Guidance

General Data Protection Regulation: learning records service (LRS)

Updated 15 September 2021

Applies to England, Northern Ireland and Wales

© Crown copyright 2021

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/lrs-help-and-support/general-data-protection-regulation-learning-records-service-lrs

1. General Data Protection Regulation (GDPR)

The General Data Protection Regulation (GDPR) comes into force on the 25th May 2018. It regulates the processing of personal data inside the EU and EU residents. GDPR replaces the Data Protection Act 1998 in the UK.

In order to incorporate recent changes in data protection regulation, as well as our commitment to transparency, we have updated our Privacy Notice on GOV.UK.

The revised privacy notice clearly communicates to individuals the lawful basis for processing their personal data, summarising the information held on record about them, why it’s held and the third parties the data is shared with.

2. Implications of GDPR changes

To meet the requirements of GDPR, local authorities, schools, academies, Further Education institutes and Higher Education (referred to as Learner Registration Bodies (LRB) by LRS) continue to be responsible for issuing a copy of the privacy notice to learners and/or parents/guardians.

For the purposes of relevant data protection legislation permitted organisations registered with LRS do not require consent from learners/citizens to issue a ULN or share their PLR. Going forward learner/citizens won’t have the option to opt out of sharing their PLR.

Historically, where a learner/citizen has opted out of sharing their PLR, the flag will remain in place. Post 25th May, where an LRB needs access to an individual’s PLR, the organisation is responsible for informing the learner/citizen in accordance with the revised agreement that it will access the PLR and the basis for accessing the data by providing a copy of the latest privacy notice. Only at that point does the LRB have the right to overwrite the consent status that allows them to view the record.

3. Important Information

  • LRB’s must provide a copy of the Privacy Notice to the learner.

  • By default, the PLR is available to permitted organisations where the Privacy Notice is provided.

  • Learner’s cannot opt out of sharing their PLR.

4. Further Changes

There are further changes required over the next 12-months:

  • System changes to the LRS Organisation Portal. (No immediate change to web service operations. These will continue to be backward compatible).

  • Amendment to all agreements including Provider and Awarding Organisation.

  • Amendment to user-guides.

  • Publish new web service operations versions.

5. Question

How do I comply?

LRB’s currently send the consent status to LRS containing one of three values:

  1. Privacy notice not seen – unable to share.
  2. Privacy notice seen and able to share.
  3. Privacy notice seen and unable to share (learner has opted out). Under the new consent model, this option no longer applies.

For the immediate time, please only use option 1 or 2.

Further comms to follow confirming portal changes to reflect the new consent model.

Back to top