Technical privacy assessment of Qualtrics

I led the technical investigation for SURF’s umbrella Data Protection Impact Assessment (DPIA) of Qualtrics DesignXM, working with colleagues to assess the platform as used by Dutch higher education and research institutions. The scope covered DesignXM survey and experience-management use; Qualtrics CoreXM and Qualtrics AI Response were out of scope. The investigation combined document review and vendor engagement with scripted testing in a Qualtrics-provided environment based on institutional use cases.

The technical scenarios followed the survey lifecycle: account login and authentication, project creation, survey design and configuration, distribution, anonymous and targeted-link responses, and analysis of results. We captured and analysed network traffic and mapped service endpoints, then compared the observed connections with Qualtrics’ disclosed subprocessors. The assessment also examined data collection and anonymisation, cookie and consent behaviour, sensitive-data detection, translation integrations, retention, and the ability to retrieve personal data through data subject access requests.

SURF’s published assessment identified 14 high risks and one low risk. Its principal concerns included uncertainty about Qualtrics’ roles and processing purposes, incomplete subprocessor and cookie transparency, limited institutional control over consent and some data flows, and shortcomings in responding to access requests. The technical analysis also raised questions about whether anonymisation and sensitive-data detection could be independently assessed, and about Dutch-specific identifiers such as BSNs. The report proposed mitigations for institutions, but concluded that the high risks required firm vendor-level commitments that had not been made at publication. SURF therefore gave negative advice for the assessed setup and advised members to consider the findings in the context of their own processing.

Qualtrics disagreed with a number of SURF’s findings and risk classifications, including SURF’s characterisation of the vendor’s role, and provided a dissenting opinion included in the DPIA. The project records SURF’s umbrella assessment and the vendor’s stated position; each institution remains responsible for assessing its own use.