As of January 2026 the WRDSB has begun to use SimpleSurvey as a survey data collection tool. In the fall of 2025, ITS, Privacy and Research Leads at the Waterloo Region District School Board (WRDSB) collaborated to conduct a data security and privacy review of the SimpleSurvey survey platform in accordance with WRDSB Administrative Procedure 4115 Online Educational and Business Tools. SimpleSurvey is a Canadian-based online tool used to conduct surveys and collect data and is widely implemented throughout the public sector in Ontario and across Canada.

SimpleSurvey has signed a Data Protection Obligations agreement with the WRDSB.

Please find below a summary of the key findings of that review and the protocols the WRDSB has put in place to further supplement the policies and practices of SimpleSurvey.

Data Security and Privacy Summary of SimpleSurvey

Data Security

  • SimpleSurvey uses a range of secure processes to ensure that data collected and stored in SimpleSurvey can never be accessed by unauthorized users. Their processes include:
    • Data access is restricted to authorized users within the platform
    • Data is encrypted at rest and in transit (TLS 1.2 or higher, AES-128 or stronger).
    • All Client and Survey Data are hosted exclusively in Canada, in secure data centers managed by a Canadian-based infrastructure provider that has undergone a SOC 2 Type 2 audit and holds ISO 27001 certification.
    • SimpleSurvey applies layered physical, technical, and organizational security measures, including:
      • Strong authentication and least-privilege access controls;
      • Encryption, firewalls, and intrusion detection systems;
      • Employee confidentiality agreements and regular privacy/security training;
      • Access-log reviews;
      • Governance policies such as the Information-Security Policy and Employee Code of Conduct.

Protection of Personal Information

  • “Personal information” means any information that relates to an identifiable individual, either directly or indirectly.
  • Only authorized SimpleSurvey users (that is, members of the WRDSB Research Department) have access to personal information that is collected and stored in the SimpleSurvey platform
  • Personal information gathered with SimpleSurvey is collected directly by the WRDSB Research Department. SimpleSurvey does not access, use, or disclose such data except as necessary to provide technical support, ensure security, or comply with legal obligations.

In response to the findings of our privacy and data security review the WRDSB has taken the following steps to ensure that we prioritize the privacy and confidentiality of all the data we collect through SimpleSurvey:

  • The WRDSB restricts access to all data held within the SimpleSurvey platform to members of the WRDSB Research Department (using multi-factor authentication).
  • The WRDSB communicates to participants in a questionnaire that uses SimpleSurvey how the data will be used and who will be able to see which data and in what format.
  • The WRDSB communicates to all students, staff, and families that participation in all data collection through the SimpleSurvey platform is voluntary.
  • The WRDSB carefully considers if personal or sensitive information is needed to support WRDSB programs and/or Ministry requirements. We will not collect data through the SimpleSurvey platform that is not needed to support accountability and/or decision-making related to WRDSB policies, programs, or initiatives.

About SimpleSurvey

For more details on SimpleSurvey’s data security and privacy practices, please review the terms of use and the privacy policy documentation shared publicly by SimpleSurvey.

If you have any questions about how the WRDSB uses SimpleSurvey and the privacy and data security protocols we have in place, please feel welcome to reach out to our Privacy and Records Management (privacy@wrdsb.ca) or the Research Department (research@wrdsb.ca).