Transparency data

Privacy information: children and young people who are aged under 18 and not in mainstream education, and care leavers aged up to 25

Updated 9 June 2026

Applies to England

This document details what personal data the Department for Education (DfE) processes about you as a child or young person who is aged under 18, if you are not in mainstream education or if you are a care leaver aged up to 25.

If you are in learning, see the relevant privacy notice:

• learners: early years foundation stage to key stage 3
• learners: key stage 4 and 5 and adult education

When we collect and use your personal information, we follow the relevant laws including:

• Data Protection Act (DPA)
• UK General Data Protection Regulation (UK GDPR)

We must have a valid reason to collect your personal data. These reasons are called lawful basis in UK GDPR. You have rights under UK GDPR about how your personal data is collected and used. Your rights change based on the lawful basis for collecting the data.

Further information on the standards you can expect when we collect, hold or use your personal information is available on the personal information charter.

We may update this privacy notice from time to time. Any updated privacy notice will be effective when published. Check this privacy notice periodically for updates. If required by law, we will contact you directly to provide you with an updated privacy notice.

1. Using your data so we can protect you

1.1 Purpose and lawful basis for processing

Our purpose for processing this information is so that we can protect you.

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR.

When we use your special category data it is because we have a substantial public interest under article 9(2)(g) of UK GDPR.

1.2 Data we collect

DfE collects information from educational settings, local authorities, your employer and other government departments to safeguard children and adults.

We collect and use personal information including your:

• name
• date of birth
• address
• sex

We collect and use special category data on your characteristics such as:

• ethnicity
• disability

We also collect and use sensitive data about episodes of being a child in need, if applicable, and notes about the concern.

Full details about how we process special category data are given in the DfE appropriate policy document.

1.3 What we do with your data

We will use your personal information to:

• keep you or another child safe from potential harm
• identify issues and provide support for mental and physical health issues
• prevent extremism in the education system - DfE works to ensure children and young people are not exposed to extremists and extremist messages

The Teaching Regulation Agency regulates the teaching profession in England and investigates cases of serious misconduct. If you are a witness or potential witness within a teacher misconduct investigation, TRA processes your information to investigate allegations of serious misconduct.

1.4 Who we share your data with

We may share your personal data with other organisations where DfE and its executive agencies are notified of an issue regarding safeguarding of children and young people.

Other people and organisations may also share personal data with DfE and its executive agencies, for example, when they make a complaint or raise a concern with us. This can include information shared in accordance with the statutory guidance:

• keeping children safe in education
• working together to safeguard children

This information will be used to investigate complaints and to ensure trusts and academies comply with the regulations including Education (Independent School Standards) Regulations 2014.

1.5 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

1.6 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of public task.

1.7 Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

2. Using your data when you are a child that is looked after by local authorities

2.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can evaluate the impact of our policies.

Local authorities have a legal duty to provide DfE with information each year about the children they look after. They must provide information about children who are looked after during the year, and about the activities and accommodation for care leavers (aged 17 to 25). Read the Children looked after return 2025 to 2026: guide for further information.

The lawful basis we rely on for this processing of your personal data is legal obligation, under article 6(1)(c) of the UK GDPR.

When we use your special category data it is because we have a substantial public interest under article 9(2)(g) of UK GDPR.

When DfE uses your data for research and to publish statistics on children who are looked after. Our lawful basis for using your special category personal data is article 9(j) archiving, research and statistics (with a basis in law) under UK GDPR.

2.2 Data we collect

DfE collects your personal information from local authorities. We use the following personal information:

• name
• date of birth
• child and pupil identifiers
• sex

We collect and use special category data, this includes details about characteristics such as ethnicity.

We collect and use sensitive data including details about:

• episodes of being looked after - important dates and information on placements
• outcomes for looked after children - whether health and dental assessments are up to date, strengths and difficulties questionnaire scores and offending
• adoptions - dates of key court orders and decisions
• care leavers - their activity and what type of accommodation they have
• unaccompanied asylum seeking children (UASC) status

Full details about how we process special category data are given in the DfE appropriate policy document.

2.3 What we do with your data

We will use your personal information:

• to evaluate and improve our policies on children’s social care
• to monitor our objectives on looked-after children, both during their time in care and on reaching adulthood.
• research
• to publish statistics annually
• for funding calculations

2.4 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

2.5 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of legal obligation.

2.6 Data processors and data controllers

Local authorities collect the data on behalf of DfE, but they are independent data controllers for the data they collect.

DfE does not use a data processor for this activity.

3. Using your data when you are a child in need

3.1 Purpose and lawful basis for processing

Our purpose for processing this information is so that we can develop, monitor and evaluate policies on children in need.

A child in need is defined under the Children Act 1989 as a child who is unlikely to reach or maintain a satisfactory level of health or development, or their health or development will be significantly impaired without the provision of services, or the child is disabled.

Local authorities have a legal duty to provide DfE with information each year about children in need. The annual children in need census covers all children who are referred to children’s social care services, even if no further action is taken. The Children in need census: guide to submitting data has more information.

The lawful basis we rely on for this processing of your personal data is legal obligation, under article 6(1)(c) of the UK GDPR.

When we use your special category data it is because we have a substantial public interest under article 9(2)(g) of UK GDPR.

When DfE uses your data for research and to publish statistics on children in need, our lawful basis for using your special category personal data is article 9(j) archiving, research and statistics (with a basis in law) under UK GDPR.

3.2 Data we collect

DfE collects your personal information from local authorities. We use the following personal information:

• name
• date of birth
• pupil identifier
• sex

We collect and use special category data, this includes details about characteristics such as ethnicity and disability.

We collect and use sensitive data including details about:

• episodes of being a child in need
• referrals to children’s social care services
• assessments
• section 47 enquiries
• child protection plans and reviews
• child in need plans
• unaccompanied asylum seeking children (UASC) status
• episodes of a child receiving targeted early help support

Full details about how we process special category data are given in the DfE appropriate policy document.

3.3 What we do with your data

We will use your personal information:

• to develop, monitor and evaluate policies on children in need.
• for research
• to respond to parliamentary questions and freedom of information requests.
• to publish annual statistics.

3.4 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

3.5 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of legal obligation.

3.6 Data processors and data controllers

Local authorities collect the data on behalf of DfE, but they are independent data controllers for the data they collect.

DfE does not use a data processor for this activity.

4. Using your data when we receive a serious incident notification (SIN)

4.1 Purpose and lawful basis for processing

Our purpose for processing this information is so that the DfE Child Safeguarding Practice Review Panel can commission national reviews of child safeguarding cases. These reviews raise issues which are complex or of national importance.

Local authorities in England must notify the panel:

• where they know or suspect that a child has been abused or neglected and:
  • the child has died or has been seriously harmed in the local authority’s area
  • the child, while normally resident in the local authority’s area, has died or been seriously harmed outside England

Local authorities in England must notify the Secretary of State for Education and Ofsted if a child who is being looked after by a local authority dies, whether or not neglect is known or suspected.

Local authorities in England should notify the Secretary of State for Education and Ofsted of the death of a care leaver up to their 25th birthday.

Once a notification is submitted no local authority, including the one that made the notification, will have access to it.

The lawful basis we rely on for this processing of your personal data is legal obligation under Article 6(1)(c) of the UK GDPR public task.

When we use your processing of sensitive or special category data, this is carried out in accordance with the substantial public interest condition under article 9(2)(g) of UK GDPR.

4.2 What data we collect

DfE collects your personal information from local authorities. We use the following personal information:

• name
• date of birth
• address
• sex

We collect and use special category data, this includes details about characteristics, such as ethnicity and disability.

We collect and use sensitive data, this includes details about:

• characteristics of the incident, such as physical abuse, knife crime and neglect
• episodes of being a child in need and child looked after, such as important dates, Child Protection information and Child Protection Plan information
• education and early years details
• parent or carer name

Full details about how we process special category data are given in the DfE appropriate policy document.

4.3 What we do with your data

The panel will use the notifications to:

• decide if a national child safeguarding practice review of any of those incidents notified for children is required
• maintain oversight of the system of national and local reviews
• review how effectively it the panel is operating

Working together to safeguard children has more details.

Serious incident notification data is published annually as official statistics. 

4.4 Who we share your data with

We will only share your personal data with others where it is lawful, secure and ethical to do so.

The notifications received by the panel are also received by DfE and Ofsted. This allows:

• Ofsted to support its regulatory and inspection work, in particular to assess local authority children’s services and inspection of services for looked-after children, safeguarding and child protection
• DfE to exercise effectively its responsibilities for children and young people in England up to the age of 18, including child protection and education

Ofsted must have regard for the need to promote and safeguard the welfare of children under section 117 of the Education and Inspections Act 2006 (‘the 2006 Act’). Section 153 of the 2006 Act provides that information obtained by the chief inspector of Ofsted in connection with any of his functions may be used by him in connection with any of his other functions.

The Secretary of State for Education has a general duty to promote the wellbeing of children (section 7 of the Children and Young Persons Act 2008).

DfE uses safeguarding information received from local authorities by the panel to inform:

• development of policy on child protection and wider reforms to the children’s social care system in England
• any action being taken or to be taken by the government in relation to local authority interventions - the Serious Child Incident Team will have immediate direct access to notifications made through the system as the team has responsibility for serious incident notifications for DfE

4.5 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

4.6 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of legal obligation.

4.7 Data processors and data controllers

For the purpose of data protection legislation, DfE and Ofsted are the joint data controllers for the personal data received via the SIN system.

Local authorities collect the data on behalf of the panel, and by extension DfE and Ofsted, but they are independent data controllers for the data they collect.

DfE does not use a data processor for this activity.

5. Using your data when you contact us to make an enquiry

See the section in the Members of the public privacy notice for details.

6. Using your data when you use our websites

See the section in the Members of the public privacy notice for details.

7. Using your data when you sign up to our notifications about learning opportunities or events

See the section in the Members of the public privacy notice for details.

8. Using your data when you use our social media channels

See the section in the Members of the public privacy notice for details.

9. Using your data when you make a complaint about education providers, children’s social care or DfE

See the section in the Members of the public privacy notice for details.

10. Using your data to contact you for research or feedback on services we provide to you

See the section in the Members of the public privacy notice for details.

11. Using your data to gather evidence for policy development and delivery

See the section in the Members of the public privacy notice for details.

12. Using your data so we can undertake long-term research and publish official statistics

For details of DfE’s long-term research and statistics about education and learning, see: 

• Privacy information: early years foundation stage to key stage 3
• Privacy information: key stage 4 and 5 and adult education

12.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can undertake long-term research to improve and promote the well-being of children in England.

We collect data from local authorities about children in care or who have been in care.

We also collect data as part of specific research. Research at DfE has more information, including the Children of the 2020s: second survey of families at age 2.

DfE publishes official statistics on children and young people. This is carried out in line with the code of practice for official statistics and DfE official statistics: standards and policies.

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR.

When DfE uses your data for research, our lawful basis for using your special category personal data is a substantial public interest under article 9(2)(g) of UK GDPR.

When publishing statistics, our lawful basis for using your special category personal data is article 9(2)(j) archiving, research and statistics (with a basis in law).

12.2 Data we collect

The information is sent to DfE from your local authority. The categories of data we hold include:

• your name and address
• your sex

We collect and use special category data including:

• characteristics such as your ethnicity
• your equality, diversity and inclusion information
• your health, including disabilities.

We also collect sensitive information on contact with children’s services

Full details about how we process special category data are given in the DfE appropriate policy document.

12.3 What we do with your data

DfE has long-term research databases that are used for research and statistical purposes, including the:

• National Pupil Database (NPD)
• Longitudinal Education Outcomes (LEO) dataset
• Children Looked After dataset

This data is used for research and statistical purposes to improve and promote the well-being of children in England.

Your data is stored in the National Pupil Database - see the privacy notices for more information:

For long-term research into the education system, see the Privacy information: early years foundation stage to key stage 3 and Privacy information: key stage 4 and 5 and adult education

12.4 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

12.5 Your rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of public task.

12.6 Data processors

We do not use any data processors for this processing activity.

13. Using your data when you make a referral of serious teacher misconduct to the TRA

When you make a referral, see the section in Members of the public privacy notice for details.

14. Using your data to improve the well-being of children in England

14.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can improve the wellbeing of children, including vulnerable children and children who have been, or are, in care. For further information, see Promoting and supporting mental health and wellbeing in schools and colleges.

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR.

When we use your special category data it is because we have a substantial public interest under article 9(2)(g) of UK GDPR.

See also details on using data when:

• a child is looked after by local authorities 
• a child is in need 
• DfE receives a Serious Incident Notification (SIN)

14.2  What data we collect

DfE collects information from educational settings, local authorities, your employer and other government departments. We collect and use the following personal information:

• name, date of birth and address
• sex

We collect and use special category data, which includes details about characteristics such as ethnicity and disability.

We collect and use sensitive data including details about:

• episodes of being a child in need including:
  • referral information
  • assessment information
  • Section 47 information
  • Initial Child Protection information
  • Child Protection Plan information
• episodes of being looked after, such as important dates and information on placements
• outcomes for looked after children such as:
  • whether health and dental assessments are up to date
  • strengths and difficulties questionnaire score
  • offending
• adoptions - dates of key court orders and decisions
• care leavers activity and type of accommodation
• episodes of when a child receives targeted early help support including:
  • referral information
  • assessment information
  • needs identified

14.3  What we do with your data

We use this personal data to:

• support these children and monitor their progress
• provide them with pastoral care
• assess the quality of our services
• evaluate and improve our policies on children’s social care

14.4 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

14.5 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of public task.

14.6  Data processors

We do not use any data processors for this processing activity.

15. Using your data to fund childcare or to provide grants

15.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can fund the following:

• childminders
• Family Hubs and Start for Life programme
• Support for Families with Disabled Children programme (SFDC)

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR.

When we use your special category data, it is because we have a substantial public interest under article 9(2)(g) of the UK GDPR.

15.2 Data we collect

We collect and use personal information, including your:

• name
• address
• phone number
• date of birth
• sex

We collect and use the following sensitive information:

• type of social benefit claimed
• episodes of being a child looked after by the local authority, if applicable
• equality, diversity and inclusion information
• health, including disabilities and special educational needs

Full details about how we process special category data are given in the DfE appropriate policy document.

15.3 What we do with your data

We’ll use your personal information to:

• enable us to identify children who are potentially eligible for the 2-year-old entitlement to free education and childcare
• work out how much funding is required and to publish statistics on funding

15.4 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

15.5 Your information rights under UK GDPR

Find out about your information rights when we process your personal data under the lawful basis of public task.

15.6 Data processors and data controllers

The National Audit Office (NAO) audits the DfE accounts, to analyse public spending and to improve our services. The NAO is a controller for your personal data that they process.

When fraud is identified, your personal data will be shared by us as necessary for the purposes of preventing and detecting fraud. It will be shared with fraud prevention and law enforcement agencies, such as the Police and the National Crime Agency.

DfE uses a data processor to:

• provide grants to parents, carers or legal guardians, see the Privacy Notice for Support for Families with Disabled Children programme (SFDC)  - Family Fund

16. Using your data to ensure the protection of public funds by preventing and detecting fraud

16.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can protect public funds by preventing and detecting fraud.

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR.

When we use your special category data, it is because we have a substantial public interest under article 9(2)(g) of UK GDPR.

16.2 Data we collect

We use your personal data to ensure the correct funding is provided.

To do this we collect the following information about you:

• personal contact details
• date of birth

We collect special category data including details about your:

• equality, diversity and inclusion information
• health

Full details about how we process special category data are given in the DfE appropriate policy document.

16.3 What we do with your data

We use your data to investigate suspected fraud or financial irregularity.

Find out more on how to report fraud or financial irregularity.

16.4 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

16.5 Who we share your data with

When potential fraud is identified, your personal data will be shared by us as necessary for the purposes of preventing and detecting fraud. It will be shared with fraud prevention and law enforcement agencies, such as the Police and National Crime Agency.

16.6 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of public task.

16.7 Data processors and data controllers

The National Audit Office (NAO) audits the DfE accounts, to analyse public spending and to improve our services. The NAO is a controller for your personal data that they process.

We do not use any data processors for this processing activity.

17. Using your data when we are testing or checking our IT systems

See the section in the Members of the public privacy notice for details.

18. Using your data when we share your personal information

We will only share your personal data with others where it is lawful, secure and ethical to do so. Where these conditions are met, we can share your personal information with:

• schools and other education providers
• local authorities
• researchers like universities, think tanks and research organisations, either directly or via the Office for National Statistics (ONS) and UK Data Service (UKDS) (University of Essex)
• organisations connected with promoting the education or wellbeing of children in England
• organisations fighting or identifying crime like police, courts and Home Office
• other crown and public bodies like Ofqual, Ofsted, UCAS and Office for Students
• organisations working for DfE under contract like DfE commissioned research or training providers
• organisations who provide careers and other guidance
• organisations who provide statistics and research about education, training, employment and well-being, including Jisc (formerly the Higher Education Statistics Agency or ‘HESA’) as detailed in Jisc’s collection notices

ONS and UKDS which will hold pseudonymised DfE datasets for as long as researchers need it. Once we know that researchers do not want to use it anymore, it will be destroyed. How DfE shares personal data includes further information).

Your data is also submitted to Jisc so that you can take part in the graduate outcomes survey.

DfE shares personal data where this is a benefit to:

• education
• the children’s services sector
• the interests of the wider public or society such as sharing data to fight crime or for policy development

How DfE shares personal data gives details of the protections DfE has in place when sharing your data and the relevant legislation.

The DfE Data Sharing Approval Panel (DSAP) must approve all data share requests. The panel of experts assesses each application for:

• public benefit
• proportionality
• legal underpinning
• strict information security standards

The DSAP panel has external members who analyse decisions to increase public trust in the data share process.

18.1 Purpose and lawful basis for processing

DfE will only share data with a third party where we have a lawful basis for the data share under article 6(1) of the UK GDPR.

In most cases, DfE relies on article 6(1)(e) ‘public task’ as the lawful basis where the task or function has a clear basis in law or 6(1)(f) ‘legitimate interest’ where the sharing of your data does not override your rights or when you expect us to share your data.

When we share special category data, we have a lawful basis to data share under article 9(2) of the UK GDPR. Full details about how we process special category data are given in the DfE appropriate policy document and How DfE shares personal data.

DfE will review each data share request on a case-by-case basis to ensure the right lawful basis is used. The Information Commissioner’s Office (ICO) guide to lawful basis for processing has more details.

For example, we share data under public task with:

• awarding organisations to allow exam outcomes to be accurately predicted
• Children’s Commissioner’s Office (CCO) to protect and promote the rights and interests of children in England, especially the most vulnerable
• fraud prevention and law enforcement agencies such as the police and the National Crime Agency to prevent and detect fraud in the funding of education and learning.
• Home Office (HO) to prevent abuse of immigration control
• police and criminal investigation authorities, through court orders to safeguard and promote welfare of children in the UK

We share data under legitimate interest with:

• Education Policy Institute (EPI) to identify if government policies are delivering a high-quality education system
• National Foundation for Educational Research (NFER) and Scottish Qualifications Authority (SQA) to investigate developments to the national curriculum

We share under legal obligation with:

• other official bodies appointed in the public interest for a specific investigatory or advisory purpose, such as a public inquiry

Full details of who we share data with are available: DfE external data shares.

19. How to contact us and how to make a complaint

Requesting your personal information from the Department for Education has information on how you can:

• ask questions about how we use your information
• make a complaint to the Data Protection Officer and the ICO if you have concerns about how we use your personal information

19.1 How to access your personal information

You can make a request to access your personal information verbally or in writing.