data, Transparency, DPIA

### ¶126

This can be achieved through an adequacy decision by the European Commission or, in its absence, by using safeguards such as Standard Contractual Clauses (SCCs). Multinational organisations may also use Binding Corporate Rules (BCRs) for intra-group data transfers. Qualtrics does not have BCRs. However, it relies on the SCCs between Qualtrics and education institutions (Customers), and between Qualtrics and its subprocessors. SCCs are legitimate to transfer personal data based on Qualtrics’ self-assessment, and without obtaining the EDPB’s approval decision as needed for the BCR to have a long-term compliance framework. 91 In case of Qualtrics, the transfer in based on the SCCs and are governed by the EU SCC mentioned in Schedule 3 of the DPA. The subprocessors and the transfers that take place are the following 92 : 1. Mandatory subprocessors : USA and India. 2. Mandatory Subprocessors Providing Content Delivery Network Services: USA. 3.

> Topics: International Transfer, Privacy Shield, Personal Data, Codes of Conduct

### ¶127

Optional Subprocessors Offering Technical Functionality: USA, Czech Republic, Ireland. 4. Optional Subprocessors Offering Professional Services: Canada, Hong Kong, Australia, Israel, USA, Italy, France, Australia, Brazil, Oman, Japan, Chile, South Korea, New Zealand, Germany, Taiwan, India, UK, Spain, Santiago de Chile, New Zealand, Colombia. A.10.1 Adequacy decision An adequacy decision means that the country in question has a level of protection comparable to that applied within the EEA. Currently, there are adequacy decisions with respect to Andorra, Argentina, Brazil, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, the United Kingdom under the GDPR and the LED, the United States (commercial organisations participating in the EU-US Data Privacy Framework) and Uruguay. On 10 July 2023, the European Commission issued a renewed adequacy decision for the US.

> Topics: Privacy Shield, Law Enforcement, International Transfer

### ¶128

As a result, the US is considered to have an adequate level of data protection, and European organisations are allowed to transfer personal data to US based cloud service providers without any additional protective measures, provided that the importing organisations have registered themselves for these specific services, as a participant in the Data Privacy Framework. As mentioned in Privacy Data Sheet, Qualtrics is self-certified under the EU-US Data Privacy Framework. 93 91 European Data Protection Board, ‘Approved Binding Corporate Rules’ (Our Work & Tools: Accountability Tools)https://www.edpb.europa.eu/our-work-tools/accountability-tools/bcr_en accessed 30 July 2025. 92 Qualtrics, ‘Qualtrics Subprocessor List’ https://www.qualtrics.com/subprocessor-list/ accessed 30 th January 2026. 93 United States Department of Commerce, ‘Data Privacy Framework List’ (Data Privacy Framework, updated July 2025)https://www.dataprivacyframework.gov/list accessed 30 July 2025. 104/189 The new EU-U.S. data transfer agreement does not limit the authority of U.S. law enforcement agencies to compel disclosure of personal data belonging to Dutch customers under the U.S.

> Topics: Supervision, Privacy Shield, Cloud Computing, Personal Data

### ¶129

CLOUD Act (Clarifying Lawful Overseas Use of Data). This legislation was specifically designed to enable access to data stored in data centers located outside the United States, including within the EU. The CLOUD Act extends the jurisdiction of U.S. courts to all data controlled by U.S.-based companies, regardless of where that data is physically stored. As the European Parliament notes in its opinion on the Data Privacy Framework: "the EO [Executive Order from the President, added by Privacy Company] does not apply to data accessed by public authorities via other means, for example through the US Cloud Act or the US Patriot Act, by commercial data purchases, or by voluntary data sharing agreements." 94 A.10.2 Standard Contractual Clauses For educational institutions whose use of Qualtrics XM involves the transfer of personal data from the European Economic Area (EEA), the United Kingdom, or Switzerland to countries outside these jurisdictions, Qualtrics relies on established legal mechanisms to ensure adequate protection of personal data.

> Topics: Education, Privacy Shield, Cloud Computing, Personal Data

### ¶130

Qualtrics primarily uses the Standard Contractual Clauses (SCCs) for the subprocessors where the DPF does not apply. 95 Standard Contractual Clauses (SCCs) are incorporated into its DPA and serve to safeguard data when it is transferred from Qualtrics LLC to the United States or other non-EEA affiliates. Qualtrics provides a self-service platform for customers to collect and process personal data, acting as a data processor while the customer serves as the data controller. Since Qualtrics Cloud Services involve international data transfers to countries without adequate protection, SCCs are used to ensure compliance and safeguard personal data. 96 If the Contractor is not in a third Country, it enters Module 3 of the SCCs with each Subprocessor and ensures that Subprocessors do the same when acting as data exporters. Similarly, if Qualtrics is not in a Third Country but subject to GDPR or other SCC requirements, it enters into SCCs with the Contractor for relevant data transfers. 97 Overall, Qualtrics relies on Module 2 (controller-to-processor) and Module 3 (processor-to-processor) of the New SCCs, since it only acts as a processor in its cloud services according to the DPA, and a controller for Qualtrics’ own purposes. 98 94 European Parliament, ‘Adequacy of the Protection Afforded by the EU–US Data Privacy Framework’ (European Parliament, 11 May 2023) https://www.europarl.europa.eu/doceo/document/TA-9-2023-0204_EN.html accessed 10 October 2025. 95 Qualtrics, ‘Standard Contractual Clauses Update’ (Qualtrics, last updated c 3 years ago) https://www.qualtrics.com/scc- update/ accessed 30 July 2025. 96 Qualtrics, ‘Standard Contractual Clauses Update’ (Qualtrics, last updated c 3 years ago) https://www.qualtrics.com/scc- update/ accessed 30 July 2025. 97 Qualtrics, Qualtrics Contractor Data Processing Agreement (CDPA) (Qualtrics, last revised 15 March 2024)https://www.qualtrics.com/cdpa/ accessed 30 July 2025. 98 Qualtrics, ‘Standard Contractual Clauses Update’ (Qualtrics, last updated c 3 years ago) https://www.qualtrics.com/scc- update/ accessed 30 July 2025. 105/189 SCCs are crucial for Qualtrics.

> Topics: Controllers, Processors, Processing, International Transfer

### ¶131

Qualtrics office and support personnel maintains the platform in the EU but also outside the EU. The functions for the data processing outside of the EU include engineering, customer support, customer successfor third party services (mandatory) in third countries such as USA and India. 99 According to the EDPB (European Data Protection Board) guidelines, ‘the SCCs and are sufficient to ensure that the level of protection guaranteed by the GDPR is not undermined.The data exporter and importer need to ensure that additional clauses cannot be construed in any way to restrict the rights and obligations in the SCCs or in any other way to lower the level of data protection.’ 100 Qualtrics SCCs describe the transfers including the description of the parties, transfers, and description of the competent supervisory authority, includes security measures, and subprocessors. This gives an opportunity for educational institutions to provide for a sufficient level of data protection and comply with the principle of accountability in theory.

> Topics: Supervision, Supervisory Authorities, Education, Security

### ¶132

Additionally, clauses for the ‘Transfers outside of the European Economic Area’ are mentioned in the Schedule 1 to the DPA. This the place where an education institution gives the processor (Qualtrics) specific permission for the following transfers to third countries and includes additional security measures in place. A.11 Legal and Policy Framework The ePrivacy Directive significantly affects how organisations process personal data in the context of electronic communications. It complements the GDPR, providing more specific rules around privacy in the digital environment. This section elaborates in more detail. Additionally, this chapter will examine legally binding orders directed to Qualtrics and explore the internal procedures the company follows when responding to such requests. A.11.1 ePrivacy Directive Certain rules from the current ePrivacy Directive apply to the storage of information on, and retrieval of that stored information from, browsers with pixels and cookies and similar technologies such as tracking pixels.

> Topics: Telecommunications, Cookies, Processors, Controllers

### ¶133

Consent is required prior to the retrieval or storage of information on the devices or browsers of end users, unless one of the exceptions applies, such as the necessity to deliver a requested service, or the necessity for the technical transmission of information. The current ePrivacy Directive also includes rules on the confidentiality of data from the information provided by Customers, and on communication behaviour. Article 5(1) obliges Member States to guarantee the confidentiality of communications and related traffic data via public communications networks and publicly available electronic communications services. 99 Qualtrics, ‘Qualtrics Subprocessors’ (Qualtrics, published c 5.2 years ago) https://www.qualtrics.com/subprocessor-list/accessed 30 July 2025. 100 European Data Protection Board, ‘Recommendations 01/2020 on Measures that Supplement Transfer Tools to Ensure Compliance with the EU Level of Protection of Personal Data’ (European Data Protection Board, 18 June 2021) https://www.edpb.europa.eu/system/files/2021- 06/edpb_recommendations_202001vo.2.0_supplementarymeasurestransferstools_en.pdf accessed 10 October 2025, page 23. 106/189 Article 6(1) obliges providers of publicly available telecommunications services to erase or make the traffic data anonymous as soon as they are no longer needed for the purpose of the transmission of the communication.

> Topics: Telecommunications, Personal Data, Cookies, Direct Marketing

### ¶134

Although the confidentiality rules in the ePrivacy Directive originally only covered classic telephony and internet providers, the scope was expanded significantly. Since the European Electronic Communications Code (EECC) became applicable law (21 December 2020) 101 , the confidentiality rules apply to all over-the-top communications services. In case of Qualtrics, the cookies were collected even before the end-user pressed on ‘Consent button’ before logging in. Therefore, Qualtrics starts setting the cookies the moment a user lands on the homepage before the user has interacted with a cookie banner. This goes against Article 5(3) of the ePrivacy Directive. A.11.2 Transparency report The EU–US Data Privacy Framework supplements these rules by establishingsafeguards to protect personal information transferred between the European Union and the United States. It aims to ensure that any data shared for the purposes of preventing, investigating, detecting, or prosecuting criminal offences is handled in a manner that respects fundamental privacy rights.

> Topics: Cookies, Telecommunications, Transparency, Privacy Shield

### ¶135

A requesting country may use evidence or information from the requested country only for criminal investigations, urgent public security threats, or closely related non-criminal proceedings. Use for other purposes is allowed only if the data is public or the requested country gives prior consent. 102 Additionally, Article 48 GDPR states that any judgment or decision from a third-country authority requiring a controller or processor to disclose personal data is not automatically enforceable in the EU. Qualtrics does not publish transparency reports about government requests publicly. However, the clause 4.2 DPA Processing on Legal requirements states: ‘ Processing on Legal Requirement. Qualtrics may also process Personal Data if required to do so by applicable law, in which case Qualtrics will notify Customer of that legal requirement before processing unless that law prohibits such notification.’

> Topics: Controllers, Processors, Transparency, Law Enforcement

### ¶136

SURF asked Qualtrics to clarify this statement. The explanation we received from Qualtrics was the following: ‘ Qualtrics will only comply with binding orders of governmental entities that have jurisdiction over Qualtrics or as otherwise required by law. Like many other technology companies, Qualtrics may occasionally receive a request from a law enforcement or other government agency seeking access to certain data, including access to data belonging to a customer .’ 103 101 Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code, L 321/36, 17 December 2018, URL: https://eur-lex.europa.eu/legal- content/EN/TXT/PDF/?uri=CELEX:32018L1972&from=EN 102 European Union, ‘Agreement with the United States on Mutual Legal Assistance’ (EUR-Lex) https://eur-lex.europa.eu/EN/legal- content/summary/agreement-with-the-united-states-on-mutual-legal-assistance.html?fromSummary=28 accessed 30 July 2025. 103 Qualtrics answers to SURF questions from the 10 th June. 107/189 Furthermore, Qualtrics explains that it complies with binding orders from authorities, however, shares the statistics with their customers only with regard to: Compliance with binding orders : Qualtrics' position is to only comply with binding orders of governmental entities that have jurisdiction over Qualtrics or as otherwise required by law.

> Topics: Supervision, Telecommunications, Public Authority, Statistics

### ¶137

This applies to requests from law enforcement or other government agencies seeking access to certain data, including data belonging to a customer. Notification to customer : Upon receiving such a request, Qualtrics will notify Customer of that legal requirement before processing. This notification is done in writing, and email is permitted. Qualtrics will provide reasonable written notice to allow the Customer to seek a protective order or other appropriate remedy. This notification will occur unless that law prohibits such notification on important grounds of public interest. Limiting disclosure : Qualtrics will only disclose such information as is required by the governmental entity or otherwise required by law. Confidential treatment : Qualtrics will use commercially reasonable efforts to obtain confidential treatment for any confidential information so disclosed. SURF asked for more information from Qualtrics about the meaning of ‘efforts to obtain confidential treatment’.

> Topics: Supervision, Public Authority

### ¶138

In the response to SURF, Qualtrics explained that: ‘ This is with regards to our compliance with binging orders of governmental entities that have jurisdiction of Qualtrics, this clause means that we use commercially reasonable efforts to obtain confidential treatment for any confidential information disclosed pursuant to the Request.’ 104 Under the GDPR, any transfer of EU personal data to non-EU countries must ensure an ‘essentially equivalent’ level of protection. The CLOUD Act allows the United Stated (U.S.) authorities to compel access to data held by the U.S. companies, even if that data is stored in the EU. ‘Qualtrics does not purposefully create back doors or other undocumented functionalities with the intention of unauthorized access to the system and/or data. Qualtrics will inform the Customer of any legally binding request from a public authority to access Customer data, to the extent Qualtrics is permitted to do so.’ 105 Such non-disclosure may also conflict with the principle of transparency, which requires that personal data be processed in a manner that is clear, open, and accessible to data subjects (Article 5(1)(a) GDPR).

> Topics: Personal Data, Transparency, Fairness & Transparency, Cloud Computing

### ¶139

Upholding this principle is essential to ensure individuals are informed about how their data is used, reinforcing both trust and legal compliance. 106 104 Qualtrics answers to SURF questions from the 11 th of August 2025. 105 Qualtrics answer to SURF questions from the 10 th of June. 106 Recital 39 – GDPR. It emphasizes that individuals should be aware of the collection and use of their personal data, including the extent and purpose of processing. This supports the idea that secrecy or non-disclosure can undermine transparency. 109/189 Backup Deletion Deletion from backup systems Additional 90 days to the original retention period of 90 days. Ensures recovery risk is minimised Final data erasure Full removal from active and backup systems Approximately 6 months total (90 + 90 days) Completes deletion lifecycle Table 13 Data backups For the backup data retention, Qualtrics specifies that the litigation hold, a formal instruction to ‘freeze’ certain information so it is not deleted or changed, is under Customer’s control.

> Topics: Storage Limitation, Transparency, Retention Period, Personal Data

### ¶140

‘Regarding a request for a litigation hold, because the Brand is under the Customer’s control, it is up to the Customer to implement a litigation hold. Qualtrics has the ability to disable the entire Brand, meaning the Customer will have no access. Even so, Qualtrics cannot typically legally represent anything related to a Brand’s usage or Data for litigation purposes.’ 110 Retention periods of the personal data processed on behalf of the Controller (education institutions) are mentioned in Schedule 1 DPA. This is based on the choice of the institions which retention period is used for any category of personal data together with the criteria to determine the period. SURF requested more information about the processes that allow Qualtrics handle different retention periods assigned by educational institutions. Qualtrics’ response is the following: ‘We process based off of customer instruction/activity within their brand(s).

> Topics: Retention Period, Education, Storage Limitation, Controllers

### ¶141

E.g. Customer A may have an automated retention period set for all of their data, customer B may manually delete their data and customer C may not delete their data at all until the agreement ceases. These preferences will be adhered to before our Backup Management program is in place and data is ultimately erased out of services.’ 111 110 Section ‘Backup Data Retention’ in Qualtrics’ Cloud Secuirty & Privacy Framework from April 2025. 111 Qualtrics’ answers to SURF from December 2025. 110/189 Part B Assessment of Lawfulness of Data Processing The second part of the DPIA assesses the lawfulness of the data processing. This part contains an assessment of the legal grounds of both the educational institutions and Qualtrics, the processing of special personal data, the application of purpose limitation, the necessity of the processing and the application of data subject’s rights. B.1 Legal Basis To comply with the GDPR, the processing of personal data must be based on one of the legal bases outlined in Article 6(1) of the Regulation.

> Topics: Personal Data, Storage Limitation, Retention Period, DPIA

### ¶142

Before addressing the applicable legal bases for the processing, it is first necessary to outline the context in which the processing occurs. This includes not only defining the roles of the parties involved but also examining the contractual framework that governs their relationship. B.1.1 Contractual context and role determination B.1.1.1 DPA concluded via Education institutions conclude two types of the DPAs through SURF DPA model: directly with Qualtrics and through the provider which distributes the Qualtrics products to educational institutions in the Netherlands. 112 The scope of the later agreement is ‘DAS uitvraag Online Collaboration tools, perceel 3 Polling&Survey tools’. 113 The role determination is undermined due to the fact that there is no defined relationship between the educational institution as controller and Qualtrics as processor according to the DPA. In this agreement, there is a direct agreement between the controller and , and not Qualtrics which does not correspond to the requirements of Article 28 GDPR.

> Topics: Processors, Controllers, Education, Processing Agreement

### ¶143

‘Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller.’ 114 EDPB states that the the processing agreement should be specific and directly address the controller-processor relationship. 115 The processor is ‘ ’ according to the agreement, together with Qualtrics. is the only contractual party who signs the agreement. This does not create a direct binding agreement with Qualtrics, or that the reseller’s agreement effectively binds Qualtrics to the controller’s instructions. In the agreement, there is the 112 , 113 Annex 4 Data Processing Agreement ‘Online Collaboration tools’ (based on SURF Model Data processing Agreement version 3.0 from January 2019), date 24 TH October 2023, page 2. 114 Article 28 GDPR. 115 EDPB, https://www.edpb.europa.eu/sites/default/files/consultation/edpb_guidelines_202007_controllerprocessor_en.pdf , page 4. 111/189 reference only to the ‘DAS uitvraag Online collaboration tool, perceel 3 Polling & survey tools’.

> Topics: Processors, Controllers, Personal Data, Processing Agreement

### ¶144

There is no reference to the names of the services that Qualtrics offers to the institution, but a general name of the services offered that the seller distributes to the education instituions. The issue of the service names was also experienced by SURF when the scope of the research had to be determined. Since this information could not be clearly derived from the agreement, SURF looked for the clarification directly from Qualtrics, and Qualtrics provided the necessary details of the services that educational institutions use. As identified by the EDPB: ‘Therefore, the processing agreement should not merely restate the provisions of the GDPR: rather, it should include more specific, concrete information as to how the requirements will be met and which level of security is required for the personal data processing that is the object of the processing agreement.’ 116 Therefore, if the agreement lacks the concrete and specific information, it should be provided to fulfill the principle of accuracy of the data processing.

> Topics: Education, Personal Data

### ¶145

Additionally, since the allocation of the responsibilities is not defined clearly and not linked directly to Qualtrics, the protection of rights and freedoms of data subjects as well as responsibility are jeopardized due to non-clear allocation of responsibility and liability of controller and processors. 117 Specifically, that Qualtrics was not mentioned in this agreement, although Qualtrics’ services are used. Therefore, for education institutions, it is important to draft a DPA with clear indications of the parties’ roles to the DPA agreement. B.1.1.2 Misalignment with the role allocation in Schedule 1 of the DPA, Privacy Policy and GTC According to the statements available publicly and Qualtrics’ responses to SURF, Qualtrics operates as a data agnostic platform. ‘ All Customer Data is considered highly confidential, treated equally, and protected using industry-best practices, regardless of whether it is sensitive or not.’ 118 However, following the technical research, SURF identified that there are cases of misalignment of the purposes of data processing activities with the role of Qualtrics.

> Topics: Controllers, Processors, Processing, Supervisory Authorities

### ¶146

In Privacy Policy, which is applicable only to Qualtrics’ website visitors and not Customers, it is mentioned that Qualtrics may process personal data for the purpose of Service development such as release, development, and upload of any fixes or upgrades to the Cloud services. The similar purpose is observed in Schedule 1 to the DPA where the vendor may process the transferred personal data for the ‘Release, development, and upload of any fixes or upgrades to the Cloud Service’. 119 116 European Data Protection Board, Guidelines 07/2020 on the concepts of controller and processor in the GDPR (July 2020) https://www.edpb.europa.eu/sites/default/files/consultation/edpb_guidelines_202007_controllerprocessor_en.pdf accessed 10 October 2025. page 32. 117 European Data Protection Board, Guidelines 07/2020 on the concepts of controller and processor in the GDPR (July 2020) https://www.edpb.europa.eu/sites/default/files/consultation/edpb_guidelines_202007_controllerprocessor_en.pdf accessed 10 October 2025. page 32. 118 Qualtrics’ responses to SURF questions from the 9 th of December. 119 https://success.qualtrics.com/rs/542-FMF- 412/images/Qualtrics%20GTC%20DPA%20%28for%20Online%29%20Template%20250523-MJR.pdf?version=0 112/189 In the GTC, there is a clause that ‘ Qualtrics or Qualtrics’ Affiliates may create analyses by using anonymized and aggregated information related to Customer’s use of the Cloud Service (“Analyses”).

> Topics: Controllers, Processors, Cloud Computing, Personal Data

### ¶147

120 This clause describes a processing activity. Placing this clause in the GTC rather than the DPA creates a misalignment with the The processing activity requires a legal basis such as the DPA framework. If the anonymisation happens before the analysis, the process of anonymizing is itself personal data processing. This process is governed nowhere in the DPA. Qualtrics explains that: ‘Qualtrics does not use raw Customer Data to train its own models. It uses anonymized and aggregated Customer Data for any model training purposes. Furthermore, Qualtrics has contractual agreements and specific configurations with third-party Large Language Model (LLM) providers (subprocessors) to ensure that Customer data shared with them will not be utilized for AI/LLM training purposes by the vendor or retained by them. for the purpose of "Service Development," Qualtrics only uses a subset of Customer Data (Anonymized and Aggregated Analyses) that no longer constitutes Personal Data, effectively preventing any "intersection" with its controller purpose of "research and development" which uses its own collected data.’ 121 Regarding the DPA, no clauses about restriction of further LLM training on anonymised personal data are mentioned.

> Topics: Anonymization, Processing, Controllers, Supervisory Authorities

### ¶148

The DPA with education institutions, Article 2.3.3, prohibits the processing for the benefit of the vendor or third-parties, or for advertising, or other purposes. No agreements were observed with education institutions about the LLM training. For the anonymisation, as was discussed in Section A.6.4, only few personal data categories are flagged and anonymised. The anonymisation technique excludes entrirely special types of personal data. Therefore, by processing personal data for its own purpose such as ‘Service development’, Qualtrics is processing beyond the instructions of the education institutions. Even if Qualtrics uses anonymisation techniques, the legal threshold for anonymisation is high. If the anonymisation technique fails or does not detect special categories of personal data to prevent re-identification, Qualtrics is processing personal data for its own strategic ends. Recital 26 of the GDPR provides that all means of reidentification that could reasonably be used must be taken into account, such as the nature and volume of data.

> Topics: Anonymization, Personal Data, Supervisory Authorities, Identification

### ¶149

Anonymisation is a processing activity in itself because according to Article 4 (2) GDPR: ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, 120 Qualtrics, ‘Qualtrics GTC DPA (for Online) Template’ (no date), Clause 3.4, https://success.qualtrics.com/rs/542-FMF- 412/images/Qualtrics%20GTC%20DPA%20%28for%20Online%29%20Template%20250523-MJR.pdf accessed 17 March 2026. 121 Qualtrics’s responses to the SURF questions on the 9 th December 2025. 113/189 disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.’ Therefore, Qualtrics should mention this in the Data Processing Agreement which is concluded with education institutions.

> Topics: Anonymization, Processing, Processing Agreement, Personal Data

### ¶150

B.1.1.3 Governing Law and Disputes Additionally, according to the Clause 12.10 ‘Governing Law and Disputes’, ‘ Agreement and any claims: The Agreement and any claims arising out of or in connection with the Agreement and its subject matter will be governed by and construed under the laws of the State of Delaware, without reference to its conflicts of law principles. ’ Even though, the GDPR strong enforcement applies regardless of the GTC terms, from the consumer law protection, it is not clear for the customer which terms and laws apply in case of a dispute. This might create jurisidictional disadvantage for the education institutions. Whereas consumers, in cross border disputes, can bring action in their own Member State of domicile or the seller’s. 122 The interplay between the GTC and mandatory EU law leaves customers in a state of legal uncertainty. The consumer law protection are weakened when the vendor defaults to Delaware law, where the transparency obligations are not the same as expected by education institutions.

> Topics: Transparency, Supervision

### ¶151

This creates a jurisdictional disadvantage for the education institutions. The GTC has reference to the Qualtrics Responsibilities such as ‘Providing support for the Cloud Services as referenced in the order form’. 123 It was mentioned in Section A.1.6Educational institutions’ order forms, that order forms mention special categories of personal data. This creates a risk to the transparency for the data subject; while the processing may occur across various regions, the governing jurisdiction established by the GTC is Delaware rather the Member State. This is due to the Order Form being referenced by the GTC which is governed by Delaware law. B.1.2 Legal grounds Article 6, paragraph 1(e) of the GDPR (Task carried out in the public interest). Institutions have a legal obligation to perform a public task, namely the organisation of education. In order to perform this task, institutions must draw up plans and schedules, and the processing of personal data is necessary to do so.

> Topics: Personal Data, Transparency, Processing, Cloud Computing

### ¶152

To invoke this basis, institutions must carry out a necessity test to demonstrate that the processing is necessary for the proper performance of 122 The Brussels I Regulation (Recast) Regulation 1215/2012, articles 17-19. 123 Qualtrcis General Terms and Conditions, Clause 3.2. 114/189 their public task. For the processing of data that is not necessary for their public task, institutions may be able to apply one of the following bases. 124 Article 6, paragraph 1(a) of the GDPR (Consent) To process users' personal data such as particular consent part of the surveys to process sensitive data, special categories of data, or even IP address, the consent should be requested from the user (data subject) via the platform. Among other things, this consent must be freely given to be valid as a basis under the GDPR. This means that the user must not suffer any adverse consequences from refusing consent.

> Topics: Personal Data, IP Address, Consent

### ¶153

Institutions must therefore provide users with sufficient information about the interactions in Qualtrics if they wish to explicitly consent to the services. Article 6(1)(b) of the GDPR (Performance of a contract) Processing that is not necessary for the performance of a public task may be necessary to perform a contract with students (e.g. an education contract) and/or employees (e.g. an employment contract). Here too, institutions must carry out a necessity test to demonstrate that the purpose of the contract cannot be achieved without the processing of personal data in question. 125 Qualtrics states that Customers are responsible fpr ensuring compliance specifically, accuracy and transparency. 126 However, the burden of compliance is shifted mainly to education institutions despite the DPA in place according to which the vendor should assist the Controllers with data processing activities.

> Topics: Processing, Personal Data, Transparency, Controllers

### ¶154

From the vendor’s side, there is no transparent and accessible data-to-purpose mapping, for instance, Records of Processing Activities (‘ROPA’) of Customers personal data. Without insight into which specific data categories are being used for concrete processing activites, the Customer may not fulfill its duty to inform data subjects or ensure data integrity. These aspects are absent from the definitions provided in the GTC. Specifically, under Article 28 GDPR as discussed by the EDPB: ‘When a processor processes data outside or beyond the controller’s instructions, and this amounts to a decision determining the purposes and means of processing, the processor will be in breach of its obligations and will even be considered a controller in respect of that processing in accordance with Article 28(10).’ 127 While the privacy policy draws a distinction between Customer data and ‘other information’ such as service usage data, account data, and marketing data, there is no information about the categories/list of personal data that Qualtrics processes on behalf of education institutions or as an independent controller.

> Topics: Processors, Controllers, Personal Data, Records of processing activities

### ¶155

For instance, account creation details, school setup information, 124 Wet open overheid, Wet open overheid (Stb. 2021, 358) https://wetten.overheid.nl/BWBR0005682/2025-01-01 accessed 10 October 2025. 125 Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) of the GDPR in the context of the provision of online services to data subjects , EDPB 126 Qualtrics’ feedback from the 21 st February 2026. 127 https://www.edpb.europa.eu/system/files_en?file=2023-10/EDPB_guidelines_202007_controllerprocessor_final_en.pdf , page 36. 115/189 contact data and certain log data (like IP addresses) appear in both. Common identifiers such as name and email address are mentioned in both the DPA and the ‘other information’ section of the privacy policy. This overlap between personal data and purposes of the processing blurs the line between the data processed on behalf of the institution and data processed for Qualtrics’ own purposes, making it difficult to clearly define the roles and responsibilities.

> Topics: Personal Data, IP Address, Processing, Supervisory Authorities

### ¶156

Article 6(1)(f) of the GDPR (Legitimate interest) Processing that is not necessary for the performance of a task carried out in the public interest may be necessary for the purposes of the legitimate interests pursued by the institution. In order to use this basis, it must be assessed whether institutions (1) have a legitimate interest, (2) the processing is necessary to pursue this interest, and (3) whether the interests of the institution outweigh those of the data subjects. 128 B.1.2.1 Legal grounds for Qualtrics B.1.2.1.1 Consent Consent can make processing of personal data lawful, if and to the extent that the purposes are specific (Article 6 (1) (a) GDPR). When processing has multiple purposes, consent should be asked for all of them separately. Article 4 (11) GDPR, defines ‘consent’ as meaning ‘any freely given, specific, informed and unambiguous indication of the data subject’s wishes which he or she, by a statement or by clear affirmative action, signifies agreement to the processing of personal data relating to him or her’.

> Topics: Legitimate Interest, Personal Data, Processing, Consent

### ¶157

The fact that education and research institutions are public sector organisations also makes it difficult to rely on consent for processing. In the context of Recital 43 of the GDPR, the EDPB explains: “ whenever the controller is a public authority, there is often a clear imbalance of power in the relationship between the controller and the data subject. It is also clear in most cases that the data subject will have no realistic alternatives to accepting the processing (terms) of this controller. The EDPB considers that there are other lawful bases that are, in principle, more appropriate to the activity of public authorities .” 129 Meanwhile, when Qualtrics acts as a processor, there is no obligation on Qualtrics to obtain the consent from customers. It is a direct responsibility of Controllers which stems from the agreement. However, Qualtrics may enhance its privacy by design choices to help its customers in obtaining valid consent from its data subjects.

> Topics: Controllers, Public Authority, Privacy by Design, Processors

### ¶158

For example, as was discussed in Section A.4.6.1, it was observed that the consent banner does not include an option to ‘Reject all cookies’. This will correspond to the practice of informed consent, where a user has a genuine freedom of choice to reject or accept the cookies: ‘Rejecting must be as easy as accepting’. 130 Whereas, Qualtrics elaborated the consent functionality as : ‘The process involves the Customer’s end users accessing Qualtrics' products via modern web browsers, with all access to the front-end 128 Autoriteit Persoonsgegevens, ‘Basis AVG: Grondslagen AVG Uitgelegd – Gerechtvaardigd Belang’ https://www.autoriteitpersoonsgegevens.nl/themas/basis-avg/avg-algemeen/grondslagen-avg-uitgelegd#grondslag-gerechtvaardigd- belang accessed 10 October 2025. 129 EDPB, Guidelines on consent, paragraph 3.1.1. 130 Judgment of the Hanover Administrative Court dated 19.03.2025 (10 A 5385/22) 116/189 Cloud Service using HTTPS (Hypertext Transfer Protocol Secure) and enforcing HSTS (HTTP Strict Transport Security).’ 131 B.1.2.1.2 Necessity for the performance of the contract The legal ground of necessity for the performance of a contract (Article 6(1)(b) GDPR) is limited to situations where the processing is strictly necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

> Topics: Personal Data, Consent, Legitimate Interest, Cloud Computing

### ¶159

This legal ground can be used in this situation. Because Qualtrics and educational instituions conclude a GTC and DPA. The DPA (the Qualtrics’ template) outlines the responsibilities, and even though there is a DPA in place, a more detailed and specific DPA should always be in place between educational institutions and Qualtrics for detailed compliance, especially when processing is done on behalf of a controller by a processor. 132 Since the GTC references and governs the Order Form, the data subjects special categories of data are governed by this agreement. Despite the absence of a direct agreement between the data subject and Qualtrics, the vendor’s contractual practice indirectly affects the individual’s data protection interests. Potentially, the special categories might fall outside of the DPA framework. B.1.2.1.3 Necessity to comply with a legal obligation Article 6 (1) (c) GDPR reads: “processing is necessary for compliance with a legal obligation to which the controller is subject” .

> Topics: Controllers, Processors, Education, Personal Data

### ¶160

There are four conditions that need to be met for this legal basis to be relied on: 133 • the legal obligation must be defined by EU or national law to which the controller is subject; • these legal provisions must establish a clear and specific obligation to process that personal data; • these provisions must at least define the purposes of the processing; • this obligation should be imposed on the controller and not on the data subject. If these criteria are not fulfilled, the processing operation cannot rely on the legal ground ‘to comply with a legal obligation’. According to the DPA, there is an obligation for the Processor to only cooperate with the request or order if the processor is legally obliged to do so and, where possible, the processor shall (judicially) object to the request or order or the prohibition to inform the controller about this or 131 Qualtrics’ responses to SURF questions from the 9 th December. 132 European Data Protection Board, ‘Process Personal Data Lawfully’ (EDPB SME Data Protection Guide) https://edpb.europa.eu/sme- data-protection-guide/process-personal-data-lawfully_en#toc-4 accessed 10 October 2025. 133 European Data Protection Board, ‘Process Personal Data Lawfully’ (EDPB SME Data Protection Guide) https://edpb.europa.eu/sme- data-protection-guide/process-personal-data-lawfully_en#toc-4 accessed 10 October 2025. 117/189 to follow the instructions of the controller. 134 Therefore, the lawful ground ‘necessary to comply with a legal obligation’ might be applicable for the data processing.

> Topics: Controllers, Personal Data, Processors, Supervisory Authorities

### ¶161

Therefore, for further processes due to the judicial request or orders, Qualtrics may become a controller with the legal ground of ‘ complying with a legal obligation to which the controller is subject ’. Qualtrics elaborated that this assessment will be entirely fact depdendent. 135 B.1.2.2 Legal grounds for educational institutions B.1.2.2.1 Consent Educational institutions should refrain from asking for consent from students and employees for the processing of their personal data. In view of the imbalance of power between students and educational institutions, consent can seldom be given freely. 136 Employees and students may not be free to refuse or withdraw consent for the processing of their personal data without facing adverse consequences. According to the GTC, Qualtrics puts the main responsibility on the customer to obtain consent from data subjects: ‘Customer will ensure that it has established all necessary lawful bases under Data Protection Laws to enable Qualtrics to lawfully process Personal Data for the purposes contemplated by the Agreement (including this DPA), including, as applicable, by obtaining all necessary consents from, and giving all necessary notices to, Data Subjects.

> Topics: Personal Data, Controllers, Education, Supervisory Authorities

### ¶162

Customer acts as a single point of contact for Permitted Controllers in accordance with this DPA. If Customer provides authorizations, consent, instructions, or permissions, these are also provided on behalf of any Permitted Controllers. If Qualtrics informs or gives notice to Customer, such information or notice is deemed received by Permitted Controllers, and Customer will forward such information and notices to the relevant Permitted Controllers.’ 137 In order to base the processing on the lawful gorund, education institution requests the consent for the processing from the data subject. Based on the technical and legal analysis conducted by SURF, there is more personal data being processed by Qualtrics that the data subject consented to such as location data. Qualtrics believes that this is up to the institution to provide the data subject with the relevant processing activities. 138 134 SURF model DPA “DAS uitvraag online collaboration tools, perceel 3 Polling & survey tools”.

> Topics: Personal Data, Processing, Controllers, Supervisory Authorities

### ¶163

Section 3.3.2.2. 135 Qualtrics’ feedback from the 21 st of February 2026. 136 Recital 49 GDPR: The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security. 137 Qualtrics, ‘Qualtrics GTC & DPA Template’ (Qualtrics Success, 25 May 2023) https://success.qualtrics.com/rs/542-FMF- 412/images/Qualtrics%20GTC%20DPA%20%28for%20Online%29%20Template%20250523-MJR.pdf?version=0 accessed 10 October 2025, section 2.2 of the GTC. 138 Qualtrics’ feedback from the 21 st of February 2026. 118/189 B.1.2.2.2 Necessity for the performance of a contract The legal ground of necessity for the performance of a contract (Article 6 (1) (b) GDPR) is limited to situations where organisations have contract with specific data subjects (such as an employment contract or an education agreement), and the processing is strictly necessary to perform the contract with such individual data subjects.

> Topics: Personal Data, Processing, Supervisory Authorities

### ¶164

The European Data Protection Authorities explain: “The controller should be able to demonstrate how the main object of the specific contract with the data subject cannot, as a matter of fact, be performed if the specific processing of the personal data in question does not occur. Thus, this ground can never be invoked by a party that does not have its own contract with that individual.” 139 If controllers want to rely on the ground of performance of a contract, the processing must pass the necessity and proportionality tests. In particular, the controller must assess whether the purpose for which the personal data are processed cannot reasonably be achieved in another way which is less prejudicial to the persons involved in the processing of personal data. 140 The CJEU has a strict interpretation of the ‘necessity’ requirement. In order for the processing of personal data to be regarded as necessary for the performance of a contract, within the meaning of that provision, the processing must be “objectively indispensable for a purpose that is integral to the contractual obligation intended for the data subject.” 141 The controller must therefore be able to demonstrate how the main subject matter of the contract cannot be achieved if the processing in question does not occur. 142 In the case of Meta vs Bundeskartellamt the CJEU considers: “The fact that such processing may be referred to in the contract or may be merely useful for the performance of the contract is, in itself, irrelevant in that regard.

> Topics: Personal Data, Processing, Controllers, Supervisory Authorities

### ¶165

The decisive factor … is rather that the processing of personal data by the controller must be essential for the proper performance of the contract concluded between the controller and the data subject and, therefore, that there are no workable, less intrusive alternatives. ” 143 The legal ground of contract cannot be invoked by organisations for the processing of personal data of data subjects that do not have a contractual relationship with that organisation. Furthermore, the educational institutions cannot invoke the legal ground of contract for the processing of personal data for purposes that are not necessary for the performance of the contract with each individual data subject. If the processing is not necessary to deliver what the contract promises, then an educational institution cannot rely on the contract to justify that processing. It must find a different legal basis such as consent or legitimate interest.

> Topics: Personal Data, Legitimate Interest, Processing, Controllers

### ¶166

Transparency is key: individuals must be informed about the use of Qualtrics, the purpose of data collection, and their rights. 139 EDPB Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects, paragraph 26 and 30. 140 ABRvS 20 September 2017, ECLI:NL:RVS:2017:2555. 141 CJEU 4 July 2023, ECLI: EU:C:2023:537 (Meta vs Bundeskartellamt) paragraph 98. 142 EDPB, Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects - version adopted after public consultation, 16 October 2019, nr. 13. URL: https://edpb.europa.eu/our-work-tools/our- documents/guidelines/guidelines-22019-processing-personal-data-under-article-61b_en. 143 CJEU 4 July 2023, ECLI: EU:C:2023:537 (Meta vs Bundeskartellamt) paragraph 99. 119/189 B.1.2.2.3 Processing is necessary for a task in a public interest or for the legitimate interests of the controller or a third party Article 6 (1) (e) GDPR reads : “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”.

> Topics: Personal Data, Legitimate Interest, Transparency, Processing

### ¶167

It follows from the CJEU ruling Meta vs Bundeskartellamt that a task of public interest within the meaning of Article 6(1)(e) GDPR is not sufficient as a basis for data processing in itself. Lawful processing of personal data on the basis of Article 6(1)(e) GDPR presupposes not only that a task of public interest is thereby performed, but also that the processing is based on EU law or on Member State law to which the controller is subject, and that that legal basis must meet an objective of public interest and be proportionate to the legitimate aim pursued (Article 6 (3) GDPR). 120/189 B.2 Special Categories of Data and Sensitive Data Qualtric mentioned in the responses to SURF, that it processes the customer data on behalf of the customers. The list of personal data was not provided to SURF, and SURF could not map the processing of personal data to separate processing activities based on the information stemming from Schedule 1 DPA.

> Topics: Processing, Personal Data, Controllers, Supervisory Authorities

### ¶168

It also was not possible to establish which special categories of personal data Qualtrics processes. The education institution determines which types of special categories of personal data are processed, and Qualtrics does not classify the data regardless the data is owned by the institutions. 144 However, sensitive data is discussed in Qualtrics’ documentation. Regarding the Sensitive Data Policy, Qualtrics explained that Customer should configure the policy to redact certain specific informatin, and customers can choose to create their own Sensitive Data Policy to identify BSN, for example. 145 In the Section A.6.5, SURF discussed that for highly sensitive data, like credit card numbers or Social Security Numbers (bsn), this data may be automatically redacted when it is collected. This means that it is hidden and irretrievable for both Qualtrics and education institutions. BSN and credit card do not fall within the categories of personal data mentioned in Article 9 GDPR such as personal data revealing racial or ethic origin, political opinions, religious or philosophical beliefs, or trade union memebrships.

> Topics: Types of Special Categories of Personal Data, Personal Data

### ¶169

However, bsn is linked to financial information such as account balances or assets, with the government. This classifies bsn as sensitive information. According to the Dutch Data Protection Auhority, it is only possible to use the bsn if the law states that an organisation is allowed to do so. 146 ‘For the government, the use of the BSN is regulated in Article 10 of the General Provisions Civil Service Number Act (Wabb). It states that government organizations may use the BSN if necessary to carry out their public task.’ 147 Therefore, the processing of BSN falls within the processing of the categories of sensitive personal data. 144 Qualtrics’ repsonse from the 21st February 2026. 145 Qualtrics’ response from the 27 th March, 2026. 146 Autoriteit Persoonsgegevens, ‘Voorwaarden gebruik BSN’ https://www.autoriteitpersoonsgegevens.nl/themas/identificatie/burgerservicenummer-bsn/voorwaarden-gebruik-bsn accessed 10 October 2025. 147 Ibid. 121/189 B.3 Purpose Limitation The requirement that the provision of information to, and communication with, data subjects is done in a “concise and transparent” manner means that data controllers should present the information/communication efficiently and succinctly in order to avoid information fatigue. 148 The principle of purpose limitation is that data may only be “collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1) GDPR not be considered to be incompatible with the initial purposes” (Article 5(1)(b) GDPR).

> Topics: Personal Data, Controllers, Processing, Identification

### ¶170

In essence, this means that a controller must specify a clear and specific purpose for collecting personal data and ensure that any further processing remains compatible with that original purpose. In its privacy policy, Qualtrics mentioned that: ‘We may process personal information using artificial intelligence (AI) technologies including generative AI, and we use this information for training machine learning models, natural language processing, large-language models and other relevant AI use-cases.’ 149 Indeed, during the technical research, we mentioned that Qualtrics processes personal data for its own purposes such as training of its AI and machine learning models. See Section on Internal Purposes. The anonymised or aggregated data is used for these purposes. Since the internal processes within Qualtrics are not transparent, SURF could only deduce the methods of anonymisation that Qualtrics implements.

> Topics: Artificial Intelligence, Controllers, Anonymization, Personal Data

### ¶171

Qualtrics offers several privacy-oriented features such as anonymity thresholds, pseudonymisation options, anonymous survey settings, and automated anonymisation policies. Many of the protections are optional, not enabled by default, or limited in scope (pseudonymisation vs. full anonymisation). Most critically, the platform’s method for detecting and removing customary personal data relies on proprietary algorithms whose workings and effectiveness remain unclear to users. As such, Qualtrics is not transparent in how it implements and enforces privacy and anonymisation measures. In order to determine if the purposes are compatible with the subsequent purpose, there should be a possible link between the purposes for which the personal data were collected and the purposes of the further processing evisaged. 150 However, SURF reviewed the agreements and observed that education institutions did not include the purpose to train AI models based on the anonymised data without confirming the technology used for the anonymisation and did not agree for the anonymisation of the personal data to train LLM in the agreements.

> Topics: Anonymization, Pseudonymization, Security, Personal Data

### ¶172

These purposes are not compativle with the purposes that education institutions instructed Qualtrics with according to the DPA. 148 European Data Protection Board, Guidelines on Transparency under Regulation 2016/679 (WP260rev01, 11 April 2018) https://www.edpb.europa.eu/system/files/2023-09/wp260rev01_en.pdf accessed 10 October 2025, page 7. 149 Qualtrics, “Privacy Statement” https://www.qualtrics.com/privacy-statement/ accessed 10 October 2025. 150 CNIL, ‘Sous-traitants : la réutilisation de données confiées par un responsable de traitement’ (8 June 2022) https://www.cnil.fr/fr/sous-traitants-la-reutilisation-de-donnees-confiees-par-un-responsable-de-traitement accessed 30 th January 2026. 122/189 B.4 Necessity and Proportionality The concept of necessity is made up of two related concepts, namely proportionality and subsidiarity. The personal data which are processed must be necessary for the purpose pursued by the processing activity.

> Topics: Transparency, Processing, Personal Data, Supervisory Authorities

### ¶173

Proportionality means the invasion of privacy and the protection of the personal data of the data subjects is proportionate to the purposes of the processing. Subsidiarity means that the purposes of the processing cannot reasonably be achieved with other, less invasive means. If so, these alternatives have to be used. Proportionality demands a balancing act between the interests of the data subject and the data controller. Proportionate data processing means that the amount of data processed is not excessive in relation to the purpose of the processing. If the purpose can be achieved by processing fewer personal data, then the controller needs to decrease the amount of personal data to what is necessary according to Article 5. B.4.1 Assessment of proportionality The key questions are: are the interests properly balanced? And does the processing not go further than what is necessary? To assess whether the processing is proportionate to the interest pursued by the data controller(s), the processing must first meet the principles of Article 5 of the GDPR.

> Topics: Controllers, Personal Data, Processing

### ¶174

As legal conditions they have to be complied with in order to make the data protection legitimate. Lawfulness The public documentations such as publicly available GTC, privacy policy, and private documentations like SURF model data processing agreement, and Trust Centre were reviewed by SURF to assess the lawfulness and legal grounds of the processing. Overall, Qualtrics relies on the ground of ‘necessary for the performance of the agreement’. Qualtrics bases their processing on the DPA between educational institutions and Qualtrics. However, due to the lack of the direct link concluded in a DPA between educational institution, reseller and Qualtrics, the legal ground may be not only directly applicable to a vendor. The lawfulness of the processing is based on the consent that data subjects provide for the processing of their personal data. For instance, a student completing a research survey thorugh Qualtrics services has no direct contractual relationsip with Qualtrics.

> Topics: Personal Data, Education, Processing Agreement, Supervisory Authorities

### ¶175

Article 6 (1) (b) cannot be invoked neither by an education institution nor the vendor for processing student data. Fairness 123/189 Fairness is an overarching principle which requires that personal data shall not be processed in a way that is detrimental, discriminatory, unexpected, or misleading to the data subject. 151 There are several circumstances that might be unexpected for the data subject. If processing causes negative effects, those must be justified and proportionate. According to Qualtrics, educational institutions, as data controllers, are responsible for determining the purposes and means of data processing. However, personal data might be used in an unexpected way. SURF cannot verify the models. It is important to highlight that Qualtrics’ lack of technical transparency makes it impossible to fully assess the fairness, explainability, or reliability of the AI or ML methods used.

> Topics: Controllers, Education, Personal Data, Transparency

### ¶176

Specifically, the usage of the anonymised personal data for further data processing activities such as training LLM undermines the transparency and purpose limitation principles. Transparency The principle of transparency not only ensures that consent must be informed but that full transparency of data practices and rights is ensured to users. In the case of children, this means that information relating to data processing must be comprehensible, recognisable and accessible to them (Article 12 GDPR). Principle of transparency might be undermined with the usage of generic purpose descriptions and uses words as ‘like’ or ‘for example’. In general, the use of ambiguous wording or vague terms can contradict the principle of fairness of Article 5 (1, a) GDPR, since information cannot be considered transparent, making data subjects unable to understand the processing of their personal data and to exercise their rights.

> Topics: Personal Data, Transparency, Minors, Processing

### ¶177

According to the EDPB, the use of conditional tense (“might”) leaves users unsure whether their data will be used for the processing or not.”. The EDPB recalls that the use of conditional tense or vague wording does not constitute “clear and plain language” as required by Article 12 (1) phrase 1 GDPR and may only be used if controllers are able to demonstrate that this does not undermine the fairness of processing. The information that was provided in the section DSAR Service Outcomes, shows that Qualtrics is not transparent regarding the extensive data processing activities where Qualtrics acts as a data controller and as a data processor. Specifically, the information was missing from the following data processing activities such as: 1. Website and service usage analytics data. This relates specifically to unique identifiers that might be linked to the user’s activity for the purpose of service improvement.

> Topics: Controllers, Processing, Processors, Identification

### ¶178

SURF’s technical investigation showed that third-party analytics services were used from Amplitude, Pendo, and Google Analytics. 2. Marketing, Advertising, and Profiling Data to build user profile. 3. Support, community and training data: generating personal data for which Qualtrics is a controller for the services Qualtrics Support, XM Basecamp, and Qualtrics Community. 151 EDPB Guidelines 4/2019 on Article 25 Data Protection by Design and Default, version 2.0, adopted on 20 October 2020, p. 16, URL: https://edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201904_dataprotection_by_design_and_by_default_v2.0_en.pd f. 124/189 4. General account metadata and browser information such as collecting and analysing information of visitors, including the domain name, visited surveys, referring Uniform Resource Locators (URLs) and other publicly available information. 152 SURF does not have documentation from Qualtrics specifying which data processing and which purposes are explicitly covered under the agreed terms between Qualtrics and the educational institutions for the role of processor.

> Topics: Controllers, Privacy by Design, Processors, Education

### ¶179

Without this documentation, SURF is relying solely on Qualtrics’ public statements and Trust Center information. However, these sources do not provide a complete overview of the data flows, categories of personal data processed, purposes, methods, or other essential details required for full transparency from the vendor. Therefore, Qualtrics does not demonstrate adherence to the transparency principles relating to processing of personal data towards the educational institutions according to Article 5 (1,a) GDPR, thereby not enabling the educational institutions as controllers to be transparent to their data subjects. Data minimisation and privacy by design The principles of data minimisation and privacy by design require that the processing of personal data be limited to what is necessary. The data must be 'adequate, relevant and limited to what is necessary for the purposes for which they are processed' (Article 5(1)(c) of the GDPR).

> Topics: Personal Data, Privacy by Design, Transparency, Retention Period

### ¶180

This means that the controller may not collect and store data that are not directly related to a legitimate purpose. According to this principle, the default settings for the data collection should be set in such a way as to minimise data collection by using the most privacy friendly settings. The principle of “data minimisation” precludes the combination, analysis and processing of all personal data obtained from the data subject or third parties by a controller, such as the operator of an online social media platform, and collected both on that platform and elsewhere, for the purposes of targeted advertising, without any limitation in time and without distinction as to the nature of that data. 153 SURF submitted the DSAR requests to have a more clear picture on the purpose of the processing and the categories of personal data. The DSAR response were not complete. It did not clarify and make it more specific what the purpose of processing and the categories of personal data being collected and processed is actually necessary and proportionate.

> Topics: Personal Data, Social Media, Retention Period, Controllers

### ¶181

For instance, collecting location data without the knowledge of data subjects and not disabling this feature by default undermines the data minimization principle. Accuracy The principle of accuracy requires that the personal data be accurate and, where necessary, kept up to date. “Every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay” (article 5 (1) (d) GDPR). According to the EDPB, the controller should consider this principle “ in relation to the risks and consequences of the concrete use of data .” 152 Qualtrics, ‘The Qualtrics' Cloud Security & Privacy Framework’ (April 2025, Version 9.0). 153 CJEU 4 October 2024, C-446/21 (Schrems vs Meta), para. 65. 125/189 As was stated throughout this DPIA, SURF was not able to get the full list of the Personal data must be accurate and linked to a specific purpose.

> Topics: Personal Data, DPIA, Retention Period, Controllers

### ¶182

Based on the DSAR responses, educational institutions are unable to clearly associate the personal data with its corresponding purpose and data subject categories. This limitation makes it more challenging to uphold the principle of accuracy in this context. The risks to accuracy principle stems from the usage of the AI Response which SURF analysed in Section A.6.3.6. Since the AI Response Task uses an LLM, it is susceptible to hallucinations (generation persuading but possibly factually incorrect information). The accuracy principle from Article 5 (1) (d) GDPR ‘reasonable steps’ should be taken to rectify or erase the inaccuracy, therefore it has been interpreted as an obligation of means, not one of results. 154 Qualtrics, as a processor, is obliged to assist the controllers in providing correct data in accordance with accuracy principle. 155 Storage limitation The principle of storage limitation requires that personal data should only be kept for as long as necessary for the purpose for which the data are processed.

> Topics: Controllers, Personal Data, Processors, Retention Period

### ¶183

Data must 'not be kept in a form which permits identification of data subjects for longer than is necessary for the purposes for which the personal data are processed ' (Article 5(1)(e), first sentence, GDPR). This principle therefore requires that personal data be deleted as soon as they are no longer necessary to achieve the purpose pursued by the controller. The text of this provision further clarifies that ‘ personal data may be kept longer in so far as the personal data are processed solely for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes in accordance with Article 89(1), subject to the implementation of appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject’ (Article 5(1)(e), second sentence, GDPR). Additionally, “The Controller may determine the duration of personal data being processed by Processor.

> Topics: Controllers, Personal Data, Processors, Statistics

### ¶184

The Processor will store personal data no longer than necessary to provide the services requested by the Controller.” During SURF’s DPIA, one of the key objectives was to identify the expected retention period for the different categories of personal data or, the criteria for determining that period. This information was not provided. The information on storage limitation, was determined from the Qualtrics ‘Data Retention’ document. 156 Qualtrics mentioned that: ‘ data retention periods are determined by the institutions, therefore we cannot provide this information on their behalf .’ 157 Integrity and confidentiality Personal data must be processed in such a way as to ensure its appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage (Article 5(1)(f) GDPR together with Article 32(1) and (2) GDPR). 154 De Bot, De toepassing van de Algemene Verordening Gegevensbescherming in de Belgische context , p. 497 155 Article 28 GDPR. 156 Qualtrics, ‘Data Retention’ (Qualtrics Support) https://www.qualtrics.com/support/survey-platform/sp-administration/data- privacy-tab/data-retention/ accessed 30 July 2025. 157 Qualtrics feedback from the 21 sT of February 2026. 127/189 B.5 Data Subject Rights The GDPR grants data subjects several rights, including the right to information, access, rectification, erasure, objection to profiling, data portability, and the right to lodge a complaint.

> Topics: Storage Limitation, Processors, Retention Period, Controllers

### ¶185

It is the responsibility of the data controller (such as a Dutch educational institution) to provide this information and respond to these requests accurately and within the required timeframe. When the data controller engages a data processor, such as Qualtrics, the GDPR requires that the data processing agreement explicitly states that the processor will assist the controller in fulfilling these obligations related to data subject rights. Qualtrics explains in its Privacy Policy, that an individual has the right to exercise data subject rights in relation to personal data for which Qualtrics acts as a data controller. Qualtrics states that it is a processor for the Customer Data. Qualtrics as a processor is contractually obligated to immediately inform the data controller that they received the request, and then assist the controller in fulfilling it. The controller remains responsible for the overall response to the data subject.

> Topics: Controllers, Processors, Processing, Personal Data

### ¶186

However, the controller should receive the assistance from Qualtrics to provide a data subject with a necessary information. B.5.1 Right to information Data subjects have a right to information (Articles 12-14 GDPR). This means that data controllers must provide people with easily accessible, comprehensible and concise information in clear language about, inter alia, their identity as data controller, the purposes of the data processing, the intended duration of the storage and the rights of data subjects. The DPA is incomplete and lacks the necessary specificity regarding the processing activities, purposes, and categories of personal data processed by Qualtrics. As a result, SURF was unable to clearly distinguish between the data processing activities carried out on behalf of the data controller and those for which Qualtrics independently determines the purposes and means of processing.

> Topics: Processing, Controllers, Personal Data, Supervisory Authorities

### ¶187

This lack of clarity undermines the institutions’ ability to fully comply with its transparency and accountability obligations under the GDPR. Furthermore, the unclear allocation of purposes for which personal data is processed and the blurred division of responsibilities between the institution and Qualtrics, makes it difficult for either party to effectively and accurately fulfill their information obligations under the GDPR. B.5.2 The right to access data The first fundamental right is the right to access. Data subjects have a (fundamental) right to access personal data concerning them. Upon request, data controllers must inform data subjects whether they are processing personal data about them (directly, or through a data processor). If this is the case, they must provide data subjects with a copy of the personal data processed, together with information about the purposes of processing, recipients to whom the data have been transmitted, the retention period(s), and information on their further rights as data subjects, such as filing a complaint with the Data Protection Authority. 128/189 Qualtrics as a data processor, should assist data controllers with providing data subjects with the right to obtain access to the personal data Qualtrics holds about them.

> Topics: Controllers, Processors, Recipient, Processing

### ¶188

This can be done though the Export Response Data: ‘The exported data can be shared with the data subject in multiple formats, such as CSV, XML, SPSS, and others, ensuring compliance with the access request in a usable and transparent manner. 159 ’ However, when SURF submitted the DSAR, the foundational information about the purposes, the categories of data subjects, personal data, retention periods was not included. B.5.3 Right to rectification Data subjects have the right to rectify inaccurate or incomplete personal data (Article 16 GDPR). Qualtrics offers instructions to Customers and data subjects how to modify or correct personal data within the XM platform. 160 Only authorised users (Brand Administrators) are allowed to edit submitted responses. B.5.4 Data Deletion (Right to erasure) Under Article 17 of the GDPR, data subjects have the right to erasure of their personal data in certain cases, such as when it is no longer needed, consent is withdrawn, or processing is unlawful.

> Topics: Storage Limitation, Personal Data, Retention Period, Right to be Forgotten

### ¶189

If a data subject requests deletion of their personal data, Qualtrics offers guidelines to their page on the Right to Erasure. 161 Data can be deleted in various ways depending on the type and location such as survey responses, XM Directory, and dashboards. Qualtrics backs up data for disaster recovery, but users are responsible for their own backups and retention policies. Once data is deleted, all related backups will be removed within 90 days. Since Qualtrics might process sensitive data such as bsn, the data should not be left after the request to delete the data. Because the bsn makes it easier for government organisations to exchange personal details without making errors, therefore this number is connected to all the information that the government can have about an individual. It is a sensitive identifier that can be used in various types of fraud, including identity theft and phishing scams.

> Topics: Personal Data, Right to be Forgotten, Identification

### ¶190

Therefore, controllers and processors need to make sure that this data will not ‘reappear’ in the system again. SURF has not received evidence or additional documentation about the process deletion. Therefore, SURF cannot confirm the exercise of the right to erasure further. 159 Qualtrics, ‘Export Formats’ (Qualtrics Support) https://www.qualtrics.com/support/survey-platform/data-and-analysis- module/data/download-data/export-formats/ accessed 10 October 2025. 160 Qualtrics, ‘Qualtrics GDPR Compliance – Data Modification’ (Qualtrics Support) https://www.qualtrics.com/support/survey- platform/getting-started/qualtrics-gdpr-compliance/#DataModification accessed 10 October 2025. 161 Qualtrics, ‘Right to Erasure’ (Qualtrics Support) https://www.qualtrics.com/support/survey-platform/sp-administration/data- privacy-tab/right-to-erasure/ accessed 10 October 2025. 129/189 Part C Description and Assessment of Risks to Data Subjects C.1 Introduction Before examining the details of the risk classification, it is important to mention that Qualtrics did not provide clear explanations or sufficiently address the questions raised.

> Topics: Controllers, Processors, Right to be Forgotten, Personal Data

### ¶191

The ‘black box’ approach was taken in this DPIA. This is why some of the risks were classified as high, because no sufficient information from Qualtrics was provided to conduct a balanced DPIA. The absence of transparency and cooperation from Qualtrics hindered the research from achieving a more collaborative and well-informed outcome. C.1.1 Identification of risks Below, a general distinction is made between the risks of the processing of metadata on the one hand, and the Content Data on the other hand. Subsequently, 11 specific data protection risks are described, of which 7 relate to the processing of Diagnostic Data, and 4 to the Content Data. Generally speaking, data protection risks can appear in the following categories: • inability to exercise rights (including but not limited to privacy rights) • inability to access services or opportunities • loss of control over the use of personal data • discrimination • identity theft or fraud • financial loss • reputational damage • physical harm • loss of confidentiality • re-identification of pseudonymised data or • any other significant economic or social disadvantage. 162 C.1.2 Classification of the risks A risk matrix is used to visually represent and classify the factors of probability and impact.

> Topics: Pseudonymization, Transparency, DPIA, Personal Data

### ¶192

SURF uses the Information Commissioner’s Office (‘ICO’) matrix. 163 The risk matrix consists of a table with two axes, one on the left and one on the right, with the probability of occurrence on the horizontal axis and the impact on the vertical axis. 162 Information Commissioner’s Office, Overview of data protection harms and the ICO’s taxonomy (Version 1, April 2022) https://ico.org.uk/media2/about-the-ico/documents/4020144/overview-of-data-protection-harms-and-the-ico-taxonomy-v1- 202204.pdf accessed 10 April 2026. 163 Information Commissioner’s Office, How do we do a DPIA? https://ico.org.uk/for-organisations/uk-gdpr-guidance-and- resources/accountability-and-governance/data-protection-impact-assessments-dpias/how-do-we-do-a-dpia/ accessed 10 April 2026. 131/189 C.2.2 Loss of control – data agnostic approach undermining the parties’ role allocation and purpose limitation principle (High) There are existing documentation gaps that were observed during the review of the documentation that related to the Qualtrics XM services.

> Topics: DPIA, Accountability

### ¶193

Initially in the DPIA process, Qualtrics refused to share more information than what was publicly available or through the Trust Centre, which was not sufficient to fill in the gaps of the missing information or insufficient documentation in public documentations such as Privacy policy, GTC, and requested documentation from educational institutions such as DPA. Additionally, in the section on Qualtrics’ Purposes as a Controller, SURF mentioned that according to these 7 purposes Qualtrics acts as a controller (according to the Privacy Policy): 1) To provide the services; 2) To communicate with the client about the services; 3) To improve, monitor, personalise, and protect the services; 4) For research and development; 5) For marketing and advertising; 6) For compliance and protection; 7) To train artificial intelligence tools. Qualtrics acts both as a processor (on behalf of institutions) and as a controller (for its own purposes, such as analytics and AI training).

> Topics: Controllers, Processors, DPIA, Education

### ¶194

However, Qualtrics also processes personal data that falls under the DPA for their own purposes for the service development such as LLM training. Unauthorised processing of personal data for the vendor’s own purposes can create a high impact on data subjects. If Qualtrics reuses the personal data for its own purposes without a lawful basis, this violates the purpose limitation principle. SURF found out that personal data might be used to train AI tools. 164 In order to check if the purposes match the purposes reflected in the DPA and other agreements, a list of personal data and categories of personal data matching the relavant purpose should be mentioned in the Schedule 1 of the DPA to provide a clear and transparent overview of data processing activities. In such setups, categorisation of data is often blurred or incomplete, especially when not clearly separated in contracts or privacy notices.

> Topics: Personal Data, Processing, Transparency, Legitimate Interest

### ¶195

Qualtrics provided the types of Personal data (the subset of Customer Data) that are usually defined by the customer. This data was incorporated into the Table 5 Personal data mapping for Qualtrics as a processor. During the technical research, SURF observed that Qualtrics processes the data further for the development purposes when personal data is de-identified and aggregated. Qualtrics states that it maintains a clear separation between its roles as processor and controller. 165 The likelihood of damage occurring is high because no information is provided to SURF about processing purposes, legal bases for processing, categories of data and data subjects, and data retention criteria. Without this clarity of the specific and lawful purpose, and inadequate 164 https://www.qualtrics.com/privacy-statement/ 165 Qualtrics response to SURF from the 9 th December 2025. 132/189 documentation, the risk of not being able to provide clear, complete processing document for noncompliance is high.

> Topics: Controllers, Personal Data, Processors, Storage Limitation

### ¶196

SURF realises that the vendor implements a data agnostic approach, and acts on behalf of the instructions of the education institutions (their customers). However, without mapping the purposes to the categories of personal data in the Schedule 1 of the DPA, it is more complex for education institutions to verify their internal purposes are aligned with those contractually agreed upon. This increases the chance that data is processed inconsistently with the agreements with educational institutions. The impact in this situation is high because it is non-compliance with the core GDPR principles according to Article 5 (1) GDPR. Even though SURF categorised the available categories of personal data processed by Qualtrics in the role of data controller (See Table 4 ), Qualtrics did not provide the full overview of the personal data processed on behalf of the Customers. Therefore, the lack to demonstrate that Qualtrics complies with the core GDPR principles can erode trust within educational institutions, and affect the fundamental rights of data subjects.

> Topics: Controllers, Personal Data, Education, Processing

### ¶197

C.2.3 Inability to exercise data subjects rights – Transparency issue with the DSAR support to institutions. (High) According to the GDPR requirements, data subjects must be informed about the categories of personal data collected, the purposes and the retention periods. If there is no an adequate support to educational institutions, a vendor might hinder the right to access data (Article 13 and 14 GDPR). In the initial stages of our technical research, SURF observed that access to personal data through the platform's user interface is limited to survey response data, excluding critical system-generated data, user account metadata, error logs, or access records. Additionally, the vendor refuses to assist directly with DSARs for data processed on behalf of the institution, and instead refers users to a generic self-service support page. This page only covers manual export of respondent survey data, offering no support for accessing broader personal data processed by the system.

> Topics: Personal Data, Transparency, Retention Period, Right of Access

### ¶198

Qualtrics describes this approach because of the Controller’s responsibility in providing its data subjects with the DSAR: ‘Controller Responsibility for DSARs: Under the DPA, if Qualtrics receives a request from a Data Subject relating to Personal Data, Qualtrics is obligated to promptly notify the Customer and will not respond to the request itself. Instead, Qualtrics asks the Data Subject to redirect the request to the Customer. This is because the Customer, as the Controller, has the direct relationship with the data subjects and solely determines the purposes and means of processing.’ 166 Therefore, the responsibility is on the Customer to provide the full response to the DSAR. Ths corresponds to the vendor’s choice of being a data agnostic platform. However, data subjects 166 Qualtrics response to the SURF question from the 9 th December 2025. 133/189 have the right of obtaining the ‘copy’ of a personal data meaning that the data subject must be given a faithful and intelligible reproduction of all those data. 167 Qualtrics operates a DSAR tool described in the Section Personal Data Request tool.

> Topics: Personal Data, Controllers, Supervisory Authorities

### ¶199

This new DSAR export tool provides the firstly missing information, but still misses the logging information. The impact of providing insufficient information to customers on data subjects is high, because fundamental rights of the Customers’ data subjects are at stake. No full information was provided by Qualtrics in the beginning, and educational institutions could not fulfill their controller’s obligation to provide a data subject with a full disclosure either. The likelihood of the risk occurring is high, because the probability that data subjects get the DSAR missing the logging data, or incomplete disclosure about data processing such as anonymisation techniques used by Qualtrics and LLM training, makes the data subject rights non-exercisable by data subjects. Overall, the risk is high. C.2.4 Lack of transparency in the subprocessor list – Incomplete subprocessor list (High) During the tehnical research some additional services were discovered such as Google Analytics (Google LLC), Pendo, Amplitude.

> Topics: Transparency, Anonymization, Controllers, Education

### ¶200

These subprocessors were either incompletely described or entirely absent from the official subprocessor list. Since Qualtrics does not provide sufficient information about its data processing activities which are considered confidential by a vendor, not being able to inform its users about the actual third party processing personal data creates legal and operational risks for educational institutions. SURF provided the evidence in the Section Technical Investigation of Data Flows and Endpoints about more parties being involved in data processing activities than included in the Qualtrics’ suprocessor list. 168 The impact is high because under GDPR, data processors must inform controllers about third- party processors involved in data processing. Indeed, Qualtrics informs users about new subprocessors through sharing the email notification to the customers, however they are not mentioned in the subpocessors list.

> Topics: Controllers, Processors, Processing, Education

### ¶201

The likelihood is high because endpoint testing during platform use revealed frequent connections to domains associated with Google Analytics, Pendo, Amplitude, all of which are not transparently listed in the vendor's official subprocessor documentation. Therefore, the risk is high. C.2.5 Lack of transparency for the optional subprocessor Imperium LLC (No longer a risk) Qualtrics may engage Imperium, LLC, a US-based optional subprocessor, to perform device fingerprinting and fraud detection through the collection of metadata such as IP address, browser/device info, and bot detection scores. This constitutes profiling and fingerprinting. However, it is unclear when and how Imperium is actually activated, as there is no visibility 167 Case C-487/21, Osterreichische Datenschutzbehorde and CRIF. 168 Qualtrics, ‘Subprocessor List’ (Qualtrics, n.d.) https://www.qualtrics.com/subprocessor-list/ accessed 14 April 2026. 134/189 provided to Brand Administrators or researchers regarding its usage on specific responses.

> Topics: Transparency, IP Address, Marketing, Profiling

### ¶202

Also, there is no clear audit trail or logs confirm if metadata is processed by Imperium. This creates a transparency and accountability gap in the processing of personal data via third parties. Under Recital 30 GDPR, metadata like device characteristics, IP addresses, and browser signatures may be used for fingerprinting, and are considered personal data. This type of profiling can: infringe on users’ privacy rights, trigger the need for explicit consent in some jurisdictions (especially under ePrivacy and for cookie-like technologies), require detailed transparency in privacy policy. Therefore, the impact on data subjects can be detrimental since Qualtrics uses online identifiers. There is a reasonable chance because even though Imperium LLC is labeled ‘optional’, the lack of a clear opt-in or opt-out mechanism creates a situation where its processing may be active by default or indirectly triggered.

> Topics: IP Address, Personal Data, Audit Logs, Consent

### ¶203

Therefore, it is probable that this subprocessor might be switched on in certain conditions without the controller’s or user’s awareness. Given the impact and the likelihood of occurrence of this risk, it was classified as high. However, due to the fact that Qualtrics stopped using Imperium LLC, this risk is no longer applicable to this DPIA. Additionally, Qualtrics is advised to remove this subprocessor from the list of subprocessors. 169 C.2.6 Lack of transparency – transparency report (High) Qualtrics does not publish transparency reports about government requests. Qualtrics stated that it does not publish transparency reports about government requests publicly. Moreover, in the DPA it is stated that Qualtrics may process personal data if required so by applicable law and Qualtrics notifies the Customer of that legal requirement. However, this approach lacks transparency regarding the number of government requests that Qualtrics receives, specififcally about the frequency of government data requests,the types of requests (national security, law enforcement), whether requests were complied with or rejected, and whether data of EU citizens was involved.

> Topics: Transparency, DPIA, Supervision, Controllers

### ¶204

According to Article 13 and 14 of the GDPR, the controllers (education institutions) should provide data subjects with the information regarding personal data collected from the data subjects. There is an obligation on the intermediary services (which include online platforms) to provide transparency reports regarding their content moderation activities according to the Digital Services Act (‘DSA’). 170 This requirement includes providing annual reporting which is publicly available and easily accessible. The information shall include Government orders such as the number of orders received from the government authoriries. The DSA provides more specific obligation, and represents the recognized risk of the information gap between platfrom and the data subjects. 169 Qualtrics, ‘Subprocessor List’ (Qualtrics, n.d.) https://www.qualtrics.com/subprocessor-list/ accessed 14 April 2026. 170 Article 15 Digital Servcies Act (‘DSA’) 135/189 Qualtrics’ position and contractual commitments are: ‘• SCC-Specific Report: Qualtrics will make available to the Customer on a yearly basis a report containing statistical information on any requests from intelligence authorities for the disclosure of personal data transferred on the basis of the Standard Contractual Clauses (SCCs). • Content of the Report: This specific report lists the number of such requests received in a given calendar year.’ 171 Despite providing the report to the Customers, the lack of transparency for data subjects creates an information gap for data subjects.

> Topics: Personal Data, Transparency, Controllers, International Transfer

### ¶205

It has a high impact on data subjects. Data subjects should receive the because end users should be able to receive this information publicly, and not only for the vendor to provide a ‘compliance mechanism for the contracting Customer to facilitate their oversight under international data transfer requirements’ 172 which does not contribute to a better transparency mechanism to inform the data subjects about the government requests. The likelihood of the risk occurring is high, because there is a chance that data subjects remain uninformed. From a processor accountability perspective, Qualtrics has designed this mechanism to correspond to its own contractual and legal obligations towards the Customers, and not the data subjects. Therefore, education institutions, as controllers, need to proactively inform data subjects through privacy notices and transparency reports based on the Qualtrics’ SCC-Specific Report.

> Topics: Transparency, Controllers, Processors, Personal Data

### ¶206

In practice, education institutions refer to the Qualtrics’ public available information. This excludes the details about the information collected from the data subjects, because Qualtrics shares it with the Customers only. The lack of transparency (regarding with who, when and why the data subjects’ information was shared with government authorities) and effect on processing of personal data has a high impact on data subjects. There should be a clear communication how the controllers and processor (to assisit the controller with sharing this information with data subjects) provide these details to the data subjects. The likelihood of the risk occurring to the data subject is significant because the chance that data subjects are not informed remains high. Education institutions may lower the likelihood of the risks by providing this information to the data subject. This risk is classified as high.

> Topics: Controllers, Personal Data, Processors, Transparency

### ¶207

C.2.7 Lack of transparency – Proxy Login (High) This feature is described in the Section Proxy Login. The end user receives no notification that a proxy login has occurred. The proxy functionality does not correspond to the GDPR’s transparency obligation in two ways: at the point of access (the end user does not know their account is accessed in real time) and after the fact (no notification mechanism). The impact on data subjects is high because everytime a Brand Administrator uses proxy login, the end user is unaware. This makes the impact of this risk high because the impersonator can view and/or access personal data which can potentially lead to the unauthorised data access. Since the user is not informed pre- or post-session, more measures should be implemented to 171 Qualtrics’ responses to SURF questions from the 9 th of December 2025. 172 Qualtrics’ responses to SURF questions from the 9 th of December 2025. 136/189 comply with transparency principle from Article 5 (1) (a) GDPR.

> Topics: Transparency, Personal Data

### ¶208

This makes this feature a high risk for data subjects. The likelihood of this risk is high due to the fact that the feature is available without any notification controls of the end-users. It is frequently used since it is a standard support tool. C.2.8 Loss of control - internal system and performance logs (High) During the SURF research, it was identified that Qualtrics maintains a log of internal system and performance events. From Qualtrics documentation, they are used for the purpose of capturing technical metrics related to infrastructure health, service integrity, and operational anomalities. Moreover, the logs contain metadata such as the IP address of the requestor, the protocol used, and other information mentioned in the Section Internal System and Performance Logs. SURF identified that these internal logs are not made available to the customers. Only a limited subset of activity data is surfaced to customers via the platform’s user interface or API endpoints.

> Topics: IP Address, Personal Data

### ¶209

From the perspective of impact, educational institutions will not be able to track the processing of personal data, and as a consequence will lose the track of the exact personal data which is processed by Qualtrics either in the role of controller and processor. As a result, even though the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with the GDPR according to Article 24, educational institutions will not have the full control of what whether the metada is included in the data processing at the level of performance logs and will not be able to inform their data subjects about this processing. Likelihood of the damage occurring is high, because Qualtrics isn’t providing access to the personal data in these logs at this moment. Therefore, the risk is classified as high. C.2.9 Loss of control: Reidentification of pseudonymised data – anonymisation techniques to train AI models (High) SURF experienced the lack of transparency regarding the use of ‘proprietary rules’ and reliance on machine learning techniques for anonymisaton.

> Topics: Personal Data, Controllers, Processors, Transparency

### ¶210

Qualtrics’ lack of full auditability and the potential for advanced re-identification attacks cause an overreliance on Qualtrics’ internal processes. If the information about the internal processes was more available, the risk would be minimised because Qualtrics will be able to show education institutions that the vendor is compliant with the GDPR and does not have any high data processing risks. The impact on data subjects is high because sensitive personal data (such as Dutch specific identifiers) could be exposed by using advanced inference techniques if re-identification occurs. Qualtrics has provided SURF with where anonymisation techniques and methods are demonstrated. Qualtrics mentioned few personal data categories which are flagged and anonymised/reduced. This excludes entirely Special types of personal data, as well as other sensitive information. 137/189 Qualtrics mentioned this list is not reviewed by legal specialists, but only technical experts of the vendor.

> Topics: Personal Data, Identification, Anonymization, Types of Special Categories of Personal Data

### ¶211

Additionally, Qualtrics does not have any anonymisation accuracy metrics for Dutch, and also could not share with SURF if the model has been trained on Dutch at all. Therefore, how the anonymisation technique work with Dutch remains unclear. Regarding the ‘human in the loop’, no actual metrics were shared. Additionally, a related aspect to the risk of reidentification is that SURF could not verify in the Qualtrics’ documentation what types of AI models Qualtrics uses, there are no published metrics on any of the Qualtrics’ AI. Therefore, it is complex to verify the effective anonymisation techniques to train AI models. Although, in SURF’s experience, vendors do provide this information to determine the effectiveness of the anonymisation techniques. The likelihood of this risk occurring increases when anonymisation techniques are not clearly checked for the compliance of anonymisation techniques.

> Topics: Anonymization, Meaningful Human Review and Decision-Making

### ¶212

Lack of transparency reduces the ability of SURF and education institutions (data controllers) to assess risks and compensating controls which significantly impacts data subjects. This marks the likelihood high. SURF in its conclusions cannot overrely on Qualtrics’ internal processes. The chance of damage occurring is high because data subjects are not aware of certain data processing activities. In the Section Anonymisation and Pseudonymisation, SURF shared the findings of the technical research. Performance metrics do not correspond to the same level of details as vendors are providing during the DPIAs. Given that SURF has limited visibility into Qualtrics’ internal processes and the likelihood of the risk is high as long as transparency is lacking, this risk is qualified as high. C.2.10 Loss of Control- Inadequate support for transparent user communication and informed consent (High) The risk here is that Qualtrics provides only a minimal default disclamer, placing the full responsibility on educational institutions (as data controllers) to: inform users properly about data collection, use retention, and rights; obtain valid informed consent, and comply with transparency obligations.

> Topics: Transparency, Processing, Controllers, Anonymization

### ¶213

For example, Qualtrics’ cookie consent banner lacks a 'Reject All' option, effectively nudging users toward data acceptance and complicating the opt-out process. More critically, the platform deploys cookies immediately upon loading the main page, before a user choice is made. Therefore, data subjects are unable to prevent the processing of their behavioral data, leading to a direct violation of the ePrivacy Directive and GDPR transparency requirements. Impact is high, because an invalid consent may be obtained if notices are unclear about data retention periods and legal basis for the data processing. The likelihood of the risk would be high because institutions as data controllers rely on Qualtrics as data processor and its default. Overall, the risk of inadequate support for transparent user communication and informed consent is high. 139/189 Likelihood of the risk occurring is remote, , which was previously identified, no longer appears in the most recent SOC2 Report. 174 It is important to note that remediation of the control does not retrospectively answer the outstanding questions surrounding the period during which the control failed.

> Topics: Controllers, Processors, Cookies, Storage Limitation

### ¶214

Specifically, what occurred, which data subjects or systems were affected, and for how long the deficiency persisted. Those questions remain relevant from a GDPR accountability and incident management perspective and should continue to be addressed separately. Regarding the current risk position: Qualtrics' new SOC 2 report returns a positive outcome, and the remediation letter provided by Qualtrics sets out concrete countermeasures designed to prevent recurrence of the issue. The unresolved questions about the failure period mean that accountability for that period cannot be demonstrated. Taking these factors into account, the risk associated with is resolved. However, the risk remains in the internal processes of the vendor for not being able to present the This risk stems from vendor’s choice for the level of transparency and accuracy regarding its data processing activities. C.2.13 Loss of Control - Incomplete automated detection by ExpertReview of specific sensitive identifiers for Dutch education customers (High) Sensitive data policy primary feature is to protect respondent privacy by identifying and preventing the collection of sensitive data.

> Topics: Transparency, Processing, Personal Data, Accountability

### ¶215

Personal data is automatically blocked and redacted through the functionality of ExpertReview. Qualtrics is a data processor, and the Brand Administrator of the educational institution defines specific Sensitive Data Policies by setting up topics and requirements. However, the current system does not automatically detect Dutch- specific sensitive identifiers. For example, Dutch mobile phone numbers and Dutch BSN (burgerservicenummer). These identifiers may therefore be collected without triggering alerts or redactions. Brand administrators can manually create custom detection rules, however the impact of this feature not being specific to Dutch educational institutions has a high privacy impact. Because Dutch bsn is considered sensitive personal data under GDPR. If this data is not redacted, failure to detect these identifiers may lead to unlawful processing and breach with data minimisation principles.

> Topics: Processors, Controllers, Personal Data, Retention Period

### ¶216

The likelihood depends on whether education institutions actively configure personal data through the ExpertReview. This function includes a disclaimer that it does not warrant any users from any data specific languages. The tool will not be able to detect any Dutch specific configurations such as BSN. Although education institutions code their own rules and ensure that it functions in accordance with the set rules, the likelihood that the risk will occur when institutions use this feature is more likely than not. Because even if this feature is not used actively by the institutions, there is a significant possibility that certain groups of data subjects that use the feature may be significantly impacted. 174 Qualtrics SOC 2 Type 2 Report on Qualtrics’ System and Organization Controls Relevant to Security, Availability, and Confidentiality (February 2026). 140/189 Therefore, the classification of the risk is high.

> Topics: Personal Data

### ¶217

C.2.14 Lack of transparency – no publication of accuracy metrics for Sensitive Data Policy and absence of feedback mechanisms (High) The absence of published accuracy metrics for Sensitive Data Policy detection undermines educational institutions’ ability to assess and manage risks about the system’s reliability. As the result, educational institutions are unable to assess situation if sensitive data was not detected and thus exposed, or sensitive data being incorrectly flagged or redacted. This situation becomes more challenging with the absence of feedback and complaint processes to report detection inaccuracies. The impact of this risk is high because it may cause educational institutions to struggle with demonstrating data accuracy and effective data minimisation without evidence of accurate or non-accurate detection mechanism. The potentially high likelihood, complexity of sensitive data detection without published metrics, educational institutions must assume a moderate chance of detection errors.

> Topics: Transparency, Retention Period, Accuracy, Education

### ¶218

The lack of feedback means that errors may be left inchecked for extended periods. The combination of high impact and high likelihood given the sensitivity of personal data, makes it a high risk to data protection. C.2.15 Loss of control and lack of transparency – Insufficient control of translated user surveys Google Translate and Amazon Translate (High) The platform Qualtrics XM automatically sends content to the external providers of transaltion function (Google Translate or Amazon Translate) without the possibility for Brand Administrators to disable this behaviour. Initially, Qualtrics did not inform users when content in the Data Analysis module has been processed in this way, nor has it disclaimers about possible translation inaccuracies. The risk associated with the usage of third-party translation provides increases the risk of data exposure because the text is transmitted to external servers providers.

> Topics: Transparency, Personal Data

### ¶219

Extra points are added where data could be intercepted. Brand administrators have no control to disable this data sharing. As the result, educational institutions cannot prevent potentially sensitive data from being sent out by default. Additionally, according to the section Translation Services, end users should manually enable the automatic translation by other translation services. Qualtrics allows for the manual renaming of translation columns; however, this currently requires the user to append identifiers ('AI-translated to EN') to the field manually. This measure makes the likelihood of the risk occurring low if education institutions amend the identifiers. The likelihood of automatic translation service depends on the frequency of the usage of this function, whether a researcher clicks the translate button. The likelihood increases with the more frequency surveys with sensitive content are translated.

> Topics: Education, Identification

### ¶220

Frequent usage of Google Translate and Amazon Translate means that data exposure is recurring, but moderate. The 141/189 chance of damage occurring is medium risk because it depends how often data subjects are using the translation. The impact on data subjects is high because there is loss of control over the accuracy of the processing of personal data. C.2.16 Transfer outside of the EU/EEA - Automatic use of Google Translate and Amazon Translate (High) This risk concerns the loss of sovereignty over the processes mentioned in the previous section. The impact on data subjects is high because their personal data is transmitted to US-based hyperscalers (Google or Amazon) without the explicit consent of the subject or the intervention of the Controller (the Educational Institution). The chance of damage is considered medium because it is triggered only when a researcher actively engages the ‘Translate’ function in the Data Analysis module.

> Topics: Personal Data, Consent, Controllers, Processing

### ¶221

However, because the Brand Administrator cannot disable this feature globally, the institution cannot prevent an individual researcher from accidentally or intentionally triggering a non-compliant transfer. Overall, this risk is classified as high. C.2.17 Lack of transparency and absence of consent due to the incomplete cookie information (High) In the section Technical Testing of Cookies, SURF explained that cookies that were not described in the Cookie policy were identified during the technical research. The description of some identified cookies was not included in the articles mentioned by Qualtrics. This lack of transparency limits the ability of educational institutions as data controllers to assess the cookies in use to provide or not provide an explicit consent. SURF followed up on the 25 missing cookies that were encountered during the technical research. Qualtrics explained the purposes for cookies, however these purposes were not included in the Cookie statement.

> Topics: Controllers, Consent, Transparency, Education

### ¶222

Additionally, the categories of personal data and the relevant subprocessors were also missing from this list. The impact is high because educational institutions without knowing the purpose of the cookies collected and relevant personal data, may not demonstrate the compliance with the lawfulness of data processing. Under the ePrivacy Directive, cookies require the user’s prior consent. Since no information on the cookies is presented, no valid consent is obtained. The likelihood is high, because it is occurring, and creates potential unlawful processing. High impact and moderate likelihood makes this risk high for data subjects and causes unintentional compliance breaches for educational institutions. 152/189 ‘Targeting’ that are not strictly necessary for the service. For every cookie used, Qualtrics must provide a clear technical justification proving it is ‘Strictly necessary’ under Article 5(3) of the ePrivacy Directive. 153/189 Conclusion This DPIA identified 14 high and 1 low risks associated with the use of Qualtrics Design XM for Education.

> Topics: Cookies, Personal Data, DPIA, Education

### ¶223

The mitigating measures proposed in Part D by SURF, education instititions may view the measures that SURF suggested to mitigate some of the risks. These measures correspond to low risks and features that may be disabled by the institutions. The high risks are unlikely to be resolved without firm and concrete commitments from Qualtrics to implement approporiate technical and organisational measures at the vendor level. Throughout the DPIA process, SURF constantly seeked the best possible outcome of the DPIA, and engaged with Qualtrics at every stage of the project. While Qualtrics was not actively involved in the initial stages of the assessment, its review of the completed DPIA and identified risks let to a recognition of the value of more substantive participation. The vendor has not committed to implementing mitigating measures and has disputed the SURF’s risk classification. The high risks identified concern the following: the data agnostic approach, incomplete list of subprocessors, loss of control and transperancy due to the incomplete consent collection, incomplete cookie lists, and incomplete handling of the DSARs.

> Topics: DPIA, Consent

### ¶224

SURF’s objective is to ensure that the use of Qualtrics’ products by education customers within the Netherlands is fully compliant with the GDPR. As SURF is at the forefront of conductings and publishing DPIA outcomes of behalf of its members. Given the unresolved high risks identified, SURF urges education institutions to carefully consider the findings of this DPIA before continuing using Qualtrics’ platform. Should Qualtrics provide firm commitments to implement the necessary mitigating measures, SURF will update this assessment accordingly. 155/189 julian.rill@surf.nl Julian Rill julian.rill@surf.nl Brand Admini strator N/A N/A Bran d Adm in julian.rill+samhoog land@surf.nl Sam Hoogl and julian.rill+samhoo gland@surf.nl Standa rd - Qualtri cs Legal Resear ch Yes Rese arch er (C) N/A N/A N/A N/A N/A N/A N/A Ano nym ous Parti cipa nt N/A Sand er Noord julian.rill+sandern oord@surf.nl N/A N/A N/A Parti cipa nt (A) N/A Bo van Doorn julian.rill+bovand oorn@surf.nl N/A N/A N/A Parti cipa nt (B) Table 14 Accounts used during technical testing within Qualtrics 156/189 1.3 Scenario 1: Login and Authentication Business Processes This scenario involves business processes related to Identiteitenbeheer (Identity Management) , which focuses on managing and making available user data and their authorisations.

> Topics: DPIA, Access Controls, Identification

### ¶225

It also relates to Informatiebeveiliging (Information Security) , which ensures the continuity of information and information provision and limits the consequences of security incidents. Features Tested The features tested include Multi-Factor Authentication (MFA) , user login with email and password , and the option to “Remember this device for 30 days” . Qualtrics supports various authentication methods, including Native login and Single Sign-On (SSO), with MFA feasible for both. Actors • Researcher (A) Scenario Description A researcher attempts to log into the Qualtrics platform, providing their email address and password, and completing a two-factor authentication step, with the option to remember their device for future logins. Prerequisites • The Brand Administrator created an account for Researcher (A). Steps 1. Researcher (A): Navigates to the login page. 2. Researcher (A): Enters their email address and password, and clicks 'Log In'. 3.

> Topics: Access Controls, Identification, Information Provision Modalities and Communication Methods

### ¶226

Researcher (A): Enters their 2FA code, ticks 'Remember this device for 30 days', and clicks 'Log In'. 157/189 1.4 Scenario 2: Creating Qualtrics Projects Business Processes This scenario is primarily associated with Onderzoeksplanning (Research Planning) , which involves setting up a proposal for a study and submitting it for approval. It also broadly relates to Applicatie-ontwikkeling (Application Development) , as it involves developing application programs and data collections. Features Tested The features tested are the ability to “Create a new project” , specifically selecting the “Survey” project type , and the general process of “Create project” . Qualtrics allows users to start projects from scratch, enabling them to build their own questionnaires. Actors • Researcher (A) Scenario Description A researcher initiates the process of creating a new survey project within Qualtrics, navigating through the project creation interface to select the survey type and provide a name for their new project.

### ¶227

Prerequisites • Scenario 1 was executed. Steps 1. Researcher (A): Clicks ‘Create a new project’. 2. Researcher (A): Clicks ‘Survey’. 3. Researcher (A): Clicks ‘Get started’. 4. Researcher (A): Writes ‘Tech Survey’ and clicks ‘Create project’. 158/189 1.5 Scenario 3: Designing Surveys Business Processes This scenario is central to Onderzoeksuitvoering (Research Execution) , which involves the careful, verifiable, and systematic study of a specific issue to answer research questions. It also ties into Gegevensbeheer (Data Management) , which is about managing and making available data, and Informatiebeveiliging (Information Security) for sensitive data checks. Furthermore, Kwaliteitszorg Onderzoek (Research Quality Assurance) is relevant due to the use of ExpertReview to evaluate survey quality. Features Tested A wide range of question types and survey functionalities are tested, including basic multiple- choice questions , Meta Info questions (which collect background data like browser and operating system), Signature questions , File upload questions , Text box questions (specifically for sensitive data like bsn), CAPTCHA questions , and Video response questions with a recording time limit .

### ¶228

The scenario also tests the “Publish” functionality and the ExpertReview tool , including its ability to flag Sensitive Data Requests and provide recommendations for survey improvement. Actors • Researcher (A) Scenario Description A researcher constructs a survey by adding various question types, such as multiple-choice, meta info, signature, file upload, and open text fields for sensitive data like a bsn, along with Captcha and video response options. They also utilise the ExpertReview feature to check for potential issues and sensitive data requests before publishing the survey. Prerequisites • Scenario 2 was executed. Steps 1. Researcher (A): In the default question block, they enter ‘First question’, and answers ‘Answer 1’, ‘Answer 2’ and ‘Answer 3’. 2. Researcher (A): Clicks ‘Add new question’ and selects ‘Meta Info’. 3. Researcher (A): Clicks ‘Add new question’ and selects ‘Signature’. 4.

### ¶229

Researcher (A): Enters ‘Your signature please’ in the text box. 5. Researcher (A): Clicks ‘Add new question’ and selects ‘File upload’. 6. Researcher (A): Enters ‘Need a file’ in the text box. 7. Researcher (A): Clicks ‘Add new question’ and selects ‘Text box’ 8. Researcher (A): Enters ‘Your bsn please’ in the text box. 9. Researcher (A): Clicks ‘Add block’. 10. Researcher (A): In the new text box, clicks ‘Add new question’ and selects ‘Captcha’. 11. Researcher (A): Enters ‘Just a check’ in the text box. 12. Researcher (A): Clicks ‘Add new question’ and selects ‘Video response’. 13. Researcher (A): Enters ‘A nice video’ in the text box. 14. Researcher (A): Ticks ‘Recording time limit’. 15. Researcher (A): Clicks ‘Publish’. 159/189 16. Researcher (A): Clicks ‘View recommendations’ under ‘ExpertReview’. 17. Researcher (A): Closes the ExpertReview tab. 18. Researcher (A): Clicks ‘Publish’ again, enters ‘My tech survey’ as description, and clicks ‘Publish’ in the new window. 19.

### ¶230

Researcher (A): Clicks ‘Okay’. 160/189 1.6 Scenario 4: Configuring Survey Options Business Processes This scenario is primarily related to Informatiebeveiliging (Information Security) , which involves safeguarding information and information provision. It also pertains to Gegevensbeheer (Data Management) , as it defines how survey responses are handled, and Performancemanagement (Performance Management) , ensuring the organisation’s functioning aligns with set objectives. Features Tested The features tested include accessing “Survey options" , configuring “Responses” settings such as the time limit for incomplete responses, and enabling “Security” features like preventing multiple submissions , bot detection , and the security scan monitor . Additionally, the “Scoring” functionality is briefly accessed. Actors • Researcher (A) Scenario Description A researcher configures the operational settings of their survey, including its name and description, defining the timeout period for incomplete responses, and activating security measures such as preventing multiple submissions, detecting bots, and monitoring for security scans.

> Topics: Security, Monitoring, Information Provision Modalities and Communication Methods

### ¶231

Prerequisites • Scenario 3 was executed. Steps 1. Researcher (A): Clicks ‘Survey options’. 2. Researcher (A): Enters ‘The technical survey’ as name and ‘It's a simple survey really.’ as description. 3. Researcher (A): Clicks ‘Responses’. 4. Researcher (A): Under ‘How much time should pass before they’re considered incomplete?’, they select ‘1 Hour’. 5. Researcher (A): Clicks ‘Security’. 6. Researcher (A): Selects ‘In Survey: prevent multiple submissions’. 7. Researcher (A): Selects ‘Bot detection’. 8. Researcher (A): Selects ‘Security scan monitor’. 9. Researcher (A): Clicks ‘Scoring’. 10. Researcher (A): Clicks ‘Back to survey builder’. 161/189 1.7 Scenario 5: Distributing Surveys to Participants Business Processes This scenario aligns with Communicatiemanagement (Communication Management) , which ensures the organisation communicates appropriately with internal and external parties. If the distribution targets potential external participants, it also relates to Marktbewerking (Market Cultivation) , which involves specific actions and campaigns to reach target groups.

### ¶232

Features Tested The core features tested are the email distribution method and various social media distribution options, including LinkedIn, Facebook, and Twitter. Qualtrics allows users to send out questionnaires via email using either Qualtrics' mail servers or their own, and provides options for social media sharing. Actors • Researcher (A) Scenario Description A researcher distributes their survey to participants through multiple channels, specifically sending it via email and sharing it on various social media platforms like LinkedIn, Facebook, and Twitter. Prerequisites • Scenario 4 was executed. Steps 1. Researcher (A): Clicks 'Distributions'. 2. Researcher (A): Clicks 'Distribute survey'. 3. Researcher (A): Clicks 'Generate a traceable link for each contact'. 4. Researcher (A): Selects 'Lists' and then 'New Contact List'. 5. Researcher (A): Enters the following contact information: 6.

> Topics: Social Media

### ¶233

Email: julian.rill+sandernoord@surf.nl, julian.rill+bovandoorn@surf.nl 7. First Name: Sander, Bo 8. Last Name: Noord, van Doorn 9. Researcher (A): Clicks 'Create'. 10. Researcher (A): Clicks 'Generate Links'. This will download a .csv file with the links. 11. Researcher (A): Clicks 'Anonymous link'. 12. Researcher (A): Clicks 'Copy survey link.' This resulted in: https://surftest.qualtrics.com/jfe/form/SV_3yljFEIimPrABSK 13. Researcher (A): Clicks 'Social media'. 14. Researcher (A): Clicks 'LinkedIn'. 15. Researcher (A): Clicks 'Facebook'. 16. Researcher (A): Clicks 'Twitter'. 17. Researcher (A): Logs out. 162/189 1.8 Scenario 6: Anonymously Answering Surveys Business Processes This scenario is a direct part of Onderzoeksuitvoering (Research Execution) , focusing on the data collection aspect of a study. It also relates to Informatiebeveiliging (Information Security) and Gegevensbeheer (Data Management) due to the emphasis on anonymous responses and the collection of potentially sensitive data.

> Topics: Social Media

### ¶234

Features Tested The testing involves opening and interacting with an anonymous survey link , providing input for signature , file upload , and text box questions (including sensitive data like bsn). It also tests the functionality of reCAPTCHA and video response recording , while ensuring the anonymity of the participant. Qualtrics offers features for anonymous responses by setting minimum anonymity thresholds for data points and comments. Actors • Anonymous Participant Scenario Description An anonymous participant accesses a survey via a public link and provides responses, including a signature, file upload, text input with sensitive data, and a video response, while also completing a reCAPTCHA challenge. Prerequisites • Scenario 5 was executed. Steps 1. Anonymous Participant: Opens the anonymous link. 2. Anonymous Participant: Selects Answer 1, enters a random signature and uploads the file Sample Document - SURF.pdf. 3.

### ¶235

Anonymous Participant: Closes the tab of the questionnaire. 4. Anonymous Participant: Reopens the anonymous link. 5. Anonymous Participant: Re-enters the previously mentioned data, in addition with the bsn 123456782. 6. Anonymous Participant: Clicks the '->' button. 7. Anonymous Participant: Closes the tab of the questionnaire. 8. Anonymous Participant: Reopens the anonymous link. 9. Anonymous Participant: Checks the reCAPTCHA. 10. Anonymous Participant: Clicks 'Record video'. 11. Anonymous Participant: Clicks the '->' button. 163/189 1.9 Scenario 7: Survey Answering via Targeted Links Business Processes Like anonymous response, this is part of Onderzoeksuitvoering (Research Execution) and Gegevensverwerking en -analyse (Data Processing and Analysis) . Given the use of personalized links, it also touches upon Identiteitenbeheer (Identity Management) , as it implies managing user accounts and authorisations.

> Topics: Access Controls

### ¶236

Features Tested The scenario tests interaction with a personalized survey link . The response process involves providing input for various question types, including multiple-choice , signature , file upload , text box (specifically for bsn), reCAPTCHA , and video recording . This tests how Qualtrics handles individual participant data collection when a traceable link is used. Actors • Participant (A) • Participant (B) Scenario Description Two distinct participants access and complete a survey using their unique, personalized links, providing various forms of input including sensitive data, demonstrating the system's behavior for targeted survey collection. Prerequisites • Scenario 5 was executed. Steps 1. Participant (A): Opens their personalised link. 2. Participant (A): Selects Answer 2, enters a random signature and uploads the file ‘Sample Document - SURF.pdf’. 3. Participant (A): Reopens the anonymous link. 4.

### ¶237

Participant (A): Enters the bsn 123456782. 5. Participant (A): Clicks the '->' button. 6. Participant (A): Checks the reCAPTCHA. 7. Participant (A): Clicks 'Record video'. 8. Participant (A): Clicks the '->' button. After completing steps 1 until 8, repeat the exact same steps for actor Participant (B). 164/189 1.10 Scenario 8: Data Analysis on Survey Results Business Processes This scenario is deeply embedded in Gegevensverwerking en -analyse (Data Processing and Analysis) , which covers extracting, converting, cleaning, ordering, analysing, and interpreting collected research data. It also relates to Kwaliteitszorg Onderzoek (Research Quality Assurance) for evaluating research against quality criteria, and Informatiemanagement (Information Management) for reporting information to stakeholders. Features Tested The analysis features tested include viewing “Results” , utilising the “Data Analysis” module, examining “Response Quality” to identify issues like gibberish or non-descriptive text, performing Text iQ analysis for text interpretation, and conducting Stats iQ analysis , which includes Crosstabs iQ and Weighting for statistical insights.

### ¶238

Additionally, the ability to review “Audio & video” responses is tested. Actors • Researcher (A) Scenario Description A researcher performs comprehensive data analysis on survey results, specifically reviewing video responses, evaluating response quality, and conducting text analysis using Text iQ. They then apply statistical methods with Stats iQ, including crosstabs and weighting, to gain deeper insights from the collected data. Prerequisites • Scenarios 6 and 7 were executed. Steps 1. Researcher (A): Logs in. 2. Researcher (A): Under 'Active surveys', clicks 'Results'. 3. Researcher (A): Clicks one of the videos under 'A nice video'. 4. Researcher (A): Clicks 'Data Analysis'. 5. Researcher (A): Clicks 'Response Quality'. 6. Researcher (A): Clicks 'Text iQ' 7. Researcher (A): Clicks 'Your bsn please' and then 'Finish'. 8. Researcher (A): Clicks 'Update'. 9. Researcher (A): Clicks 'Stats iQ'. 10.

### ¶239

Researcher (A): Clicks 'Crosstabs iQ' 11. Researcher (A): Clicks 'Weighting' 12. Researcher (A): Clicks 'Audio & video' 166/189 Healthcare Solutions – EX Private Off Off Manage Location Data On On Access TotalXM Reporting Project On Off Card Sorting Solution On On Index Content to Research Hub On On Use Alternative Method To Purchase Online Samples Off Off Use Qualtrics Tickets On On Use CX Dashboards On On Manage Journeys On Off Create CX Projects On On Manage Qualtrics Tickets Off Off Qualtrics Tickets Admin Off Off Manage CX Users On Off Stats iQ – Individual User Off Off Stats iQ – Individual User – Describe Off Off Stats iQ – Individual User – Relate Off Off Stats iQ – Individual User – Pivot Tables Off Off Stats iQ – Individual User – Regression Off Off Stats iQ – Individual User – Cluster Off Off Stats iQ - R Integration Off Off 167/189 Use Crosstabs – Individual User Off Off Predict iQ – Individual User Off Off Use Response Weighting On On Use Imported Data Projects On Off Choice Based Conjoint On On Create Frontline Feedback Projects On Off MaxDiff On On Create Brand Tracker Projects Off Off Create Brand Tracker Programmes Off Off Create Brand Lift Premium Projects Off Off Customise Email Headers Off Off Create Brand Experience Projects Off Off Create BX Dashboards Project Off Off Use Brand Drivers Analysis Simulator Off Off View Online Sample waves and reporting Off Off Purchase Online Samples Off Off Purchase Online Samples Soft Launch Off Off Manage Online Sample Pricing Off Off Purchase Allocations for Online Samples Off Off 168/189 Manage Online Samples survey allocations Off Off Manage Workflows Across Projects On On Manage Online Samples Templates Off Off Modify SES Resources Off Off Access Data & Analysis - Data On On Access Data & Analysis – Audio & Video Off Off COVID-19 Brand Trust Pulse On On COVID-19 Dynamic Call Centre Script On On COVID-19 Customer Confidence Pulse On On Remote Educator Pulse On On Public Health: COVID-19 Pre- Screen & Routing On On Healthcare Workforce Pulse On On Higher Education: Remote Learning Pulse On On K-12 Education: Remote Learning Pulse On On Remote + On-Site Work Pulse On On Return to Work Pulse On On Supply Continuity Pulse On On Customer Confidence Pulse On On Digital Open Door On On Frontline Connect On On 169/189 Manage Customer Care Widgets On On Use QClassroom - Course Evaluations Off Off New Three Sixty Reports Off Off Access EX Candidate Experience Programme On Off Create Idea Screening Projects On On Can Change Custom Solution Access Type On Off Manage Custom Solutions On Off Manage Data Access Control Off Off Create Concept Testing Projects On On Manage Vanity Domains On Off Create Audience Management Solutions On On Create Conjoint Dynamic Images Solutions On On Use Vaccination Status Manager Solution On On Allow Widget Pinning On On View New User Navigation Tour On On Embedded Widgets On On Embedded Dashboards On On Tiered Workflows Off Off Create Reputation Management Project On Off Manage BX Users Off Off 170/189 Use Outer Loop Projects Off Off Create Outer Loop Projects Off Off Use Credit Union CX Solution Off Off Healthcare Certified Questions Off Off Magnet Programs Off Off Use Customer Experience Program On Off Use Search Report Off Off Use BXM Report Off Off Search Research Hub Off Off Access Online Panel On On Create Public Audio & Video Links On On Access Research Hub Off Off Access Research Hub Collections Off Off Access Research Hub Manage Research Off Off Enable SFDC App Off Off Translate Surveys with Amazon Translate On On Use Social Channels Off Off Push to Translation Hub Off Off Enable Brand Management Hub Off Off Manage Voice Pipelines Off Off Access EX Benchmarks Off Off Edit XM Directory Off Off 183/189 Scenario 2 www.google-analytics.com N/A Google LLC NL Scenario 2 www.googletagmanager.com N/A Google LLC NL Scenario 2 sr-client-cfg.amplitude.com N/A Amazon.com, Inc. NL Scenario 2 sr-client-cfg.amplitude.com N/A Amazon.com, Inc. NL Scenario 2 www.xm-apps-static.com N/A Akamai Technologies, Inc. NL Scenario 2 surftest.qualtrics.com N/A AKAM1-RIPE- MNT NL Scenario 2 siteintercept.qualtrics.com N/A Cloudflare, Inc. US Scenario 2 zn0xmxq4camg7mvzh- qxm.siteintercept.qualtrics.com N/A Cloudflare, Inc. US Scenario 2 zn0xmxq4camg7mvzh- qxm.siteintercept.qualtrics.com N/A Cloudflare, Inc. US Scenario 2 region1.google-analytics.com N/A Google LLC US Scenario 2 data.pendo.io N/A Google LLC US Scenario 2 cdn.pendo.io N/A Google LLC US Scenario 2 api.amplitude.com N/A Amazon.com, Inc. US Scenario 2 api2.amplitude.com N/A Amazon.com, Inc. US Scenario 2 api2.amplitude.com N/A Amazon.com, Inc. US Scenario 3 content-autofill.googleapis.com 4 Google LLC NL Scenario 3 surftest.qualtrics.com 255 AKAM1-RIPE- MNT NL Scenario 3 data.pendo.io 57 Google LLC US 184/189 Scenario 3 api.amplitude.com 18 Amazon Technologies Inc. US Scenario 4 www.googletagmanager.com 1 Google LLC NL Scenario 4 content-autofill.googleapis.com 2 Google LLC NL Scenario 4 www.google-analytics.com 3 Google LLC NL Scenario 4 sr-client-cfg.amplitude.com 2 Amazon.com, Inc. NL Scenario 4 www.xm-apps-static.com 2 Akamai Technologies, Inc. NL Scenario 4 surftest.qualtrics.com 211 AKAM1-RIPE- MNT NL Scenario 4 pendo-static- 4743056171335680.storage.googleapi s.com 4 Google LLC NL Scenario 4 zn0xmxq4camg7mvzh- qxm.siteintercept.qualtrics.com 2 Cloudflare, Inc. US Scenario 4 siteintercept.qualtrics.com 3 Cloudflare, Inc. US Scenario 4 region1.google-analytics.com 2 Google LLC US Scenario 4 data.pendo.io 21 Google LLC US Scenario 4 api2.amplitude.com 2 Amazon Technologies Inc. US Scenario 4 cdn.pendo.io 1 Google LLC US Scenario 4 api.amplitude.com 12 Amazon Technologies Inc. US Scenario 5 www.google-analytics.com 2 Google LLC NL Scenario 5 content-autofill.googleapis.com 9 Google LLC NL Scenario 5 www.googletagmanager.com 1 Google LLC NL 185/189 Scenario 5 pendo-static- 4743056171335680.storage.googleapi s.com 2 Google LLC NL Scenario 5 platform.twitter.com 2 Fastly, Inc. NL Scenario 5 abs.twimg.com 204 Fastly, Inc. NL Scenario 5 sr-client-cfg.amplitude.com 3 Amazon.com, Inc. NL Scenario 5 surftest.qualtrics.com 670 AKAM1-RIPE- MNT NL Scenario 5 facebook.com 2 meta-mnt, Meta Platforms Ireland Limited, RIPE- NCC-LEGACY- MNT NL Scenario 5 www.facebook.com 4 meta-mnt, Meta Platforms Ireland Limited, RIPE- NCC-LEGACY- MNT NL Scenario 5 static.xx.fbcdn.net 19 meta-mnt, Meta Platforms Ireland Limited, RIPE- NCC-LEGACY- MNT NL Scenario 5 zn0xmxq4camg7mvzh- qxm.siteintercept.qualtrics.com 3 Cloudflare, Inc. US Scenario 5 siteintercept.qualtrics.com 4 Cloudflare, Inc. US Scenario 5 abs-0.twimg.com 1 Twitter Inc. US Scenario 5 static.licdn.com 12 Fastly, Inc. US 186/189 Scenario 5 twitter.com 1 Cloudflare, Inc. US Scenario 5 api.x.com 15 Cloudflare, Inc. US Scenario 5 www.linkedin.com 19 Cloudflare, Inc. US Scenario 5 platform.linkedin.com 1 Cloudflare, Inc. US Scenario 5 syndication.twitter.com 1 Cloudflare, Inc. US Scenario 5 x.com 2 Cloudflare, Inc. US Scenario 5 region1.google-analytics.com 2 Google LLC US Scenario 5 data.pendo.io 24 Google LLC US Scenario 5 api2.amplitude.com 9 Amazon Technologies Inc. US Scenario 5 cdn.pendo.io 1 Google LLC US Scenario 5 api2.amplitude.com 2 Amazon Technologies Inc. US Scenario 6 update.googleapis.com 1 Google LLC NL Scenario 6 clientservices.googleapis.com 1 Google LLC NL Scenario 6 translate.googleapis.com 1 Google LLC NL Scenario 6 tools.google.com 1 Google LLC NL Scenario 6 optimizationguide-pa.googleapis.com 1 Google LLC NL Scenario 6 content-autofill.googleapis.com 2 Google LLC NL Scenario 6 apis.google.com 1 Google LLC NL Scenario 6 sr-client-cfg.amplitude.com 1 Amazon.com, Inc. NL 187/189 Scenario 6 use.typekit.net 1 AKAM1-RIPE- MNT NL Scenario 6 s.qualtrics.com 1 AKAM1-RIPE- MNT NL Scenario 6 www.qualtrics.com 6 AKAM1-RIPE- MNT NL Scenario 6 surftest.qualtrics.com 86 AKAM1-RIPE- MNT NL Scenario 6 ogads-pa.clients6.google.com 6 Google LLC NL Scenario 6 android.clients.google.com 1 Google LLC NL Scenario 6 siteintercept.qualtrics.com 1 Cloudflare, Inc. US Scenario 6 zncydxfem8jrupnsj- qwebsite.siteintercept.qualtrics.com 1 Cloudflare, Inc. US Scenario 6 client-registry.mutinycdn.com 1 Fastly, Inc. US Scenario 6 data.pendo.io 2 Google LLC US Scenario 6 api2.amplitude.com 2 Amazon Technologies Inc. US Scenario 7 content-autofill.googleapis.com 2 Google LLC NL Scenario 7 tools.google.com 1 Google LLC NL Scenario 7 content-autofill.googleapis.com 2 Google LLC NL Scenario 7 apis.google.com 2 Google LLC NL Scenario 7 surftest.qualtrics.com 61 AKAM1-RIPE- MNT NL Scenario 7 ogads-pa.clients6.google.com 5 Google LLC NL Scenario 8 update.googleapis.com 3 Google LLC NL Scenario 8 content-autofill.googleapis.com 6 Google LLC NL Scenario 8 www.google-analytics.com 2 Google LLC NL Scenario 8 csp.withgoogle.com 1 Google LLC NL 188/189 Scenario 8 tools.google.com 1 Google LLC NL Scenario 8 pendo-static- 4743056171335680.storage.googleapi s.com 10 Google LLC NL Scenario 8 clientservices.googleapis.com 8 Google LLC NL Scenario 8 www.googletagmanager.com 1 Google LLC NL Scenario 8 content-autofill.googleapis.com 1 Google LLC NL Scenario 8 passwordsleakcheck- pa.googleapis.com 2 Google LLC NL Scenario 8 sr-client-cfg.amplitude.com 2 Amazon.com, Inc. NL Scenario 8 sr-client-cfg.amplitude.com 3 Amazon.com, Inc. NL Scenario 8 sr-client-cfg.amplitude.com 7 Amazon.com, Inc. NL Scenario 8 www.xm-apps-static.com 4 Akamai Technologies, Inc. NL Scenario 8 use.typekit.net 2 AKAM1-RIPE- MNT NL Scenario 8 p.typekit.net 1 AKAM1-RIPE- MNT NL Scenario 8 accounts.qualtrics.com 2 AKAM1-RIPE- MNT NL Scenario 8 s.qualtrics.com 2 AKAM1-RIPE- MNT NL Scenario 8 www.qualtrics.com 9 AKAM1-RIPE- MNT NL Scenario 8 static-assets.qualtrics.com 27 AKAM1-RIPE- MNT NL Scenario 8 surftest.qualtrics.com 3378 AKAM1-RIPE- MNT NL Scenario 8 content-autofill.googleapis.com 1 Google LLC NL 189/189 Scenario 8 pendo-static- 4743056171335680.storage.googleapi s.com 5 Google LLC NL Scenario 8 api2.amplitude.com 17 Amazon.com, Inc. US Scenario 8 zncydxfem8jrupnsj- qwebsite.siteintercept.qualtrics.com 1 Cloudflare, Inc. US Scenario 8 zn0xmxq4camg7mvzh- qxm.siteintercept.qualtrics.com 11 Cloudflare, Inc. US Scenario 8 siteintercept.qualtrics.com 21 Cloudflare, Inc. US Scenario 8 zncydxfem8jrupnsj- qwebsite.siteintercept.qualtrics.com 1 Cloudflare, Inc. US Scenario 8 siteintercept.qualtrics.com 3 Cloudflare, Inc. US Scenario 8 zn0xmxq4camg7mvzh- qxm.siteintercept.qualtrics.com 6 Cloudflare, Inc. US Scenario 8 cdn.jsdelivr.net 1 Fastly, Inc. US Scenario 8 client-registry.mutinycdn.com 4 Fastly, Inc. US Scenario 8 client-registry.mutinycdn.com 1 Fastly, Inc. US Scenario 8 region1.google-analytics.com 1 Google LLC US Scenario 8 edgedl.me.gvt1.com 2 Google LLC US Scenario 8 data.pendo.io 69 Google LLC US Scenario 8 api2.amplitude.com 26 Amazon Technologies Inc. US Scenario 8 cdn.pendo.io 5 Google LLC US Scenario 8 api.amplitude.com 5 Amazon Technologies Inc. US

> Topics: Social Media, Access Controls

---
Generated by overview.legal · https://overview.legal/posts/615083 · 2026-11-14