Guidance

Core Principles: school MIS procurement

Updated 17 July 2026

Applies to England

Core Principles

As part of their procurement process, schools should include these Core Principles and ask all potential suppliers to:

a. Confirm their acceptance of the Core Principles as a condition of participating in the procurement.
b. Confirm that their terms and conditions and any other documentation that will form part of the contract between the school and the supplier (“Contract”) reflect the Core Principles.
c. Agree that, to the extent that there is any conflict between the contents of the Contract and the Core Principles, the Core Principles will take precedence.

In line with paragraph (b), in the first instance the Contracts ought to reflect the Core Principles from the outset. This will ensure certainty and avoid any conflict between the Contract and the Core Principles. Paragraph (c) is a fall-back if that has not been done and therefore rather than creating uncertainty, this paragraph provides clarity by establishing a clear hierarchy of terms.

School MIS supply: Core Principles

Supplier and system standards

The supplier must hold cyber essentials plus accreditation and/or ISO 27001 or be working towards such accreditation, with completion due by spring 2027 at the latest.

The supplier must provide clear, transparent pricing to the School as part of its tender and, in any event, before entering into the Contract. This must identify what is included in the core provision, any optional or modular bolt-ons, and all third-party integrations, including whether each integration is one-way, two-way or via an aggregator.

Fair contract terms

The Contract can automatically renew at the end of its contract term, but only once for a maximum of 12 months (“Additional Term”).  The Contract must automatically terminate at the end of the Additional Term, and not “auto-renew” again. As a minimum, the Supplier should, by written notice to the email address and postal address specified in the Contract for the School’s designated representative, contact the School at least 6 months ahead of the initial contract expiry date and Additional Term to start the extension, re-procurement or termination process.

The Supplier acknowledges that only the School’s designated representative may sign, agree and vary the contract. The Contract can include a term that a school’s signatory confirms they are authorised to sign on behalf of the school.  A school’s designated representative is defined as:

• For maintained schools: the local authority’s procurement officer or the school’s delegated budget holder
• For multi-academy trusts: the CEO, the CFO, or any other officer with delegated authority under the trust’s scheme of delegation.
• For all other schools: the headteacher, school business manager, or a governor with delegated financial authority.

The Contract must allow notices to be served both electronically or in hardcopy. The email address for electronic notices must be clearly stated in the Contract. For a notice that is served:

• electronically, the notice will be deemed served on the date that it is emailed to the email address stated in the contract, provided that the notice was despatched in a legible and complete form to the correct e-mail address without any error message
• by post, the notice will be deemed to be served on the date two working days after it is posted.

These provisions for the service of contractual notices do not apply to the service of legal proceedings which shall be governed by the applicable procedural rules.

Clickwrap or portal acceptance will not constitute valid agreement of a Contract between the School and the Supplier. This does not preclude the use of electronic signature platforms that comply with applicable electronic signature legislation, nor does it apply to routine administrative or operational changes that do not affect either party’s material rights or obligations. Changes relating to termination, pricing, scope, duration, liability or service levels will be treated as material.

Contracts must not be longer than 3 years (including any Additional Term).

Where the School procures support services directly from the Supplier under a separate support contract, the support contract must be co-terminus with the MIS Contract so that the School is not obligated to pay for support services after the expiry of the MIS Contract.

Data

‘School Data’ means data relating to the School (including information about its pupils and staff) that is: (a) provided by the School to the Supplier; or (b) collected or generated by the Supplier and/or its systems during the provision of services.

‘School Personal Data’ means School Data that is personal data (as defined in UK data protection law).

School Data must only be stored and processed within the UK or European Economic Area (EEA) unless the transfer is undertaken in compliance with applicable data protection legislation and is supported by appropriate transfer mechanisms and safeguards.  The Supplier must notify the School in advance of any proposed transfer of School Data outside the UK or EEA, and provide details thereof that include (as a minimum) the identity of the country and recipient of transfer for the School’s prior written consent to such transfer.

All rights in and to, and title to, School Data will remain with the School. The School will be the data controller of School Data, and the Supplier will be processor in relation to School Personal Data processed in the provision of the services, both as defined in the UK/EU GDPR.  In relation to business contact information processed by the Supplier in administering the contract, the Supplier shall be a controller.

The Supplier must not use School Data for any purpose other than delivery of the Services to that School, unless required by law or expressly authorised to do so in writing by the School for a specific purpose. This shall not prevent the use by the Supplier of supplier operational data, system telemetry, security logs, or genuinely anonymised data for legitimate service operation, security monitoring and support analytics.

The Supplier shall keep School Data confidential.

School Data shall be available to the School at any time, including during any exit period, for no additional cost to the School.

Bulk transfers of School Data shall be available to the School as follows:

• no more than three times during a contract year, at no additional cost to the School
• upon any other request during a contract year, in return for a reasonable additional cost to the School provided it is proportionate to the supplier’s operating cost to comply with the request
• during any exit period, for no additional cost to the School

In all circumstances, the School Data shall be available:

• either by download or by API
• in bulk, line by line, or by custom selection
• in a commonly available, migration ready, machine-readable format

Systems will be API-enabled to support sharing with third parties, for example, other schools, other edtech providers and DfE.

The Supplier must reasonably co-operate with the School and its nominated third-party providers to support migration of School Data on entry to and exit from the Contract. To ensure this, the Contract must set out a timeframe for completion of each migration and details of the School’s and the Supplier’s migration responsibilities.  During any exit period (being the period of time during which the Supplier will be required to provide termination assistance), the Supplier must continue to provide the Service and access to School Data as set out in Core Principle 15.