A DPIA is a standard requirement under the General Data Protection Regulation (GDPR): it examines how a service handles personal data and identifies where safeguards can be strengthened. The results of this assessment were shared with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) on 1 September 2026.

The assessment identified several points that require further attention. Maastricht University takes these findings seriously and is working with SURF to assess their implications and determine appropriate follow-up measures. Our institute has a direct contract and Data Processing Agreement with Qualtrics containing agreements on the processing and protection of personal data.

At the same time, we are looking ahead. We are in contact with SURF on the longer-term development of survey solutions for Dutch higher education and are starting preparations for the procurement of a future survey platform. Privacy, security and greater institutional control over data will be important considerations in that process.

In the meantime, users can continue using Qualtrics. Make sure you follow the existing guidelines, in particular by collecting only the personal data you genuinely need for your survey and taking extra care with sensitive information. If your research involves special categories of personal data, please consult your data steward / privacy officer before you begin.

We will share more specific guidance once the follow-up actions have been finalised. If you have questions in the meantime, please contact the Qualtrics support team via the contact form below.

This field is for validation purposes and should be left unchanged.