Skip to main content
Transparency data

Privacy information: early years foundation stage to key stage 3

Updated 9 June 2026

Applies to England

© Crown copyright 2026

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/privacy-information-early-years-foundation-stage-to-key-stage-3/privacy-information-early-years-foundation-stage-to-key-stage-3

This document details what personal data the Department for Education (DfE) process about learners and children in:

  • early years foundation stage (EYFS), which covers school-based nursery and reception years – children are 3 to 5 years old
  • key stage 1 (KS1) – learners are 5 to 7 years old and in years 1 to 2
  • key stage 2 (KS2) – learners are 7 to 11 years old and in years 3 to 6
  • key stage 3 (KS3) – learners are 11 to 14 years old and in years 7 to 9

This includes pupils and learners in schools, academies and independent schools, as well as learners in hospital schools, alternative provision or who are home educated.

When we collect and use your personal information, we follow the relevant laws including:

We must have a valid reason to collect your personal data. These reasons are called lawful basis in UK GDPR. You have rights under UK GDPR about how your personal data is collected and used. Your rights change based on the lawful basis for collecting the data.

Further information on the standards you can expect when we collect, hold or use your personal information is available on the personal information charter.

We may update this privacy notice from time to time. When we publish an update, it takes effect immediately. Check this notice regularly for any changes. If the law requires it, we will contact you directly with the updated version.

1. Using your data so we can protect you

1.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can protect you.

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR.

When we use your special category data it is because we have a substantial public interest under article 9(2)(g) of UK GDPR.

1.2 Data we collect

DfE collects information from educational settings, local authorities and other government departments to safeguard children and adults.

We collect and use personal information, including your:

  • name
  • date of birth
  • address
  • sex

We collect and use special category data on your characteristics such as:

  • ethnicity
  • disability

We also collect and use special category data about episodes of being a child in need, if applicable, and notes about the concern.

Full details about how we process special category data are given in the DfE appropriate policy document.

1.3 What we do with your data

We will use your personal information to:

  • keep you or another pupil or learner safe from potential harm
  • identify issues and provide support for mental and physical health issues
  • prevent extremism in the education system - DfE works to ensure children and young people are not exposed to extremists and extremist messages

The Teaching Regulation Agency regulates the teaching profession in England and investigates cases of serious misconduct. If you are a witness or potential witness within a teacher misconduct investigation, TRA processes your information to investigate allegations of serious misconduct.

1.4 Who we share your data with

We may share your personal data with other organisations where DfE and its executive agencies are notified of an issue regarding safeguarding of children and young people.

Other people and organisations may also share personal data with DfE and its executive agencies, for example, when they make a complaint or raise a concern with us. This can include information shared in accordance with the statutory guidance:

This information will be used to investigate complaints and to ensure trusts and academies comply with the regulations including Education (Independent School Standards) Regulations 2014.

1.5 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

1.6 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of public task.

1.7 Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

2. Using your data to improve the well-being of children in England

The Privacy information: children and young people under 18 has more details on using data when:

  • a child is looked after by local authorities
  • a child is in need
  • we receive a serious incident notification (SIN)
  • we use your data to improve the well-being of children in England

3. Using your data to fund your learning or childcare

3.1 Purpose and lawful basis for processing

We collect this information so that we can fund learning in the following educational settings:

  • approved childcare, including breakfast clubs and wrapround care
  • schools
  • academies

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR.

When we use your special category data, it is because we have a substantial public interest under article 9(2)(g) of the UK GDPR.

3.2 Data we collect

We need enough information to work out how much funding is required for your learning. DfE provides funding for teaching as well as buildings and special programmes. Funding is calculated based on both of the following:

  • the numbers of learners in each educational setting
  • whether learner have needs which require additional funding

To do this we collect information about you from your educational setting or local authority, including your:

  • personal contact details
  • date of birth
  • sex
  • unique pupil number (UPN)
  • learning data including information about your courses and assessments

We collect and use special category data to work out any additional funding needs, this includes details about your:

  • equality, diversity and inclusion information
  • health, including disabilities and special educational needs

Full details about how we process special category data are given in the DfE appropriate policy document.

3.3 What we do with your data

We use the data to work out how much funding is required and to publish statistics on funding.

3.4 How long we keep your data

For information about how long we hold personal data, see our retention schedule

3.5 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of public task.

3.6 Data processors and data controllers

Schools or multi-academy trusts are the data controller for most of the information they collect, store and use. However, where a school is required to supply a copy of some personal data to the department, DfE also becomes an independent data controller of the copy it receives.

We do not use any data processors for this processing activity.

4. Using your data to ensure the protection of public funds by preventing and detecting fraud

4.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can protect public funds by preventing and detecting fraud.

The lawful basis we rely on we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR.

When we use your special category data it is because we have a substantial public interest under article 9(2)(g) of UK GDPR.

4.2 Data we collect

We use your personal data to ensure schools and academies have received the correct funding.

To do this we collect the following information from your educational setting or local authority about you:

  • personal contact details
  • date of birth
  • data and information about your learning, including your courses and assessments

We collect special category data including details about your:

  • equality, diversity and inclusion information
  • health

Full details about how we process special category data are given in the DfE appropriate policy document.

4.3 What we do with your data

We use your data to investigate suspected fraud or financial irregularity.

Find out more on how to report fraud or financial irregularity.

4.4 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

4.5 Who we share your data with

When potential fraud is identified, your personal data will be shared by us as necessary for the purposes of preventing and detecting fraud. It will be shared with fraud prevention and law enforcement agencies, such as the Police and National Crime Agency.

4.6 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of public task.

4.7 Data controllers

The National Audit Office (NAO) audits the DfE accounts, to analyse public spending and to improve our services. The NAO is a controller for your personal data that they process.

We do not use any data processors for this processing activity.

5. Using your data to record, monitor and report on your learning achievements or attainments and attendance

5.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can monitor and report on learning attainments and attendance.

DfE is responsible for the development and delivery of assessments for children in education between reception and the end of KS2. The assessments include:

  • KS1 tests (non-statutory) 
  • KS2 assessments
  • multiplication tables check
  • phonics screening check
  • reception baseline assessment

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR.

When we process your special category data it is because we have a substantial public interest under article 9(2)(g) of UK GDPR. When we publish statistics, our lawful basis for using your special category personal data is article 9(j) archiving, research and statistics (with a basis in law).

5.2 Data we collect

We collect and use personal information sent to us from your school, academy or local authority. This information includes:

  • your name
  • reference numbers that identify you as a pupil or learner
  • your sex
  • details of schools attended
  • information relating to test and assessment results

We collect special category data including details about:

  • your ethnicity
  • any special educational needs you may have, this includes health or disability information

We also collect sensitive information on:

  • contact with children’s services
  • absence and exclusions

Full details about how we process special category data are given in the DfE appropriate policy document.

5.3 What we do with your data

We collect and use your personal data to monitor how well our education policies are working - we analyse your data to evaluate policy interventions to help ensure all children receive the best possible education.

For key stage 2, we may process information on a child’s individual personal circumstances that may affect their ability to access and participate in the tests concerned, for example, children requiring specific access arrangements or reasonable adjustments, to enable participation in the tests.

This data may include, but is not limited to:

  • requirements for modified test materials
  • special consideration
  • additional time
  • compensatory marks

For the Multiplication Tables Check (MTC), the data collected is used to create the pupil register and confirm pupils participating in the MTC. This enables us to deliver the assessment to all year 4 pupils. See Multiplication tables check for more information.

For the reception baseline assessment (RBA), the data collected is stored and used at the end of year 6 to create the school-level progress measure. No numerical score is shared. However, teachers will receive a series of short, narrative statements that tell them how their pupils performed in the assessment. See the RBA assessment: privacy notice for more information.

For the attendance information, the data is collected from the daily attendance registration records. See the Privacy Notice for school attendance data collection for more information. 

For the attendance information, the data is collected from the daily attendance registration records, see the Privacy Notice for school attendance data collection for more information. 

Publishing statistics on achievements or attainments and attendance

We collect and use your personal data to publish official statistics.

Statistics at DfE has more information on the official statistics that DfE produces. 

We do not publish school-level results for the MTC, but we publish statistics at national and local authority level. 

Individual and school-level results will be made available for schools to view in: 

We do not publish school-level results for the phonics screening check, but schools will have access to national, regional and local authority results to allow them to benchmark their pupils’ performance. 

The Check Your Performance Measures Data (CYPMD) has performance tables that compare schools’ performance over time and to national averages. CYPMD has data for KS2. All published data is anonymised and can be downloaded.

Your data is stored in the following databases, see these privacy notices for more information:

See also section on Using your data so we can undertake long-term research and publish official statistics.

5.4 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

5.5 Who we share your data with

Standards and Testing Agency (STA) has a data sharing agreement in place to provide our national curriculum contractor partner for phonics, KS1 and KS2, school and pupil census data. For phonics and KS1 tests, the census information shared is school information and cohort number of pupils only.  

For KS2 assessments, the data shared includes school and individual pupil information.

We may share the information we hold about you with certain organisations where the law allows it, or if we have a legal obligation to do so.

For Analyse school performance (ASP) , we may share information with other organisations, including the following:

  • national and local agencies who look after children 
  • local authorities 
  • professionals who work in schools and further and higher education institutions, children’s services, and health services 
  • other government departments and related public-sector bodies 
  • research institutions
  • organisations contracted with us or by the above organisations to undertake work for them, requiring them to manage your information

For Get Information About Pupil (GIAP) , we routinely share pupil information with:

  • local authorities 
  • multi-academy trusts 
  • single academy trusts 
  • local-authority-maintained schools 

The GIAP website provides a secure service for users to access individual pupil level data. The purpose of the system is to facilitate the ‘setting’ of pupils on joining an establishment so that proper provision can be made for them. This includes:

  • monitoring progress against attainment by pupils
  • budgeting for pupils by access to pupil premium data
  • access to a ‘protected eligibility’ flag for free school meals
  • information on the pupil’s special educational needs and disabilities

5.6 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of public task.

5.7 Data processors and data controllers

DfE uses a data processor for:

Schools and multi-academy trusts are the data controller for most of the personal data that they collect, store and use. However, if a school needs to supply a copy of some personal data to the DfE, then DfE also becomes an independent data controller of the copy it receives.

6. Using your data to improve the education of children in England

6.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can improve education in England.

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR.

When we use your special category data it is because we have a substantial public interest, under article 9(2)(g) of UK GDPR.

6.2 Data we collect

We collect and use the following personal information. The information is sent to DfE from your school, academy, or local authority:

  • your name and address
  • your sex
  • reference numbers that identify you as a pupil or learner
  • details of schools attended
  • information relating to test and assessment results
  • information relating to what you did after you finished school

We collect special category data including details about:

  • your ethnicity
  • any special educational needs you may have
  • your health or disability information

We also collect sensitive information on:

  • contact with children’s services
  • absence and exclusions

Full details about how we process special category data are given in the DfE appropriate policy document.

6.3 What we do with your data

We need your personal data to:

  • monitor how well our education policies are working - we analyse your data to evaluate policy interventions to help ensure all children are kept safe from harm and receive the best possible education
  • produce official statistics - Statistics at DfE has more information

The section on Using your data to record, monitor and report on your learning achievements or attainments has more details.

Your data is stored in the following databases, see these privacy notices for more information:

How DfE shares personal data provides more information on which data we share and how we share it.

6.4 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

6.5 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of public task.

6.6 Data processors and data controllers

DfE uses a data processor for:

  • services that support the production of the school performance tables and associated digital services including:
    • Find and Compare School Performance
    • Analyse School Performance
    • NPD pupil matching
  • the Office for National Statistics (ONS) and UK Data Service (University of Essex) act as processors on behalf of DfE for requests where DfE data has been made available to external researchers within the ONS Secure Research Service and UK Data Service - the section on long-term research has more details

Schools and multi-academy trusts are the data controller for most of the data that they collect, store and use. However, if a school needs to supply a copy of some personal data to DfE, then DfE also becomes an independent data controller of the copy it receives.

7. Using your data to carry out trials

7.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can engage with its delivery partners (trialling agencies) to carry out KS1 and KS2 item validation trials (IVT) and technical pre-tests (TPT). Both the IVT and the TPT are known as trials.

The legal basis for processing the personal data used and collected during the trials is public task, under article 6(1)(e) of the UK GDPR.

When we use your special category data it is because we have a substantial public interest, under article 9(2)(g) of UK GDPR.

It is a statutory requirement for selected schools to participate in the trials for statutory national curriculum assessments. Participation in trialling for the national curriculum tests is statutory, regardless of whether the test being trialled is statutory or not

7.2 Data we collect

Trialling agencies will collect the following data for pupils who participate in the trials:

  • school names, and pupils’ names and dates of birth, which are used to cross check against pupil IDs and test data
  • item responses for the pupils selected to take part in the trials, to feed into analysis on test items in development and their suitability for inclusion in future national curriculum assessments

We collect special category data, this includes details about:

  • any access arrangements pupils may need for them to take part in the trials. This information is collected directly from the school through their secure school portal. Only data that is needed to administer the tests will be collected.

Trialling agencies will collect the following data for pupils who do not participate in the trials:

  • school names, and pupils’ names and dates of birth - this could be because a pupil is working below the overall standard of the tests, is unable to access the tests (even with the use of access arrangements) or is absent on test day

Full details about how we process special category data are given in the DfE appropriate policy document.

7.3 Data we share

STA has a data sharing agreement in place to provide its trialling agencies with the selected pupils’ names, sex, date of birth and school name. The sample is selected from information already stored by DfE and which was originally provided by schools as part of the autumn census.

The trials are completed by the selected pupils, and their completed scripts are returned to suppliers for coding. For on-screen coding, completed questions are distributed anonymously to coders, so that no coder has access to pupil data. For paper-based coding, the test script will include only the pupil’s name. When coding is complete, item responses for each pupil are collated by trialling agencies and submitted to STA for further analysis.

7.4 What we do with your data

STA will use the information from the trials to determine which questions are suitable, taking pupils’ background characteristics into account, for the purposes of developing appropriate tests for use nationally by other pupils in the future. The results of the trials will not be published, and no individual school or pupil will be identified in any reports produced by STA or its trialling agencies.

7.5 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

7.6 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of public task.

7.7 Data processors

DfE’s trialling agencies are data processors. They are responsible for securely storing and handling any personal data required to administer the trials. Approved trialling agencies are:

  • Australian Council for Educational Research 
  • National Foundation for Educational Research 
  • Pearson 
  • PricewaterhouseCoopers 
  • Scottish Qualifications Authority

8. Using your data so we can undertake long-term research and publish official statistics

8.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can undertake long-term research to show the impact of education, training or support programmes on outcomes later in life. This includes monitoring attendance in education and learning. This shows us how learning can affect your future earnings and employment outcomes.

We process the data already collected about your learning and achievements from the following educational settings:

  • schools
  • academies

We also collect data from local authorities about children in care or who have been in care.

DfE publishes official statistics on early years, schools, further education, higher education, children and young people. This is carried out in line with the code of practice for official statistics and DfE official statistics: standards and policies. See also Publishing statistics on achievements or attainments and attendance. 

DfE takes part in the following international comparison studies of education.  

International Association for the Evaluation of Educational Achievement’s (IEA) Progress in International Reading Literacy Study (PIRLS). Previous results are available via the International comparisons of education 

DfE commissions research, which includes SEND futures and Five to Twelve, by the National Centre for Social Research (NatCen).

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR.

When DfE uses your data for research, our lawful basis for using your special category personal data is a substantial public interest under article 9(2)(g) of UK GDPR.

When publishing statistics, our lawful basis for using your special category personal data is article 9(2)(j) archiving, research and statistics (with a basis in law).

8.2 Data we collect

The information is sent to DfE from your school, academy or local authority. Data is collected through the annual School Census. The categories of data we hold include:

  • your name and address
  • your sex
  • unique pupil and learner numbers
  • pupil matching reference numbers
  • details of schools, academies and other education providers attended

We collect and use special category data, this includes details about:

  • characteristics such as your ethnicity
  • your equality, diversity and inclusion information
  • your health, including disabilities
  • details of any special educational needs you may have

We also collect sensitive information:

  • information relating to any contact with children’s services
  • information on absence and exclusions

Full details about how we process special category data are given in the DfE appropriate policy document.

8.3 What we do with your data

DfE has long-term research databases that are used for research and statistical purposes:

  • the National Pupil Database (NPD)
  • the Longitudinal Education Outcomes (LEO) database

The data stored in the NPD is provided by educational settings or local authorities as part of the operation of the education system, and is used for research and statistical purposes to improve and promote the education and well-being of children in England, and to monitor learning assessments.

The LEO database compares students’ levels of education to their levels of employment and earnings in later life. To do this, we link personal information obtained from the NPD to other government departments relating to education, employment and benefit claims in order to:

  • enable comparisons of the performances of schools
  • provide statistical information to support education and career decisions
  • evaluate and monitor the impact of education or training on outcomes
  • support government decision making in order to improve services

DfE works with the following government departments on the LEO study:

  • Welsh Government
  • Department for Work and Pensions (DWP)
  • His Majesty’s Revenue and Customs (HMRC)
  • Scottish Government

See these privacy notices for more information:

Apply to access the LEO dataset has more details about LEO.

Apply for DfE personal data includes further details about NPD.

8.4 Linking your data to other databases

In your later life, we will connect or link your education data with your employment, benefits and earnings data to create a de-identified person level database. The personal information we use to link this data together are:

  • name
  • date of birth
  • sex
  • postcode
  • national insurance number

Personal identifiers from our education databases are sent to the Department for Work and Pensions (DWP) who match the records against their customer information system. The matched records are then linked to your employment, earnings and benefit data that is held at DWP. All personal identifiers are then removed. Once the link is made, we can then link to other information, such as:

  • if you qualified for free school meals
  • schools attended, courses taken and qualifications achieved
  • any benefits claimed
  • employment and earned income

And special category data, such as:

  • personal characteristics including ethnic group
  • if the young person had special educational needs during their education, this may include health or disability information

Full details about how we process special category data are given in the DfE appropriate policy document.

8.5 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

8.6 Your rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of public task.

8.7 Data processors

DfE uses a data processor for:

Schools and multi-academy trusts are the data controller for most of the data that they collect, store and use. However, if a school needs to supply a copy of some personal data to DfE, then DfE also becomes an independent data controller of the copy it receives.

9. Using your data when you contact us to make an enquiry

See the section in the Members of the public privacy notice for details.

10. Using your data when you use our websites 

See the section in the Members of the public privacy notice for details.

11. Using your data when you use our social media channels 

See the section in the Members of the public privacy notice for details.

12. Using your data for the RPA claims handling services

12.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can process claims under the DfE risk protection arrangement (RPA). The RPA is an alternative to commercial insurance for schools, and an initiative that seeks to help public sector schools achieve savings on their non-staff spend. 

The aim of the RPA claims handling services is to support the effective management of the DfE risk protection arrangement for the benefit of RPA members. This includes processing RPA member claims to an appropriate conclusion. 

The lawful basis we rely on for this processing of your personal data is legitimate interest under article 6(1)(f) of the UK GDPR. When we use your special category data it is because we have a substantial public interest under article 9(2)(g) of UK GDPR.

12.2 Data we collect

We receive your personal data from RPA claims you raise as a RPA member or RPA claims that you make against a RPA member.

We also receive personal data of yours due to your involvement in the investigation and resolution of RPA claims, for example as a witness, third parties acting on behalf of a claimant, legal representative, loss adjusters, valuation experts or supplier involved in processing the claim on our behalf via our claims handling supplier.

DfE collect and use the following personal information:

  • names of people involved in the claim (which can include children)
  • personal addresses
  • telephone numbers
  • date of birth
  • bank account details
  • the extent of damage (which could include injury to children or adults and medical reports)
  • car registration numbers
  • solicitor names, telephone numbers, addresses
  • names and contact numbers of others involved in helping bring the claim to a resolution such as:
    • loss adjusters
    • school project managers
    • suppliers involved in property reinstatement
  • any other necessary personal data required to be able to process the claims to resolution

We collect and use special category data, this includes details about the extent of damage (which could include injury to children or adults and medical reports).

Full details about how we process special category data are given in the DfE appropriate policy document.

12.3 What we do with your data

The RPA claims handling service uses your personal data to ensure claims that fall within the RPA membership rules are professionally processed and resolved for RPA members.

12.4 Who we share your data with

We sometimes need to make personal data available to other organisations. These might include:

  • contracted partners who we have employed to process your personal data on our behalf
  • other organisations with whom we need to share your personal data for specific purposes

Where we need to share your personal data with others, we ensure that this data sharing complies with data protection legislation. For this project, we will share personal data with:

  • our claims handling supplier
  • the supply chain involved in the investigation or resolution of the RPA claim
  • supporting delivery partners of the RPA service as required, which include but not limited to risk management, actuarial and research support services

12.5 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

12.6 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of legitimate interest.

12.7 Data processors

DfE uses a data processor for RPA claims handling services.

13. Using your data when you make a complaint about education providers, children’s social care or DfE

See the section in the Members of the public privacy notice  for details.

14. Using your data when you make a referral of serious teacher misconduct to the TRA 

See the section in Members of the public privacy notice for details.

15. Using your data to gather evidence for policy development and delivery 

See the section in the Members of the public privacy notice for details.

16. Using your data when you sign up to our notifications about learning opportunities or events  

See the section in the Members of the public privacy notice for details.

17. Using your data when you attend our events or webinars

17.1 Purpose and lawful basis for processing

Our purpose for processing this data is so we can organise the event or webinar.

The lawful basis we rely on for processing your personal data is ‘consent’ under article 6(1)(a) of the UK GDPR.

When we collect any information about dietary or access requirements, we also need your explicit consent under article 9(2)(a) of the UK GDPR.

At any time, you can tell us you no longer want us to use your data. The information on your rights has more details.

17.2 Data we collect

DfE collects and uses the following personal information:

  • first name and surname
  • establishment name
  • email address or telephone number (where you ant to receive communication about the event or webinar)
  • IP address (if applicable)
  • your image and audio (when participating in an online event)

We collect and use special category data. This include details about dietary or access requirements.

Full details about how we process special category data are given in the DfE appropriate policy document.

17.3 What we do with your data

We use your email address to provide you with event details. This will include information about any recording taking place. For recorded events we will also email you a link to the recording once the event has concluded.

For some events we may publish the recording on our website or YouTube channels so this is accessible to a wider audience. If an event recording will be published, we will always notify you before the event.

We do not publish delegate lists for event or webinars, but your name and email address may be visible to others in attendance during the event.

17.4 How long we keep your data

Our retention schedule includes information about how long we hold your personal data.

17.5 Your rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of consent.

As we are processing your personal data with your consent, you have the right to withdraw that consent. You can withdraw your consent up until the webinar recording is published. If you change your mind, or you are unhappy with our use of your personal data, contact us and state the name of the event or webinar.

17.6 Data processors

DfE uses a data processor to help organise our events. The organiser of the event is provided in the sign-up email.

For National Centre for Computing Education (NCCE), see the privacy notice - Teach Computing.

18. Using your data when we are testing or checking our IT systems

See the relevant section in the Members of the public privacy notice for details.

19. Using your data when we share your personal information

We will only share your personal data with others where it is lawful, secure and ethical to do so. Where these conditions are met, we can share your personal information with:

  • schools and other education providers
  • local authorities
  • researchers like universities, think tanks and research organisations, either directly or via the Office for National Statistics (ONS) or UK Data Service (UKDS) (University of Essex)
  • organisations connected with promoting the education or wellbeing of children in England
  • organisations fighting or identifying crime like police, courts and Home Office
  • other crown and public bodies like Ofqual, Ofsted, UCAS and Office for Students
  • organisations working for DfE under contract like DfE commissioned research or training providers
  • organisations who provide careers and other guidance
  • organisations who provide statistics and research about education, training, employment and well-being, including Jisc (formerly the Higher Education Statistics Agency or ‘HESA’) as detailed in Jisc’s collection notices

ONS and UKDS which will hold pseudonymised DfE datasets for as long as researchers need it. Once we know that researchers do not want to use it anymore, it will be destroyed. For further information about sharing data with ONS and UKDS, see How DfE shares personal data.

Your data is also submitted to Jisc so that you can take part in the graduate outcomes survey

DfE shares personal data where this is a benefit to:

  • education
  • the children’s services sector
  • the interests of the wider public or society such as sharing data to fight crime or for policy development

How DfE shares personal data gives details of the protections DfE has in place when sharing your data and the relevant legislation.

The DfE Data Sharing Approval Panel (DSAP) must approve all data share requests. The panel of experts assesses each application for:

  • public benefit
  • proportionality
  • legal underpinning
  • strict information security standards

The DSAP panel has external members who analyse decisions to increase public trust in the data share process.

19.1 Purpose and lawful basis for processing

DfE will only share data with a third party where we have a lawful basis for the data share under article 6(1) of the UK GDPR.

In most cases, DfE relies on article 6(1)(e) ‘public task’ as the lawful basis where the task or function has a clear basis in law or 6(1)(f) ‘legitimate interest’ where the sharing of your data does not override your rights or when you expect us to share your data.

When we share special category data, we have a lawful basis to data share under article 9(2) of the UK GDPR. Full details about how we process special category data are given in:

DfE will review each data share request on a case-by-case basis to ensure the right lawful basis is used. The ICO guide to lawful basis for processing has more details.

For example, we share data under public task with:

  • awarding organisations to allow test outcomes to be accurately predicted
  • Children’s Commissioner’s Office (CCO) to protect and promote the rights and interests of children in England, especially the most vulnerable
  • fraud prevention and law enforcement agencies such as the police and the National Crime Agency, to prevent and detect fraud in the funding of education and learning
  • Home Office (HO) to prevent abuse of immigration control
  • police and criminal investigation authorities, through court orders to safeguard and promote welfare of children in the UK

We share data under legitimate interest with:

  • Education Policy Institute (EPI) to identify if government policies are delivering a high-quality education system
  • National Foundation for Educational Research (NFER) and Scottish Qualifications Authority (SQA) to investigate developments to the national curriculum

For example, we share under legal obligation with:

  • other official bodies appointed in the public interest for a specific investigatory or advisory purpose, such as a public inquiry

Full details of who we share data with are available: DfE external data shares.

20. How to contact us and how to make a complaint

Requesting your personal information from the Department for Education has information on how you can:

  • ask questions about how we use your information
  • make a complaint to the Data Protection Officer and the Information Commissioner’s Office if you have concerns about how we use your personal information

20.1 How to access your personal information

You can make a request to access your personal information verbally or in writing.

Back to top