NSFAS ObservatoryReport

Privacy Notice

NSFAS Observatory

Last updated: July 2026

1. Introduction

The NSFAS Observatory is a platform that collects information about issues experienced by students in relation to the National Student Financial Aid Scheme (NSFAS).

The purpose of the platform is to help students, civil society organisations, researchers, institutions, policymakers, and other stakeholders understand the nature, scale, and distribution of NSFAS-related challenges.

The NSFAS Observatory is a research, monitoring, and public-interest data project. It is not a complaints portal, case management system, or official NSFAS support service.

This Privacy Notice explains how we collect, use, store, and share personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA).

2. Information We Collect

When you submit an issue through the NSFAS Observatory, we may collect:

Personal Information

  • Full name
  • Email address
  • Phone number
  • WhatsApp number (if provided)
  • Institution
  • Student number
  • Course or programme of study
  • Year of study

Issue Information

  • Issue category
  • Description of the issue
  • Duration of the issue
  • Reported impacts of the issue
  • Status updates submitted by you

Consent Information

We record:

  • Which consent options you selected
  • The date and time consent was given
  • The version of the consent wording presented at the time

Proof of registration documents

If you verify your student status by uploading a proof-of-registration document, we collect:

  • The document image (PDF, JPG or PNG)
  • Extracted fields: your name, student number and institution name
  • A hash of the document and of the student number for duplicate detection

We use automated verification tools to confirm the document is a valid registration document and extract the relevant fields. The operating team may view the document image to check accuracy and identify any issues with the system.

The document image is retained for up to 7 days and then deleted. We keep the extracted fields and verification outcome for record-keeping.

We do not collect South African ID numbers.

3. Why We Collect Information

We collect information in order to:

  • Record student-reported NSFAS issues
  • Produce aggregate statistics and public reporting
  • Identify trends and recurring challenges
  • Support evidence-based engagement with institutions, government, civil society, and other stakeholders
  • Contact users where consent has been provided
  • Improve the quality and reliability of the Observatory's data

4. Legal Basis for Processing

The NSFAS Observatory processes personal information on the basis of:

  • Your consent;
  • Legitimate public-interest research and monitoring activities; and
  • The operation of the platform for the purposes described in this notice.

You may choose not to provide certain optional information, although this may limit some functionality.

5. Public Dashboard and Anonymisation

The public dashboard displays only aggregated information.

The dashboard does not display:

  • Names
  • Student numbers
  • Phone numbers
  • Email addresses
  • WhatsApp numbers
  • Any other directly identifying information

Public reports and visualisations are designed to present trends and statistics rather than information about individual students.

6. Sharing of Information

Your information may be shared only in accordance with the consent options you select.

Institutions

If you consent, your information may be shared with your institution for follow-up or research purposes.

Department of Higher Education and Training (DHET)

If you consent, your information may be shared with the Department of Higher Education and Training.

Service Providers

We may use trusted service providers to host, secure, or process platform data on our behalf.

These providers may only process information as necessary to provide those services.

Legal Obligations

Information may be disclosed where required by law.

7. WhatsApp Contact

If you provide a WhatsApp number and consent to WhatsApp contact, we may send messages relating to updates, follow-up requests, surveys, or issue-status tracking.

You may withdraw this consent at any time.

8. Data Security

We take reasonable technical and organisational measures to protect personal information against:

  • Loss
  • Unauthorised access
  • Unauthorised disclosure
  • Alteration
  • Destruction

Access to identifiable records is restricted to authorised administrators.

9. Cross-Border Processing and Storage

The digital systems, cloud services, and technology platforms used to operate the NSFAS Observatory may process or store personal information on servers located outside the Republic of South Africa.

As a result, personal information may be transferred to, stored in, or processed in jurisdictions whose data protection laws may differ from those applicable in South Africa.

Where personal information is transferred outside South Africa, the NSFAS Observatory will take reasonable steps to ensure that appropriate safeguards are in place and that any such transfer is undertaken in accordance with the requirements of section 72 of the Protection of Personal Information Act, 2013 (POPIA).

By using the NSFAS Observatory and submitting information through the platform, you acknowledge that your information may be processed using systems that operate across multiple jurisdictions, subject to the safeguards described in this Privacy Notice.

10. Data Retention

Information will be retained only for as long as reasonably necessary to:

  • Operate the Observatory;
  • Produce reports and analysis;
  • Maintain data integrity;
  • Meet legal or regulatory requirements.

Data may be anonymised and retained for research and statistical purposes.

11. Your Rights

Under POPIA, you may have the right to:

  • Request access to your personal information;
  • Request correction of inaccurate information;
  • Request deletion of information where appropriate;
  • Withdraw consent for optional processing activities;
  • Object to certain forms of processing;
  • Lodge a complaint with the Information Regulator.

12. Updating Your Information

The Observatory provides a mechanism for users to update information previously submitted.

Users may update issue details, provide developments, and indicate whether an issue has been resolved.

13. Age Restrictions

The NSFAS Observatory is intended for students enrolled at recognised higher education institutions who are 18 years of age or older.

Individuals under the age of 18 may not submit reports through the platform.

By submitting information to the NSFAS Observatory, you confirm that you are at least 18 years old.

If we become aware that information has been submitted by a person under the age of 18, we may remove that information from our systems and take reasonable steps to prevent further processing.

14. Changes to this Privacy Notice

This Privacy Notice may be updated from time to time.

Material changes will be reflected on this page together with an updated revision date.

15. Contact

Questions about this Privacy Notice or requests relating to personal information may be directed here.

16. Information Regulator

If you believe your personal information has been handled unlawfully, you may lodge a complaint with the Information Regulator (South Africa).

Information Regulator (South Africa)
Website: https://inforegulator.org.za/

17. Pilot Notice

The NSFAS Observatory is currently being piloted in Gauteng. Functionality, processes, governance arrangements, and policies may be refined as the platform develops and expands.