Transparency data

Privacy information: early years foundation stage to key stage 3

Updated 5 January 2024

Applies to England

© Crown copyright 2024

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/privacy-information-early-years-foundation-stage-to-key-stage-3/privacy-information-early-years-foundation-stage-to-key-stage-3

This document provides details of what personal data we process about learners in the following:

  • early years foundation stage (EYFS), which covers nursery and reception years – learners are 3 to 5 years old
  • key stage 1 (KS1) – learners are 5 to 7 years old and in years 1 to 2
  • key stage 2 (KS2) – learners are 7 to 11 years old and in years 3 to 6
  • key stage 3 (KS3) – learners are 11 to 14 years old and in years 7 to 9

This includes pupils and learners in schools, academies and independent schools, as well as learners in hospital schools, alternative provision or who are home educated.

See also our privacy notices for:

When we collect and use your personal information, we need to follow the law. The main laws are the Data Protection Act (DPA) and the UK General Data Protection Regulation (UK GDPR).

The Department for Education (DfE) is the data controller for the personal information we process. This includes when the information is collected or processed by third parties on our behalf. See DfE is the data controller for more details.

We must have a valid reason to collect your personal data. These reasons are called ‘lawful basis’ in article 6(1) of the UK GDPR.

When we process your information, we maintain your information’s confidentiality, integrity and availability:

  • confidentiality means only authorised users can view access, change or use your information
  • integrity means we ensure your information is correct and accurate
  • availability means we ensure your information is available, in a secure system, when required

Further information on the standards you can expect when we collect, hold or use your personal information is available on the personal information charter.

1. Using your data to provide money for your learning

1.1 Using your data to fund your learning

This includes funding learning in the following educational settings:

  • schools
  • academies

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Section 11 of the Education Act 1996 allows us to do this.

When we use your sensitive or ‘special category’ data. We use it because we have a substantial public interest under article 9(2)(g) of the UK GDPR. This processing is under Section 11 of the Education Act 1996.

Full details about how we process special category data are given in the DfE appropriate policy document.

Data we collect

We need enough information to work out how much funding is required for your learning. DfE provides funding for teaching as well as buildings and special programmes. Funding is calculated based on the numbers of learners in each educational setting and if they have needs which need additional funding.

To do this, we collect the following information from your educational setting or local authority about you:

  • personal contact details
  • date of birth
  • data and information about your learning, including your courses and assessments

We collect and use special category data, to work out any additional funding needs. This includes details about your:

  • equality, diversity and inclusion information
  • health, including disabilities and special educational needs

Full details of how we process special category data are given in the DfE appropriate policy document.

For further details about safeguarding children with special educational needs and disability in schools, colleges and children’s services, see special educational needs and disability (SEND) and special educational needs and disability (SEND) and high needs.

What we do with your data

We use the data to work out how much funding is required and to publish statistics on funding.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 7 years for funding and financial purposes.

If the learning is funded by European Social Fund (ESF), we must retain the data until 31 December 2034.

If your personal information is included in any legal agreement classified as a deed, we will retain it for 12 years from the point of the deed’s expiry.

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
  • the right to ask us for copies of your personal information we have about you – this is called ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
  • the right to ask us to stop using your information – this is called ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf.

For most of the personal data schools or the multi-academy trusts collect, store and use, they are the data controller. However, where a school is required to supply a copy of some personal data to the department, DfE also becomes an independent data controller of the copy it receives.

1.2 Using your data to ensure the protection of public funds by preventing and detecting fraud

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Section 11 of the Education Act 1996, providing funding for primary, secondary or further education, allows us to do this.

When we use your sensitive or ‘special category’ data. We use it because we have a substantial public interest. The Education Act 2002, Apprenticeships, Skills, Children and Learning Act 2009 or the Further and Higher Education Act (1992) allows us to use your data.

Full details about how we process special category data are given in the DfE appropriate policy document.

Data we collect

We use your personal data to ensure schools and academies have received the correct funding.

To do this we collect the following information from your educational setting or local authority about you:

  • personal contact details
  • date of birth
  • data and information about your learning, including your courses and assessments

We collect special category data, this includes details about:

  • your equality, diversity and inclusion information
  • your health

Full details about how we process special category data are given in the DfE appropriate policy document.

What we do with your data

We use your data to investigate suspected fraud or financial irregularity.

More details on how ESFA handles allegations of suspected fraud or financial irregularity are available.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 7 years after legal proceedings have been completed.

Your rights

We are relying on public task for this processing, this means you have:

  • the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
  • the right to ask us for copies of your personal information we have about you – this is called ‘right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
  • the right to ask us to stop using your information – this is called ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf.

The National Audit Office (NAO) audits the DfE accounts, to analyse public spending and to improve our services. The NAO is a controller for your personal data that they process.

When fraud is identified, your personal data will be shared by us as necessary for the purposes of preventing and detecting fraud. It will be shared with fraud prevention and law enforcement agencies, such as the Police and the National Crime Agency.

2. Using your data to support your learning

2.1 Using your data to record, monitor and report on your learning achievements or attainments

The Standards and Testing Agency (STA) is an executive agency of DfE, responsible for the development and delivery of assessments for children in education between reception and the end of key stage 2.

The learner assessments include national curriculum assessments at key stage 1 and key stage 2, which are supported by the Primary Assessment Gateway and the Multiplication Tables Check (MTC) service (accessed through DfE Sign-in).

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Section 11 of the Education Act 1996, allows us to do this, improving standards in education, encourage diversity and increase opportunities in learning and education. Section 87 of the Education Act 2002 allows us to do national curriculum assessments.

When we use your sensitive or ‘special category’ data. We use it because we have a substantial public interest. The Education Act 2002, Apprenticeships, Skills, Children and Learning Act 2009 or the Further and Higher Education Act (1992) allows us to use your data.

DfE uses your data for research and to publish statistics on learners and funding. Our lawful basis for using your special category personal data is article 9(j) archiving, research and statistics (with a basis in law), this is in accordance with article 89(1) and schedule 1 part (4) of the DPA 2018.

Full details about how we process special category data are given in the DfE appropriate policy document.

Data we collect

We collect and use the following personal information. The information is sent to DfE from your school, academy, college, training provider or local authority:

  • your name and address
  • reference numbers that identify you as a pupil/learner
  • details of schools attended
  • information relating to exam and assessment results

We collect special category data, this includes details about:

  • your gender or ethnicity
  • details of any special educational needs you may have, this includes health or disability information

We also collect sensitive information:

  • information relating to any contact with children’s services
  • information on absence and exclusions

Personal information for key stage 1 (KS1) and key stage 2 (KS2) school pupils will be processed and stored on the Primary Assessment Gateway, including teacher assessment data and test results data. Information or data on a child’s individual personal circumstances that may affect their ability to access and participate in the tests concerned – for example, children requiring specific test access arrangements or reasonable adjustments – will also be processed through the Primary Assessment Gateway. This may include, but is not limited to, requirements for modified test materials, special consideration, additional time or compensatory marks.

For the Multiplication Tables Check (MTC), the data collected is used to create the pupil register and confirm pupils participating in the MTC, which enables us to deliver the assessment to all year 4 pupils. The MTC determines whether pupils can fluently recall their times tables, which is essential for future success in mathematics. The MTC results are provided back to schools to help them identify pupils who have not yet mastered their times table and may require more support. The collected and processed data is used at an aggregate level, for operational purposes and to inform a statistical publication at national and local authority level. Individual pupil and school-level results will be made available for schools to view in Analyse School Performance (ASP). Pupil-level data will also be released in Get Information about Pupils (GIAP).

Full details about how we process special category data are given in the DfE appropriate policy document.

What we do with your data

We need your personal data to:

  • monitor how well our education policies are working – our analysis of your data provides DfE, education providers, Parliament and the wider public with a clear picture of how the education and children’s services sectors are working in order to better target, and evaluate, policy interventions to help ensure all children are kept safe from harm and receive the best possible education
  • produce official statistics – see statistics at DfE for more details

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

To enable DfE to use your education data for long-term research, we keep your personal data:

We review this retention policy, and the need to retain the data held, on an annual basis. As part of these ongoing reviews, we consider whether the data needs to be retained and, if so, whether it is possible to fully anonymise or de-identify the data.

Your rights

We are relying on public task for this processing, this means you have:

  • the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
  • the right to ask us for copies of your personal information we have about you – this is called ‘right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
  • the right to ask us to stop using your information – this is called ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf.

DfE uses a data processor for the following activities:

  • services that support the production of the school and college performance tables (and associated digital services including Find and Compare School Performance and Analyse School Performance) and National Pupil Database (NPD) pupil matching
  • the National Foundation for Educational Research (NFER) administers the 2023 KS1 and KS2 technical pre-tests on behalf of DfE. For more details, see the Privacy notice for parents for the national curriculum technical pre-tests 2023

For most of the personal data schools or the multi-academy trusts collect, store and use, they are the data controller. However, where a school is required to supply a copy of some personal data to the department, DfE also becomes an independent data controller of the copy it receives.

Your personal data is shared by awarding organisations, they send DfE details of your qualifications so we have a record of your achievements.

2.2 Using your data to carry out item validation trials

STA engages with its delivery partners (trialling agencies) to carry out key stage 1 (KS1) and KS2 item validation trials (IVT) and technical pre-tests (TPT). Both the IVT and the TPT are known as trials.

Purpose and lawful basis for processing

The legal basis for processing the personal data used and collected during the trials is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary for the exercise of a function of a government department, specifically, the requirement of the DfE to provide an effective and robust testing, assessment and moderation system to measure and monitor pupils’ progress and attainment through primary school from reception to the end of KS2. Section 87 of the Education Act 2002 allows us to do national curriculum assessments.

It is a statutory requirement for selected schools to participate in the trials for statutory national curriculum assessments. Schools may also be selected for trials of non-statutory national curriculum assessments, but have the option not to participate.

Data we collect

Trialling agencies will collect the following data for pupils who participate in the trials:

  • school names, and pupils’ names and dates of birth, which are used to cross-check against pupil IDs and test data
  • item responses for the pupils selected to take part in the trials, to feed into analysis on test items in development and their suitability for inclusion in future national curriculum assessments

We collect special category data. This includes details about:

  • any access arrangements pupils may need for them to take part in the trials. This information is collected directly from the school through their secure school portal. Only data that is needed to administer the tests will be collected

Trialling agencies will collect the following data for pupils who do not participate in the trials:

  • school names, and pupils’ names and dates of birth — this could be because a pupil is working below the overall standard of the tests, is unable to access the tests (even with the use of access arrangements) or is absent on test day

Full details about how we process special category data are given in the DfE appropriate policy document.

Data we share

STA has a data sharing agreement in place to provide its trialling agencies with the selected pupils’ names, gender and date of birth and school name. The sample is selected from information already stored by DfE and which was originally provided by schools as part of the autumn census.

The trials are completed by the selected pupils, and their completed scripts are returned to suppliers for coding. For on-screen coding, completed questions are distributed anonymously to coders, so that no coder has access to pupil data. For paper-based coding, the test script will include only the pupil name. When coding is complete, item responses for each pupil are collated by trialling agencies and submitted to STA for further analysis.

What we do with your data

STA will use the information from the trials to determine which questions are suitable, taking pupils’ background characteristics into account, for the purposes of developing appropriate tests for use nationally by other pupils in the future. The results of the trials will not be published, and no individual school or pupil will be identified in any reports produced by STA or its trialling agencies.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

Trialling agencies (the data processor) will securely dispose of the data after 6 months, in accordance with their agreement with STA.

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
  • the right to ask us for copies of your personal information we have about you – this is called ‘right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
  • the right to ask us to stop using your information – this is called ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf.

DfE’s trialling agencies, as data processors, are responsible for securely storing and handling any personal data required to administer the trials.

2.3 Using your data to improve the education of children in England

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Section 11 of the Education Act 1996, allows us to do this, improving standards in education, encourage diversity and increase opportunities in learning/education.

When we use your sensitive or ‘special category’ data. We use it because we have a substantial public interest. The Education Act 2002, Apprenticeships, Skills, Children and Learning Act 2009 or the Further and Higher Education Act (1992) allows us to use your data.

Full details about how we process special category data are given in the DfE appropriate policy document.

Data we collect

We collect and use the following personal information. The information is sent to DfE from your school, academy, college, training provider or local authority:

  • your name and address
  • reference numbers that identify you as a pupil/learner
  • details of schools attended
  • information relating to exam and assessment results

We collect special category data, this includes details about:

  • your gender or ethnicity
  • details of any special educational needs you may have, this includes health or disability information

We also collect sensitive information:

  • information relating to any contact with children’s services
  • information on absence and exclusions

Personal information for key stage 1 (KS1) and key stage 2 (KS2) school pupils will be processed and stored on the Primary Assessment Gateway, including teacher assessment data and test results data. Information and data on a child’s individual personal circumstance(s) that may affect their ability to access and participate in the test(s) concerned – for example, children requiring specific test access arrangements or reasonable adjustments – will also be processed through the Primary Assessment Gateway. This may include, but is not limited to, requirements for modified test materials, special consideration, additional time or compensatory marks.

For the Multiplication Tables Check (MTC), the data collected is used to create the pupil register and confirm pupils participating in the MTC which enables us to deliver the assessment to all year 4 pupils. The MTC determines whether pupils can fluently recall their times tables, which is essential for future success in mathematics. The MTC results are provided back to schools to help them identify pupils who have not yet mastered their times table and may require more support. The collected and processed data is used at an aggregate level, for operational purposes and to inform a statistical publication at national and local authority level. Individual pupil and school-level results will be made available for schools to view in Analyse School Performance (ASP). Pupil level data will also be released in Get Information about Pupils (GIAP).

Full details about how we process special category data are given in the DfE appropriate policy document.

What we do with your data

We need your personal data to:

  • monitor how well our education policies are working – our analysis of your data provides DfE, education providers, Parliament and the wider public with a clear picture of how the education and children’s services sectors are working in order to better target, and evaluate, policy interventions to help ensure all children are kept safe from harm and receive the best possible education
  • produce official statistics – see statistics at DfE for more details

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

To enable DfE to use your education data for long-term research, we keep your personal data:

We review this retention policy, and the need to retain the data held, on an annual basis. As part of these ongoing reviews, we consider whether the data needs to be retained and, if so, whether it is possible to fully anonymise or de-identify the data.

Your rights

We are relying on public task for this processing, this means you have:

  • the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
  • the right to ask us for copies of your personal information we have about you – this is called ‘right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
  • the right to ask us to stop using your information – this is called ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activities:

  • services that support the production of the school and college performance tables (and associated digital services including Find and Compare School Performance and Analyse School Performance) and National Pupil Database (NPD) pupil matching
  • the Office for National Statistics (ONS) act as a processor on behalf of DfE for requests where DfE data has been made available to external researchers within the ONS Secure Research Service following approval and instructions by DfE - see the section on long-term research for details
  • the National Foundation for Educational Research (NFER) administers the 2023 KS1 and KS2 technical pre-tests on behalf of DfE. For more details, see the Privacy notice for parents for the national curriculum technical pre-tests 2023

For most of the personal data schools or the multi-academy trusts collect, store and use, they are the data controller. However, where a school is required to supply a copy of some personal data to the department, DfE also becomes an independent data controller of the copy it receives.

Your personal data is shared by awarding organisations, they send DfE details of your qualifications so we have a record of your achievements.

2.4 Using your data to carry out item validation trials

STA engages with its delivery partners (trialling agencies) to carry out key stage 1 (KS1) and KS2 item validation trials (IVT) and technical pre-tests (TPT). Both the IVT and the TPT are known as trials.

Purpose and lawful basis for processing

The legal basis for processing the personal data used and collected during the trials is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary for the exercise of a function of a government department, specifically, the requirement of the DfE to provide an effective and robust testing, assessment and moderation system to measure and monitor pupils’ progress and attainment through primary school from reception to the end of KS2. Section 87 of the Education Act 2002 allows us to do national curriculum assessments.

It is a statutory requirement for selected schools to participate in the trials for statutory national curriculum assessments. Schools may also be selected for trials of non-statutory national curriculum assessments but have the option not to participate.

Data we collect

Trialling agencies will collect the following data for pupils who participate in the trials:

  • school names, and pupils’ names and dates of birth, which are used to cross check against pupil IDs and test data
  • item responses for the pupils selected to take part in the trials, to feed into analysis on test items in development and their suitability for inclusion in future national curriculum assessments

We collect special category data, this includes details about:

  • any access arrangements pupils may need for them to take part in the trials. This information is collected directly from the school through their secure school portal. Only data that is needed to administer the tests will be collected.

Trialling agencies will collect the following data for pupils who do not participate in the trials:

  • school names, and pupils’ names and dates of birth — this could be because a pupil is working below the overall standard of the tests, is unable to access the tests (even with the use of access arrangements) or is absent on test day

Full details about how we process special category data are given in the DfE appropriate policy document.

Data we share

STA has a data sharing agreement in place to provide its trialling agencies with the selected pupils’ names, gender and date of birth and school name. The sample is selected from information already stored by DfE and which was originally provided by schools as part of the autumn census.

The trials are completed by the selected pupils, and their completed scripts are returned to suppliers for coding. For on-screen coding, completed questions are distributed anonymously to coders, so that no coder has access to pupil data. For paper-based coding, the test script will include only the pupil name. When coding is complete, item responses for each pupil are collated by trialling agencies and submitted to STA for further analysis.

What we do with your data

STA will use the information from the trials to determine which questions are suitable, taking pupils’ background characteristics into account, for the purposes of developing appropriate tests for use nationally by other pupils in the future. The results of the trials will not be published, and no individual school or pupil will be identified in any reports produced by STA or its trialling agencies.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

To enable DfE to use your education data for long-term research, we keep your personal data:

We review this retention policy, and the need to retain the data held, on an annual basis. As part of these ongoing reviews, we consider whether the data needs to be retained and, if so, whether it is possible to fully anonymise or de-identify the data.

Your rights

We are relying on public task for this processing, this means you have:

  • the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
  • the right to ask us for copies of your personal information we have about you – this is called ‘right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
  • the right to ask us to stop using your information – this is called ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf.

  • DfE’s trialling agencies, as data processors, are responsible for securely storing and handling any personal data required to administer the trials.

2.5 Using your data to monitor attendance in education and learning

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Section 11 of the Education Act 1996 allows us to do this.

When we use your sensitive or ‘special category’ data. We use it because we have a substantial public interest. The Education Act 2002, Apprenticeships, Skills, Children and Learning Act 2009 or the Further and Higher Education Act (1992) allows us to use your data.

DfE uses your data for research and to publish statistics on learners and funding. Our lawful basis for using your special category personal data is article 9(j) archiving, research and statistics (with a basis in law), this is in accordance with article 89(1) and schedule 1 part (4) of the DPA 2018.

Full details about how we process special category data are given in the DfE appropriate policy document.

Data we collect

We collect and use the following personal information. The information is sent to DfE from your school, academy, college, training provider or local authority:

  • your name and address
  • reference numbers that identify you as a pupil or learner

We collect special category data, this includes details about:

  • your gender or ethnicity
  • details of any special educational needs you may have, this may include health or disability information

We also collect sensitive information on absence and exclusions.

Full details about how we process special category data are given in the DfE appropriate policy document.

What we do with your data

We need your personal data to:

  • monitor how well our education policies are working – our analysis of your data provides DfE, education providers, Parliament and the wider public with a clear picture of how the education and children’s services sectors are working in order to better target, and evaluate, policy interventions to help ensure all children are kept safe from harm and receive the best possible education
  • produce official statistics – see statistics at DfE for more details

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

To enable DfE to use your education data for long-term research, we keep your personal data:

We review this retention policy, and the need to retain the data held, on an annual basis. As part of these ongoing reviews, we consider whether the data needs to be retained and, if so, whether it is possible to fully anonymise or de-identify the data.

Your rights

We are relying on public task for this processing, this means you have:

  • the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
  • the right to ask us for copies of your personal information we have about you – this is called ‘right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
  • the right to ask us to stop using your information – this is called ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activities:

  • services that support the production of the school and college performance tables (and associated digital services including Find and Compare School Performance and Analyse School Performance) and National Pupil Database (NPD) pupil matching

3. Using your data to carry out research

3.1 Using your data so we can undertake long-term research and publish official statistics

DfE undertakes long-term research to show the impact of education or training on outcomes later in life. We process the data already collected about your learning and achievements from the following educational settings:

  • schools
  • academies

We also collect data from local authorities about children in care or who have been in care.

This data is used to provide long-term research and statistics on education. DfE undertakes long-term research to show us how learning can affect your future earning and employment outcomes.

DfE publishes official statistics on early years, schools, further education, higher education, children and young people. This is carried out in line with the code of practice for official statistics and DfE official statistics: standards and policies.

Purpose and lawful basis for processing

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Section 10 of the Education Act 1996 and Section 83 of the Children’s Act 1989 allow us to do this.

When we use your sensitive or ‘special category’ data. We use it because we have a substantial public interest, the Education Act 2002 allows this.

DfE uses your data for research and to publish statistics on learners and funding. Our lawful basis for using your special category personal data is article 9(j) archiving, research and statistics (with a basis in law), this is in accordance with article 89(1) and schedule 1 part (4) of the DPA 2018.

Full details about how we process special category data are given in the DfE appropriate policy document.

We’ll use your personal information for research that DfE undertakes to provide high-quality evidence to inform policy development and delivery.

Data we collect

The information is sent to DfE from your school, academy, college, training provider or local authority. The categories of data we hold include:

  • your name and address
  • unique pupil and learner numbers
  • pupil matching reference numbers
  • details of schools, academies and other education providers attended

We collect and use special category data, this includes details about:

  • characteristics such as your gender or ethnicity
  • your equality, diversity and inclusion information
  • your health, including disabilities
  • details of any special educational needs you may have

We also collect sensitive information:

  • information relating to any contact with children’s services
  • information on absence and exclusions

Full details about how we process special category data are given in the DfE appropriate policy document.

Linking your data to other databases

In the future we will connect or link your education data with your employment, benefits and earnings data to create a de-identified person level database. The personal information we use to link this data together are:

  • name
  • date of birth
  • gender
  • postcode
  • national insurance number

Personal identifiers from our education databases are sent to the Department for Work and Pensions (DWP) who match the records against their customer information system. The matched records are then linked to your employment, earnings and benefit data that is held at DWP. All personal identifiers are then removed. Once the link is made, we can then link to other information, such as:

  • if you qualified for free school meals
  • schools attended, courses taken and qualifications achieved
  • any benefits claimed
  • employment and earned income

And special category data, such as:

  • personal characteristics including gender and ethnic group
  • if the young person had special educational needs during their education, this may include health or disability information

Full details about how we process special category data are given in the DfE appropriate policy document.

What we do with your data

DfE has 2 long-term research databases that are used for research and statistical purposes – the National Pupil Database (NPD) and the Longitudinal Education Outcomes (LEO) database.

The data stored in the NPD is provided by educational settings or local authorities as part of the operation of the education system, such as to fund your learning. This data is used for research and statistical purposes to improve and promote, the education and well-being of children in England.

The LEO database compares students’ levels of education to their levels of employment and earnings in later life. To do this, we link personal information obtained from the NPD to other government departments relating to education, employment and benefit claims in order to:

  • enable comparisons of the performances of schools, colleges and universities
  • provide statistical information to support education and career decisions
  • evaluate and monitor the impact of education or training on outcomes
  • support government decision making in order to improve services

DfE works with 4 government departments on the LEO study: Welsh Government, Department for Work and Pensions (DWP), His Majesty’s Revenue and Customs (HMRC) and Scottish Government.

See apply to access the Longitudinal Education Outcomes (LEO) dataset for more details about LEO.

For more details about NPD see apply for Department for Education (DfE) personal data.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

Your personal information is kept for your learning and working life. To enable DfE to use your education data for long-term research, we keep your personal data:

We review this retention policy, and the need to retain the data held, on an annual basis. As part of these ongoing reviews, we consider whether the data needs to be retained and, if so, whether it is possible to fully anonymise or de-identify the data.

Your rights

We are relying on public task for this processing, this means you have:

  • the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
  • the right to ask us for copies of your personal information we have about you – this is called ‘right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
  • the right to ask us to stop using your information – this is called ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

4. Using your data to protect you

4.1 Using your data so we can protect you

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Section 11 of the Children Act 2004, section 175 of the Education Act 2002 and the Education and Inspections Act 2006 allows us to do this.

Special categories of personal data need to also be processed for reasons of substantial public interest under section 10 (3) of the DPA 2018 (Special categories of personal data) and 18 (Safeguarding of children and individuals at risk). We use it because we have a substantial public interest, the Education Act 2002 allows this.

Full details about how we process special category data are given in the DfE appropriate policy document.

Data we collect

DfE collects information from educational settings, local authorities and other government departments to safeguard children and adults. We collect and use the following personal information:

  • name, date of birth and address

We collect and use the following special category data:

  • characteristics (such as gender, ethnicity and disability)

We collect and use the following sensitive information:

  • episodes of being a child in need, if applicable
  • notes about the concern

Full details about how we process special category data are given in the DfE appropriate policy document.

For further details about safeguarding children with special educational needs and disability in schools, colleges and children’s services, see special educational needs and disability (SEND) and special educational needs and disability (SEND) and high needs.

What we do with your data

We’ll use your personal information to:

  • keep you or another pupil or learner safe from potential harm
  • identifying issues and providing support for mental and physical health issues
  • prevent extremism in the education system - DfE works to ensure children and young people are not exposed to extremists and extremist messages

The Teaching Regulation Agency (TRA) is an executive agency of the Department for Education (DfE). TRA regulate the teaching profession in England and investigate cases of serious misconduct. If you are a witness or potential witness within a teacher misconduct investigation, TRA processes your information to investigate allegations of serious misconduct.

Sharing your data

We may share your personal data with other organisations where DfE and its executive agencies are notified of an issue regarding safeguarding of children and young people.

Other people and organisations may also share personal data with DfE and its executive agencies, for example, when they make a complaint or raise a concern with us. This can include information shared in accordance with the statutory guidance keeping children safe in education and working together to safeguard children. This information will be used to investigate complaints and to ensure trusts and academies comply with the regulations (including independent schools, in accordance with the Education (Independent School Standards) Regulations 2014 (legislation.gov.uk)).

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

For safeguarding cases, we keep your personal information until you are aged 25, or 10 years after the date of the allegation, whichever is longer, then it is reviewed.

The TRA will only keep your personal data for as long as they need to for the purpose of regulating the teaching profession, specifically up to 50 years after the closure of a case. After 50 years it will be securely destroyed.

Your rights

We are relying on public task for this processing, this means you have:

  • the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
  • the right to ask us for copies of your personal information we have about you – this is called ‘right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
  • the right to ask us to stop using your information – this is called ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

4.2 Using your data to improve the well-being of children in England

DfE collects information about vulnerable children and children who have been, or are, in care.

Purpose and lawful basis for processing

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Section 10 of the Education Act 1996 and section 7 of the Children and Young Persons Act 2008 allows us to do this as DfE is promoting the well-being of children (persons under the age of 18) in England.

When we use your sensitive or ‘special category’ data. We use it because we have a substantial public interest, the Education Act 2002 or Apprenticeships, Skills, Children and Learning Act 2009 allows this.

Full details about how we process special category data are given in the DfE appropriate policy document.

What data we collect

DfE collects information from educational settings, local authorities and other government departments. We collect and use the following personal information:

  • name, date of birth and address
  • characteristics (such as gender, ethnicity and disability)
  • episodes of being a child in need (such as referral information, assessment information, Section 47 information, Initial Child Protection information and Child Protection Plan information)
  • episodes of being looked after (such as important dates, information on placements)
  • outcomes for looked after children (such as whether health and dental assessments are up to date, strengths and difficulties questionnaire scores and offending)
  • adoptions (such as dates of key court orders and decisions)
  • care leavers (such as their activity and what type of accommodation they have)

What we do with it

We use this personal data to:

  • support these children and monitor their progress
  • provide them with pastoral care
  • assess the quality of our services
  • evaluate and improve our policies on children’s social care

How long we keep it

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. We call this our retention and disposal schedule.

To enable DfE to use your education data for long-term research, we keep your personal data:

We review this retention policy, and the need to retain the data held, on an annual basis. As part of these ongoing reviews, we consider whether the data needs to be retained and, if so, whether it is possible to fully anonymise or de-identify the data.

Your rights

We are relying on public task for this processing, this means you have:

  • the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
  • the right to ask us for copies of your personal information we have about you – this is called ‘right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
  • the right to ask us to stop using your information – this is called ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

5. Using personal data when children are looked after by local authorities

Local authorities have a legal duty to provide DfE with information each year about the children they look after.

See the section in children’s privacy notice for details: Using your data when a child is looked after by local authorities.

5.1 Using personal data when a child is in need

Local authorities have a legal duty to provide DfE with information each year about the children in need.

A child in need is defined under the Children Act 1989 as a child who is unlikely to reach or maintain a satisfactory level of health or development, or whose health or development will be significantly impaired without the provision of services, or who is disabled.

See the section in children’s privacy notice for details: Using your data when you are a child in need.

5.2 Using personal data when we receive a serious incident notification (SIN)

DfE has established the Child Safeguarding Practice Review Panel (the Panel). The Panel commissions national reviews of child safeguarding cases that raise issues that are complex or of national importance.

Local authorities in England have to notify the Panel, under section 16C(1) of the Children Act 2004, where the local authority knows or suspects that a child has been abused or neglected and:

  • the child has died or has been seriously harmed in the local authority’s area; or
  • while normally resident in the local authority’s area, the child has died or been seriously harmed outside England.

The local authority must notify the Panel, under Schedule 2, paragraph 20(1)(a) of the Children Act 1989, if a child who is being looked after by a local authority dies, whether or not neglect is known or suspected.

Once a notification is submitted no local authority, including the one that made the notification, will have access to it.

See the section in the children’s privacy notice for details: Using your data when we receive a serious incident notification (SIN).

6. Using your data when you contact us

6.1 Contacting us to make an enquiry or complaint

We collect, process and store your personal data when you contact DfE via the DfE contact us form, telephone, email, message or live chat. In addition, telephone calls to our helplines may be recorded for training and monitoring purposes. If provided, we will also use your email address to send a customer satisfaction survey.

We use this information to:

  • resolve your enquiry
  • progress a follow-up enquiry
  • action a request as appropriate

It is also used to ensure our call agents are appropriately trained and to enable us to continually improve the quality of the service provided.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department.

Data we collect

DfE collect and use the following personal information directly from you:

  • your full name
  • email address
  • phone number
  • details about your enquiry or compliant
  • internet protocol (IP) address

What we do with your data

We need information from you to investigate your complaint or enquiry properly.

We use the IP address to detect and block malicious visitors to our websites.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 5 years from the date of the enquiry or complaint

Your rights

We are relying on public task for this processing, this means you have:

  • the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
  • the right to ask us for copies of your personal information we have about you – this is called ‘right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
  • the right to ask us to stop using your information – this is called ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

6.2 Data when you use our websites

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department.

Data we collect

We use Google Analytics to collect information from you about how you use this website. We do not collect or store your personal information through Google Analytics so it cannot be used to identify who you are.

Google Analytics uses 3 types of cookies. See the DfE cookies policy.

What we do with your data

We use your personal information to:

  • ensure we present our website content in the best way for you.
  • allow you to take part in interactive features of our service, when you choose to do so

See also data when you sign up to our notifications about learning opportunities or events for more information on when we use your data to:

  • notify you about changes to our website or services
  • provide you with information or services that you request from us or which may interest you

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

Your personal information is retained for up to 2 years. See details about cookies on GOV.UK for more information.

If you create an account on our websites or sign up for an alert your personal information is kept as long as you have an account. If you delete your account or cancel your alert, your data will also be deleted. See data when you sign up to our notifications about learning opportunities or events for more information.

Your rights

We are relying on legitimate interest for this processing, this means you have:

  • the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
  • the right to ask us for copies of your personal information we have about you – this is called ‘right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
  • the right to ask us to delete your personal information – this is called ‘right to erasure’
  • the right to ask us to stop using your information – this is called ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activities:

  • we use Google Analytics cookies and a Real User Monitoring (RUM) cookie from SpeedCurve to collect information about how you use GOV.UK

6.3 Using your data when you use our social media channels

We use social media to share news and views with people working in:

  • schools
  • colleges
  • local authorities
  • children’s services

We also use social media to communicate with parents, children and young people.

See our social media use policy for more details.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is consent under article 6(1)(a) of the UK GDPR – this is when we ask your consent to use your information.

Data we collect

When you interact with our social media channels we collect and use:

  • your name

What we do with your data

When you use our websites and social media channels, we use your personal information to:

  • allow you to take part in interactive features of our service, when you choose to do so
  • ensure we present our website content in the best way for you
  • provide you with information or services that you request from us or which may interest you - we always get your consent when you request these DfE services
  • notify you about changes to our website or services

See the DfE cookies policy.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

The DfE social media channels are captured by the National Archives’ government web archive as a permanent record of DfE’s social media communication.

Your personal information is retained for up to 2 years, see the details about cookies on GOV.UK page for more information.

Your rights

We are relying on consent for this processing, this means you have:

  • the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
  • the right to ask us for copies of your personal information we have about you – this is called ‘right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
  • the right to ask us to delete your personal information – this is called ‘right to erasure’
  • the right to ask us to stop using your information – this is called ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to withdraw consent at any time (where relevant), by using our contact form.

As we are processing your personal data with your consent, you have the right to:

  • withdraw consent to the processing of your personal data at any time, by using our contact form
  • ask DfE to cease publication of your image, words and/or voice on its social media channels, if you do so, DfE will not publish further social media posts featuring this content, but it is not obligated to remove or delete existing posts - the DfE social media channels are captured by the National Archives’ government web archive as a permanent record of DfE’s social media communication

If you change your mind, or you are unhappy with our use of your personal data, contact DfE and state the name of the project.

Further information on rights and the ways in which your data may be used are contained in the filming, photography and audio recordings consent form.

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activities:

  • we use Google Analytics cookies and a Real User Monitoring (RUM) cookie from SpeedCurve to collect information about how you use GOV.UK

7. Using your data to check our IT systems

7.1 Using your data when we are testing or checking our IT systems

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is legitimate interest, under article 6(1)(f) of the UK GDPR.

When we use your sensitive information, this is ‘special category’ data. The reasons we use it because we have a substantial public interest under article 9(2)(g) of UK GDPR. The Education Act 2002 and Section 54 of the Further and Higher Education Act (1992) allows this.

Full details about how we process special category data are given in the DfE appropriate policy document.

Data we collect

DfE collects information from educational settings, local authorities and other government departments. We will process the following information about you:

  • personal contact details
  • date of birth
  • ethnicity
  • data and information about your learning, including your courses and assessments

If the IT system or database contains special category data, we would be processing details about:

  • your equality, diversity and inclusion information
  • your health

If the IT system or database contains sensitive information about you, we would be processing details about:

  • children that are looked after or are in care

What we do with your data

When we are designing a new system or database. It is sometimes necessary to use ‘live’ personal data to test the design in a secure environment. This is because ‘dummy data’ is not capable of replicating the complexity of the data that is actually collected.

Similarly, it is necessary to extract copies and run quality checks for the purposes of identifying unnecessary duplication or even conflicting data about the same data subject. In order to maintain the accuracy of our data, if duplicate records are identified, we would either merge the duplicate records under one Unique Learner Number or maintain existing records but include cross referencing so all the records are linked and are retrieved when searching for the one data subject.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

This processing activity is for the length of time it takes to test or check the data, any copies of the data created would be deleted as soon as the text or check is complete.

Your rights

We are relying on legitimate interest for this processing, this means you have:

  • the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
  • the right to ask us for copies of your personal information we have about you – this is called ‘right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
  • the right to ask us to delete your personal information – this is called ‘right to erasure’
  • the right to ask us to stop using your information – this is called ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activities:

  • we use contractors to do our IT Health Checks (ITHC) – an ITHC is a series of controlled tests and actions that check the security of our IT systems

8. How to contact us and how to make a complaint

8.1 How to contact us

Contact the Data Protection Team with questions about this document or how we use your information.

8.2 How to make a complaint

If you have concerns about how we use your personal information, you can make a complaint in writing to the Data Protection Officer and Information Commissioner’s Office.

8.3 How to access your personal information

A request to access your personal information can be made verbally or in writing.

Back to top