Guidance

National Pupil Database (NPD): privacy notice

Published 22 December 2022

Applies to England

This privacy notice explains how Department for Education (DfE) uses (process) any personal data you give to us, or any that we may collect about you as part of the National Pupil Database (NPD). This Privacy Notice should be read alongside the DfE Personal information charter.

The NPD is owned, and managed, by DfE and is created by linking individuals’ personal information taken from data provided by schools and local authorities via statutory data collections (such as the school census) to attainment data from awarding bodies.

For the purposes of relevant data protection legislation, the DfE is the data controller for personal data processed by DfE as part of the NPD.

If you would like:

• more information about how we process your personal data or your data protection rights
• to make a request about your information, for example to request a copy of your information or to ask for your information to be changed
• to contact our Data Protection Officer

You can contact us in the following ways:

Using our secure online contact form

Or in writing to:

Data Protection Officer Department for Education (B2.28)
7 & 8 Wellington Place
Wellington Street
Leeds
LS1 4AW

The kinds of personal data we process about you

The NPD holds different categories of data for different cohorts of individuals depending on the nature of their interaction with an educational establishment or local authority. Categories of data held within the NPD include:

• instant identifiers such as your name and address
• meaningful identifiers such as unique pupil numbers
• meaningless identifiers such as pupil matching reference numbers
• characteristics such as your gender or ethnicity
• details of any special educational needs you may have
• details of schools attended
• information on absence and exclusions
• information relating to exam results
• information relating to any contact with children’s services
• information relating to what you did after you finished school

The majority of data available in the NPD relates to children who attended school in England from the 2001 to 2002 academic year onwards.

Full details of all data available in the NPD can be found within the Find and explore data in the NPD digital service or the spreadsheet based NPD data tables.

How and why we get personal information?

The data within NPD is collected by the DfE from a number of different sources and at a number of different points within your educational journey.

The data in the NPD is provided as part of the operation of the education system and is used for research and statistical purposes to improve, and promote, the education and well-being of children in England.

The evidence and data provide DfE, education providers, Parliament and the wider public with a clear picture of how the education and children’s services sectors are working in order to better target, and evaluate, policy interventions to help ensure all children are kept safe from harm and receive the best possible education. For example, processing of data in the NPD is necessary for the school performance tables which are used to help drive up educational standards by providing valuable information for parents and increasing local accountability.

To enable our use of your personal data to be lawful, we need to meet one (or more) conditions in the data protection legislation. That lawful basis will be based on the specifics of each use, and on the personal data they are seeking to process. However, for the purpose of the creation and maintenance of the NPD, the relevant conditions are:

• article 6(1)(e) GDPR, to perform a public task as part of our function as a department
• article 9(2)(g) GDPR, to process special category data to perform a task for the reasons of substantial public interest as part of our function as a department

Sharing your personal data

We will only share your personal data with others where it is lawful, secure and ethical to do so. Where these conditions are met, the law allows us to share extracts of NPD data with certain third parties, including:

• schools
• local authorities
• researchers
• organisations connected with promoting the education or wellbeing of children in England
• organisations fighting or identifying crime
• other specified crown and public bodies

All requests for NPD data are subject to a robust approvals process where senior data experts (known as the DfE Data Sharing Approval Panel (DSAP)) assess the application for public benefit, proportionality, legal underpinning and strict information security standards. The DSAP panel also includes external members who scrutinise the ongoing decision making in order to increase public trust.

As part of the Department’s commitment to transparency we publish details of all organisations we have shared personal data with alongside a short description of the project.

Further details of some of the specific legal powers and legislation which support DfE’s use of lawful sharing are available from Legal powers and legislation for DfE data sharing.

Extracts from the NPD may be shared externally for research purposes where legislation, security and public good criteria are met which enables rigorous independent evaluation and policy scrutiny to occur. Further information on data sharing within DfE is available from:

• How we share personal data
• How to access Department for Education (DfE) data extracts
• DfE external data shares

How long we will keep your personal data?

Once the data is in the NPD, we will only keep your personal data for as long as we need it for the research and statistical purposes it was originally collected for. Under data protection legislation, and in compliance with the relevant data processing conditions, personal data can be kept for longer periods when processed purely for research and statistical purposes.

The department undertakes long-term research to show the impact of education or training on outcomes later in life. The data is kept in the NPD until 3 years after the state retirement age (currently data is retained until age 70, which is the state retirement age of 67 plus 3 years). This enables the department to link education data to earnings and employment data as part of the Longitudinal Education Outcomes (LEO) dataset.

Identifiers (or reference numbers) that identify individuals are kept by the Department so that we can match data from different sources to support the long-term research described above. However, the Department minimises the processing of, and access to, information that directly identifies any individual and, where possible, we replace any identifiers with meaningless reference numbers which have no meaning outside DfE when sharing data.

We review this retention policy, and the need to retain the data held in the NPD, on an annual basis. As part of these ongoing reviews, we consider whether the data needs to be retained and, if so, whether it is possible to fully anonymise or de-identify the data.

For external shares of NPD, each individual project is given a set period to retain, and use, the data. After this date, the data must be destroyed in a secure manner. The licence end dates for each data share are documented within our quarterly external data shares transparency publication.

Do we use any data processors?

A data processor is an organisation that processes your information on DfE’s behalf. For the purpose of the NPD, we may use a data processor for the following activities:

• we engage a contracted processor who, on behalf of DfE, are responsible for a number of services that support the production of the School & College Performance Tables (and associated digital services including Find and Compare School Performance and Analyse School Performance) and NPD pupil matching
• the Office for National Statistics (ONS) act as a processor on behalf of DfE for requests where DfE data has been made available to external researchers within the ONS Secure Research Service following approval and instructions by DfE

Storing personal data outside the UK

When DfE stores personal data outside the UK, we will make sure we comply with the data protection law and take additional steps to keep your personal data safe, which can include additional technical/security arrangements, contractual agreements and data sharing agreements.

Your data protection rights:

Under the Data Protection Act 2018, you are entitled to ask us for:

• the right to access - you can ask if we hold information about you and ask for a copy by making a ‘subject access request’
• the right to rectification - you can request to correct any information you believe is inaccurate
• the right to erasure - you can request for your information to be erased, under certain circumstances
• the right to restrict processing - you can request that we restrict the processing of your personal data, under certain circumstances
• the right to object to processing - you can object to DfE’s processing, under certain circumstances

More information on how to do request this, and about how the DfE handles personal information, is published within our Personal information charter.

Further information about your data protection rights is available on the Information Commissioner’s website.

How to make a subject access request

You have the right to ask for access to your personal information, known as a subject access request. To make a subject access request you can use the DfE contact form.

Alternatively, you can make a subject access request in writing. Post your request to:

Data Protection Officer Department for Education (B2.28)
7 & 8 Wellington Place
Wellington Street
Leeds
LS1 4AW

Include as much information as you can about what information you need and the years you need the information for. If possible, tell us which part of the department holds the information. You’ll also need to tell us your telephone number and address.

We may need to check your identity and your right to access the information you’re requesting. This means we might ask for a copy of the identification pages of your passport or photo driving licence and proof of your current address.

We’ll try to respond to your request within 1 month. However, if your request is complex we may extend the period by a further 2 months, but we’ll tell you if this is the case.

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to the Data Protection Officer at:

Department for Education (B2.28)
7 & 8 Wellington Place
Wellington Street
Leeds
LS1 4AW

You can also complain to the ICO if you are unhappy with how we have used your data by writing to:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk

Changes to this privacy notice

We may need to update this privacy notice periodically, so we recommend that you revisit this information from time to time. This privacy notice was last reviewed in December 2022 .