Transparency data

Privacy information: key stage 4 and 5 and adult education

Updated 26 February 2026

Applies to England

This document details what personal data the Department for Education (DfE) processes about you as a learner in:

• year 10 and 11, key stage 4 (KS4) aged 14 to 16 years old
• college or sixth form, key stage 5 (KS5) aged 16 to 18 years old
• adult education or on an apprenticeship aged over 16 years old, KS4 and KS5
• higher education

This information is relevant to pupils and learners in schools, academies, hospital schools, alternative provision and those who are home educated.

When we collect and use your personal information, we follow the relevant laws including:

• Data Protection Act (DPA)
• UK General Data Protection Regulation (UK GDPR)

We must have a valid reason to collect your personal data. These reasons are called lawful basis in UK GDPR. You have rights under UK GDPR about how your personal data is collected and used. Your rights change based on the lawful basis for collecting the data.

Further information on the standards you can expect when we collect, hold or use your personal information is available on the personal information charter.

We may update this privacy notice from time to time. When we publish an update, it takes effect immediately. Check this notice regularly for any changes. If the law requires it, we will contact you directly with the updated version.

1. Using your data so we can protect you

1.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can protect you.

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR.

When we use your special category data it is because we have a substantial public interest under article 9(2)(g) of UK GDPR.

1.2 Data we collect

DfE collects information from educational settings, local authorities, your employer and other government departments to safeguard children and adults.

We collect and use personal information including your:

• name
• date of birth
• address
• sex

We collect and use special category data on your characteristics such as:

• ethnicity
• disability

We also collect and use special category data about episodes of being a child in need, if applicable, and notes about the concern.

Full details about how we process special category data are given in the DfE appropriate policy document.

1.3 What we do with your data

We will use your personal information to:

• keep you or another pupil or learner safe from potential harm
• identify issues and provide support for mental and physical health issues
• prevent extremism in the education system - DfE works to ensure children and young people are not exposed to extremists and extremist messages

The Teaching Regulation Agency regulate the teaching profession in England and investigate cases of serious misconduct. If you are a witness or potential witness within a teacher misconduct investigation, TRA processes your information to investigate allegations of serious misconduct.

1.4 Who we share your data with

We may share your personal data with other organisations where DfE and its executive agencies are notified of an issue regarding safeguarding of children and young people.

Other people and organisations may also share personal data with DfE and its executive agencies, for example, when they make a complaint or raise a concern with us. This can include information shared in accordance with the statutory guidance:

• keeping children safe in education
• working together to safeguard children

This information will be used to investigate complaints and to ensure trusts and academies comply with the regulations including Education (Independent School Standards) Regulations 2014.

1.5 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

1.6 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of public task.

1.7 Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

2. Using your data to improve the well-being of children in England

Privacy information: children and young people under 18 has details on using data when:

• a child is looked after by local authorities
• a child is in need
• we receive a Serious Incident Notification (SIN)
• we use your data to improve the wellbeing of children in England

3. Using your data to fund your learning, including apprenticeships

3.1 Purpose and lawful basis for processing

We collect this information so that we can fund learning in the following educational settings:

• schools
• academies
• colleges
• sixth forms
• adult education training providers
• apprenticeships and National Technical Qualifications (NTQs)
• to help with fees and living costs through the Dance and Drama Awards (DaDA) - see the Dance and Drama Awards guide: academic year 2025 to 2026 for details
• to monitor student loans

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR.

When we use your special category data, it is because we have a substantial public interest under article 9(2)(g) of the UK GDPR.

3.2 Data we collect

We need enough information to work out how much funding is required for your learning. DfE provides funding for teaching as well as buildings and special programmes. Funding is calculated based on both of the following:

• the numbers of learners in each educational setting
• whether learner have needs which require additional funding

To do this we collect information about you from your educational setting or local authority, including your:

• personal contact details
• date of birth
• sex
• learning data including information about your courses and assessments

We collect and use special category data to work out any additional funding needs, this includes details about your:

• equality, diversity and inclusion information
• health, including disabilities and special educational needs

Full details about how we process special category data are given in the DfE appropriate policy document.

The Individualised Learner Record (ILR) specification has further information on data collected for post-16 funding.

3.3 What we do with your data

We use the data to work out how much funding is required and to publish statistics on funding - see Using your data so we can undertake long-term research and publish official statistics for information.

3.4 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

3.5 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of public task.

3.6 Data processors and data controllers

Training providers are data processors for the adult education and apprenticeship data that they send to DfE.

Schools or multi-academy trusts are the data controller for most of the information they collect, store and use. However, where a school is required to supply a copy of some personal data to the department, DfE also becomes an independent data controller of the copy it receives.

4. Using your data to ensure the protection of public funds by preventing and detecting fraud

4.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can protect public funds by preventing and detecting fraud.

The lawful basis we rely on we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR.

When we use your special category data it is because we have a substantial public interest under article 9(2)(g) of UK GDPR.

4.2 Data we collect

We use your personal data to ensure schools, academies, colleges, sixth forms, adult education training providers and apprenticeships have received the correct funding.

To do this we collect the following information from your educational setting or local authority about you:

• personal contact details
• date of birth
• data and information about your learning, including your courses and assessments

We collect special category data including details about your:

• equality, diversity and inclusion information
• health

Full details about how we process special category data are given in the DfE appropriate policy document.

4.3 What we do with your data

We use your data to investigate suspected fraud or financial irregularity.

Find out more on how to report fraud or financial irregularity.

When fraud is identified, your personal data will be shared by us as necessary for the purposes of preventing and detecting fraud. It will be shared with fraud prevention and law enforcement agencies, such as the Police and the National Crime Agency.

4.4 Who we share your data with

When fraud is identified, your personal data will be shared by us as necessary for the purposes of preventing and detecting fraud. It will be shared with fraud prevention and law enforcement agencies, such as the Police and the National Crime Agency.

4.5 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

4.6 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of public task.

4.7 Data processors and data controllers

The National Audit Office (NAO) audits the DfE accounts, to analyse public spending and to improve our services. The NAO is a controller for your personal data that they process.

We do not use any data processors for this processing activity.

5. Using your data to create your unique learner number and your personal learning record

5.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can create your unique learner number (ULN).

Your ULN is a unique 10-digit number. Most learners aged over 14 have one. It’s designed to work with your personal learning record (PLR) as proof of your learning and achievements.

Your PLR is a lifetime record of achievement for all learners, it is an online record of your qualifications and achievements.

The PLR includes:

• learning funded by DfE
• learning that is not funded by DfE, such as learning that is funded by you or training provider - your training provider can send us details of this non-funded learning

The department creates education records for all pupils using information provided to the department by schools and exam bodies. The education record app contains:

• your name, date of birth and address
• schools you have attended
• your official qualifications like GCSE results
• your support needs

Find out how to access the education record app.

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR.

5.2 Data we collect

To create your personal learning record and your unique learner number, we collect information from schools, academies, colleges and training providers, including your:

• first name, or if more than one, each first name
• surname, and former surname, if known
• preferred surname
• sex
• date of birth
• current unique pupil number, and previous unique pupil number, if applicable
• unique learner number

However, to enable us to confidently match learners to their records, DfE collects additional information to distinguish between learners and verify accuracy. This information includes:

• email address
• date of address capture
• last known address
• last known address county or city
• school at age 16
• family name at 16
• Unique Candidate Number (UCI)
• place of birth
• Scottish candidate number, if applicable

We collect this information for awarding organisations (the organisation that awards your qualification), to verify your data:

• learner date of birth
• learner sex
• learner post code

5.3 What we do with your data

We use your information to create a unique learner number (ULN) and a personal learning record (PLR). These enable us to record your learning achievements. They also enable learning and training providers to claim public funds for your learning and provide advice and guidance on:

• career progression
• employment opportunities
• next steps in learning

Find out how to access your personal learning record.

We store your ULN and PLR information in learning records service (LRS).

5.4 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

5.5 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of public task.

5.6 Data processors and data controllers

DfE uses a training provider that processes data about learners on behalf of the DfE.

Schools or multi-academy trusts are the data controller for most of the information they collect, store and use. However, where a school is required to supply a copy of some personal data to the department, DfE also becomes an independent data controller of the copy it receives.

6. Using your data when you use to find and apply for an apprenticeship

6.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can deliver the Find an apprenticeship service. This service is run by DfE to help you find and apply for apprenticeships in England.

The lawful basis we rely on for processing your personal data is consent, under article 6(1)(a) of the UK GDPR. Our lawful basis for using your special category personal data is article 9(2)(a) explicit consent.

As we are processing your personal data with your consent, you have the right to withdraw that consent. The information on your rights has more information.

6.2 Data we collect

We need to ask you for personal information to create your Find an apprenticeship account. We will ask you to provide the following information:

• name
• date of birth
• address
• sex
• email address
• telephone number

When you make an application through Find an apprenticeship, will also collect your special category information. These are optional questions about your:

• interview support request
• decision on whether you want to apply under the Disability Confident scheme (when a company is part of this scheme)
• ethnic group

Your employer and training provider may enter your apprenticeship details into our services on your behalf, they provide us with the following personal information:

• first name
• last name
• date of birth
• Unique Learner Number (ULN)
• email address

Full details about how we process special category data are given in the DfE appropriate policy document.

Some vacancies on Find an apprenticeship will send you to a company’s own website to apply. We do not collect any of the data you submit on the company’s website.

6.3 What we do with your data

We will use your data to:

• check your eligibility to use Find an apprenticeship - from your age
• create apprenticeship applications that includes your name, contact details, qualifications and work history
• let companies know if you’re eligible for the Disability Confident scheme and whether you want support at an interview
• make features in the service work, such as:
  • customising emails with your name
  • using your age to present the correct National Minimum Wage
  • pre-filling your postcode on the ‘check your travel to work’ tool
• match you to the details of your apprenticeship as provided by your employer and training provider
• provide help and support during your use of our services
• notify you of specific in-service updates and actions with regard to your apprenticeship
• guide government policy and apprenticeship promotion, using anonymised versions of:
  • your age
  • regional location
  • answers to the equality questions to learn about apprenticeships and apprenticeship recruitment - Using your data to gather evidence for policy development and delivery has further information

We may also use your data to contact you for research or feedback on services we provide to you and to ask you about creating case studies about you.

6.4 Who we share your data with

Find an apprenticeship works by sharing your applications with companies.

By ‘companies’, we mean apprenticeship employers and training providers acting on behalf of an apprenticeship employer.

6.5 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

6.6 Your rights under GDPR

Find out about your rights when we process your personal data under the lawful basis of consent. 

As we are processing your personal data with your consent, you have the right to withdraw that consent. You can withdraw your consent at any time by contacting  helpdesk@manage-apprenticeships.service.gov.uk.

If you change your mind, or you are unhappy with our use of your personal data, contact us and state the project or initiative name.

6.7 Data processors

We do not use any data processors for this processing activity.

7. Using your data to record, monitor and report on your learning achievements or attainments and attendance

7.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can monitor and report on learning attainments and attendance in schools.

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR.

When we use process your special category data it is because we have a substantial public interest under article 9(2)(g) of UK GDPR. When we publish statistics, our lawful basis for using your special category personal data is article 9(j) archiving, research and statistics (with a basis in law).

7.2 Data we collect

We collect and use personal information sent to us from your school, academy, college, training provider or local authority. This information includes:

• your name and address
• your sex
• reference numbers that identify you as a pupil or learner
• details of schools attended
• information relating to exam and assessment results
• information relating to what you did after you finished school

We collect special category data including details about:

• your ethnicity
• any special educational needs you may have, this includes health or disability information

We also collect sensitive information on:

• contact with children’s services
• absence and exclusions

Full details about how we process special category data are given in the DfE appropriate policy document.

7.3 What we do with your data

We need your personal data to:

• monitor how well our education policies are working - we analyse your data to evaluate policy interventions to help ensure all children receive the best possible education
• produce official statistics - Statistics at DfE has more information
• compare schools’ and colleges’ performance over time and to national averages

The Check your performance measures data (CYPMD) has performance tables for KS2, KS4 and 16 to 18 year olds. All published data is anonymised and can downloaded via Compare the performance of schools and colleges in England.

Your data is stored in the following databases, see these privacy notices for more information:

• Longitudinal Education Outcomes (LEO): privacy notice
• National Pupil Database (NPD): privacy notice
• Pupil parent matched data (PPMD): how we use and share data

7.4 Who we share your data with

We may share the information we hold about you with certain organisations where the law allows it, or if we have a legal obligation to do so.

For Analyse school performance (ASP), we may share information with other organisations, including the following: 

• national and local agencies who look after children 
• local authorities 
• professionals who work in schools and further and higher education institutions, children’s services, and health services 
• other government departments and related public-sector bodies 
• research institutions
• organisations contracted with us or by the above organisations to undertake work for them, requiring them to manage your information

For Get Information About Pupil (GIAP), we routinely share pupil information with: 

• local authorities 
• multi-academy trusts 
• single academy trusts 
• local-authority-maintained schools 
• further education colleges 

The GIAP website provides a secure service for users to access individual pupil level data. The purpose of the system is to facilitate the ‘setting’ of pupils on joining an establishment so that proper provision can be made for them. This includes:

• monitoring progress against attainment by pupils
• budgeting for pupils by access to pupil premium data
• access to a ‘protected eligibility’ flag for free school meals
• information on the pupil’s special educational needs and disabilities

Your personal data is shared by awarding organisations, they send DfE details of your qualifications so we have a record of your achievements.

7.5 How long we keep your data

Our retention schedule includes information about how long we hold personal data.

7.6 Your information rights under UK GDPR

Find out about  your rights when we process your personal data under the lawful basis of public task.

7.7 Data processors and data controllers

DfE uses a data processor for:

• services that support the production of the school, local authority and college performance tables and associated digital services including:
  • Find and Compare School Performance
  • Analyse School Performance
  • NPD pupil matching
• training providers that process data about learners on behalf of the DfE

Schools and multi-academy trusts are the data controller for most of the personal data that they collect, store and use. However, if a school needs to supply a copy of some personal data to DfE, then DfE also becomes an independent data controller of the copy it receives.

8. Using your data to improve the education of children in England

8.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can improve education in England.

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR.

When we use your special category data it is because we have a substantial public interest. under article 9(2)(g) of UK GDPR.

8.2 Data we collect

We collect and use the following personal information. The information is sent to DfE from your school, academy, college, training provider or local authority:

• name and address
• sex
• reference numbers that identify you as a pupil or learner
• details of schools attended
• information relating to exam and assessment results
• information relating to what you did after you finished school

We collect special category data including details about:

• ethnicity
• any special educational needs you may have
• health or disability information

We also collect sensitive information on:

• contact with children’s services
• absence and exclusions

Full details about how we process special category data are given in the DfE appropriate policy document.

8.3 What we do with your data

We need your personal data to:

• monitor how well our education policies are working - we analyse your data to evaluate policy interventions to help ensure all children are kept safe from harm and receive the best possible education
• produce official statistics - Statistics at DfE has more information

Your data is stored in the following databases, see these privacy notices for more information:

• Longitudinal Education Outcomes (LEO): privacy notice
• National Pupil Database (NPD): privacy notice
• Pupil parent matched data (PPMD): how we use and share data

How DfE shares personal data provides more information on which data we share and how we share it.

8.4 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

8.5 Your information rights under UK GDPR

Find out about  your rights when we process your personal data under the lawful basis of public task.

8.6 Data processors and data controllers

DfE uses a data processor for:

• services that support the production of the school and college performance tables and associated digital services including:
  • Find and Compare School Performance
  • Analyse School Performance
  • NPD pupil matching
• the Office for National Statistics (ONS) and UK Data Service (University of Essex) acts as processors on behalf of DfE for requests where DfE data has been made available to external researchers within the ONS Secure Research Service and UK Data Service - the section on long-term research has more details
• training providers that process data about learners on behalf of DfE

Schools and multi-academy trusts are the data controller for most of the data that they collect, store and use. However, if a school needs to supply a copy of some personal data to DfE, then DfE also becomes an independent data controller of the copy it receives.

9. Using your data when you continue your learning at another training provider

9.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can enable your learning to continue.

When a training provider closes or exits the market, DfE may take on the role of data controller for the provider’s learner administration records. DfE will remain the data controller until the records are destroyed (when they reach the end of their retention period) or transferred to a new training provider.

This retention period is specified in the funding agreement. Find out more about funding agreements. 

Find out more about how schools share personal data when you transfer to a new school. 

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. When we use your special category data it is because we have a substantial public interest under article 9(2)(g) of UK GDPR.

9.2 Data we collect

We collect and use the following personal information. The information is sent to DfE from your training provider:

• name and address
• sex
• reference numbers that identify you as a learner
• details of schools attended
• information relating to exam and assessment results

We collect special category data including details about:

• ethnicity
• any special educational needs you may have
• health or disability information

Full details about how we process special category data are given in the DfE appropriate policy document.

9.3 What we do with your data

We use your information so that your new training provider has access to the information about you as a learner so that you can continue your learning.

9.4 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

9.5 Your rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of public task.

9.6 Data processors

DfE uses a training provider to process data about learners on behalf of DfE.

10. Using your data to contact you for research or feedback on services we provide to you

10.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can:

• undertake research to learn how you interact with our services and to support our operational development and delivery
• make improvements to the services we offer to you to measure the impact and effectiveness of each of our services, programmes or events

We do this through surveys, public consultations, interviews and feedback about our helpdesks. Privacy information: members of the public includes more information on public consultations.

We will always seek your permission to take part in any research.  

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR.

10.2 Data we collect

We collect and use the information you provide directly to us when you contact us, attend one of our programmes or events or use our digital services or helpdesk. We collect your:

• full name
• email address
• phone number

10.3 What we do with your data

We use your data to:

• make improvements to the services we offer to you
• develop policy
• develop new services
• contact you to invite you to participate in research that is relevant to you

You are under no obligation to participate in any research we invite you to. We will not contact you about research using your data if you tell us not to.

Using your data to gather evidence for policy development and delivery has more information on how we process your personal information during research.

10.4 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

10.5 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of public task.

10.6 Data processors 

DfE uses a data processor to:

• provide our service desk
• contact you for feedback contact you to take part in research.

11. Using your data to gather evidence for policy development and delivery

11.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can undertake research and surveys to gather evidence to support our policy development and delivery. Having this evidence is important when improving outcomes for children, young people, families and adults.  

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR. When we use your special category data it is because we have a substantial public interest under article 9(2)(g) of UK GDPR. 

Sometimes we link your survey responses to other government-held data, the lawful basis for this processing is ‘consent’ under article 6(1)(a) of the UK GDPR. If you have agreed that we can link your survey responses to other government-held data, we are undertaking this processing with your consent.

11.2 Data we collect

We collect and use the following personal information directly from you or your education provider:

• full name
• email address
• phone number
• date of birth
• address
• sex

When we use your special category data it is because we have a substantial public interest and you have given your ethical consent to participate in the research. As part of our research we may need to collect information about your:

• heath or disability
• racial or ethnic origin

We also collect sensitive information about your:

• socioeconomic classification
• caring responsibilities

Full details about how we process special category data are given in the DfE appropriate policy document and in the research information sheet. You will be given this research information sheet at the start of the research.

11.3 What we do with your data

We will use your personal information for research that DfE undertakes to provide high-quality evidence to inform policy development and delivery.

Sometimes we link your survey responses to other government-held data, the lawful basis for this processing is ‘consent’. At any time, you can tell us you no longer want us to link your data to other data by using our contact form.

We will publish a summary of the research and the full research report. Your responses may be attributed to an organisation where this information has been provided but our publications will not contain any personal data. DfE will anonymise or desensitise the data where possible.

Research reports published since May 2010 are available on GOV.UK.

Research published before May 2010 is available from the UK government web archive.

Research at DfE and parent, pupil and learner panel omnibus surveys has more information.

11.4 Who we share your data with

Aggregated information or results may be shared with third parties but we will not share any personal data – for more information see Using your data when we share your personal information.

11.5 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

11.6 Your information rights under UK GDPR 

Find out about your rights when we process your personal data under the lawful basis of public task or consent.

If you have agreed that we can link your survey responses to other government-held data, we are undertaking this processing with your consent. You have the right to withdraw that consent up until the data is analysed for the publication. If you change your mind, or you are unhappy with our use of your personal data, contact DfE and state the project or initiative name. Further information on rights and the ways in which your data may be used are contained in the research consent form.

11.7 Data processors

DfE uses a data processor to:

• undertake the research by using contractors - our contractors will get your personal data directly from you and DfE during the activity or initiative
• process your personal data to deliver the following studies:
  • Programme for International Student Assessment (PISA) study - About PISA25
  • International Survey on Adult Skills in England

12. Using your data to take part in our stakeholder or user groups

12.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can manage various user or stakeholder groups that enable us to receive feedback and evidence to support our policy development and delivery, as well as data developments, analysis and research findings. 

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR.

12.2 Data we collect

We collect and use personal information including your:

• full name
• job role
• email address
• phone number
• date of birth
• address

12.3 What we do with your data 

We will use your personal information to manage the stakeholder and user groups, including circulating:

• meeting invites
• agendas
• meeting documents and minutes

12.4 How long we keep your data 

For information about how long we hold personal data, see our retention schedule.

12.5 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of public task. 

12.6 Data processors 

DfE uses a data processor to work on behalf of DfE to undertake the research. DfE uses contractors to do this. Our contractors will receive your personal data directly from you during the survey.

13. Using your data so we can undertake long-term research and publish official statistics

13.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can undertake long-term research to show the impact of education, training or support programmes on outcomes later in life. This includes monitoring attendance in education and learning. This shows us how learning can affect your future earning and employment outcomes.

We process the data already collected about your learning and achievements from the following educational settings:

• schools
• academies
• colleges
• sixth forms
• adult education training providers
• apprenticeships

We also collect data from local authorities about children in care or who have been in care.

We also collect data as part of specific research. Research at DfE has more information.

DfE publishes official statistics on early years, schools, further education, higher education, children and young people. This is carried out in line with the code of practice for official statistics and DfE official statistics: standards and policies.

DfE takes part in the following international comparison studies of education:

• OECD’s Programme for International Student Assessment (PISA), the next study will be PISA 2025
• International Association for the Evaluation of Educational Achievement’s (IEA) Trends in International Mathematics and Science Study (TIMSS)

For previous results see International comparisons of education.

DfE commissions research, for example:

• SEND Futures: by the National Centre for Social Research (NatCen)

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR.

When DfE uses your data for research, our lawful basis for using your special category personal data is a substantial public interest under article 9(2)(g) of UK GDPR.

When publishing statistics, our lawful basis for using your special category personal data is article 9(2)(j) archiving, research and statistics (with a basis in law).

13.2 Data we collect

The information is sent to DfE from your school, academy, college, training provider or local authority. Data is collected through the annual School Census and the Individualised Learner Record (ILR). The categories of data we hold include:

• name and address
• sex
• unique pupil and learner numbers
• pupil matching reference numbers
• details of schools, academies, colleges, universities, training providers and other education providers attended
• information relating to exam results
• information relating to what you did after you finished school

We collect and use special category data including:

• characteristics such as your ethnicity
• equality, diversity and inclusion information
• health, including disabilities.
• details of any special educational needs you may have

We also collect sensitive information on:

• contact with children’s services
• absence and exclusions

Full details about how we process special category data are given in the DfE appropriate policy document.

13.3 What we do with your data

DfE has long-term research databases that are used for research and statistical purposes:

• the National Pupil Database (NPD)
• the Longitudinal Educational Outcomes (LEO) database
• the Individualised Learner Record (ILR)

The data stored in the NPD is provided by educational settings or local authorities as part of the operation of the education system, and is used for research and statistical purposes to improve and promote the education and well-being of children in England and to monitor learning assessments.

The LEO database compares students’ levels of education to their levels of employment and earnings in later life. To do this, we link personal information obtained from the NPD to other government departments relating to education, employment and benefit claims in order to:

• enable comparisons of the performances of schools, colleges and universities
• provide statistical information to support education and career decisions
• evaluate and monitor the impact of education or training on outcomes
• support government decision making in order to improve services

DfE works with the following government departments on the LEO study:

• Welsh Government
• Department for Work and Pensions (DWP)
• His Majesty’s Revenue and Customs (HMRC)
• Scottish Government

We retain your ILR learner data initially for operational purposes (for example to fund your learning and to publish official statistics). Your personal data is then retained in our research databases so that it can be used for long-term research purposes.

See these privacy notices for more information:

• Longitudinal Education Outcomes (LEO): privacy notice
• National Pupil Database (NPD): privacy notice
• Individualised Learner Record (ILR): privacy notice

13.4 Linking your data to other databases

In your later life, we connect or link your education data with your employment, benefits and earnings data to create a de-identified person level database. The personal information we use to link this data together are:

• name
• date of birth
• sex
• postcode
• national insurance number

Personal identifiers from our education databases are sent to DWP who match the records against their customer information system. The matched records are then linked to your employment, earnings and benefit data that is held at DWP. All personal identifiers are then removed. Once the link is made, we can then link to other information, such as:

• if you qualified for free school meals
• schools attended, courses taken and qualifications achieved
• any benefits claimed
• employment and earned income

And special category data, such as:

• personal characteristics including ethnic group
• if the young person had special educational needs during their education, this may include health or disability information

Full details about how we process special category data are given in the DfE appropriate policy document.

13.5 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

13.6 Your rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of public task.

13.7 Data processors and data controllers

DfE uses a data processor for:

• services that support the production of the school and college performance tables and associated digital services including:
  • Compare School Performance
  • Analyse School Performance
  • National Pupil Database (NPD) pupil matching  - see the National Pupil Database (NPD): privacy notice
• training providers that process data about learners on behalf of DfE

Schools and multi-academy trusts are the data controller for most of the data that they collect, store and use. However, if a school needs to supply a copy of some personal data to DfE, then DfE also becomes an independent data controller of the copy it receives.

14. Using your data when we promote learning or career opportunities to you

If you have signed up for notifications see Using your data when you sign up to our notifications about learning opportunities.

14.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can promote university education or apprenticeships or learning to specific groups, for example to minority groups or disadvantaged children.

We may use your personal data to support departmental campaigns and promote departmental activities. If your personal data is used in this way, the department will identify an appropriate lawful basis, in each instance.

The lawful basis we rely on for this processing of your personal data is either:

• public task, under article 6(1)(e) of the UK GDPR – this applies when we send promotional messages that use the existing contact details on our mailing lists, or

• legitimate interest, under article 6(1)(f) of the UK GDPR – this applies when we purchase mailing lists for our promotional messages to support DfE campaigns

14.2 Data we collect

DfE collect and use the following personal information directly from you:

• full name
• address
• email
• mobile number, if applicable

14.3 What we do with your data

We use your personal information for inspiration campaigns that promote and encourage uptake of learning.

14.4 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

14.5 Your information rights under UK GDPR 

Find out about your rights when we process your personal data under the lawful basis of legitimate interest or public task.

You have the right to opt out of these messages. If you do not want to receive these messages, click on the ‘unsubscribe’ link in the email. Alternatively, let us know, stating the title of the email message.

14.6 Data processors

DfE uses a data processor for our communications campaigns. Data processors include creative agencies and PR agencies.

15. Using your data when we create case studies about you

15.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can write case studies to demonstrate the benefits of learning, like case studies about apprentices. DfE apprenticeship campaigns are aimed at 14- to 19-year-olds. These could be written, audio or video case studies. 

The lawful basis we rely on for this processing of your personal data is consent, under article 6(1)(a) of the UK GDPR. 

When we use your special category data it is because you have given your explicit consent under article 9(2)(a) of UK GDPR.

At any time, you can tell us you no longer want us to use your data. The information on your rights has more information.

DfE processes your personal data in relation to filming, photography or audio recordings on the basis of your consent. This consent is for a specific purpose and your media will not be used for any other purpose. Should we wish to use it for a different purpose we will contact you and ask for your consent for the new purpose. This includes content that will be posted across some or all of our social media channels - our social media use policy for more details. 

By signing the filming, photography and audio recordings consent form, you are agreeing that we can record, process and publish your image, words or voice in both printed and digital form, as applicable. This is for the creation of internal and external promotional and follow-up communications material.

Further information on rights and the ways in which your data may be used are contained in the filming, photography and audio recordings consent form.

15.2 Data we collect

DfE collect and use the following personal information directly from you:

• full name
• address
• email
• mobile number
• date of birth
• sex

We collect and use the following special category data:

• ethnicity
• disability, if applicable

Full details about how we process special category data are given in the DfE appropriate policy document.

15.3 What we do with your data

We use your personal information to create case studies that are used to promote apprenticeships. These case studies are published in magazines and on websites and social media. DfE also use case studies for TV and YouTube advertisements.

We provide information, insight and engagement to influence a range of stakeholders through members’ individual experience and story of an apprenticeship.

15.4 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

The DfE social media channels are captured by the National Archives’ government web archive as a permanent record of DfE’s social media channels.

15.5 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of consent. 

As we are processing your personal data with your consent, you have the right to withdraw that consent, by using our contact form. You can withdraw your consent up until the case study is published. You can ask DfE to cease publication of your image, words or voice on its social media channels. If you do so, DfE will not publish further social media posts featuring this content, but it is not obligated to remove or delete existing posts.

15.6 Data processors

DfE uses a data processor (like a PR company) to collect data for our case studies.

16. Using your data when you use our social media channels

16.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can use social media to share news and views with people working in:

• schools
• colleges
• local authorities
• children’s services

We also use social media to communicate with parents, children and young people.

Our social media use policy has more details.

The lawful basis we rely on for this processing of your personal data is consent under article 6(1)(a) of the UK GDPR.

At any time, you can tell us you no longer want us to use your data, your rights has more information.

16.2 Data we collect

When you interact with our social media channels we collect and use your name.

16.3 What we do with your data

When you use our websites and social media channels, we use your personal information to:

• allow you to take part in interactive features of our service, when you choose to do so
• ensure we present our website content in the best way for you
• provide you with information or services that you request from us or which may interest you - we always get your consent when you request these DfE services
• notify you about changes to our website or services

See the DfE cookies policy for more information.

16.4 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

The DfE social media channels are captured by the National Archives’ government web archive as a permanent record of DfE’s social media communication.

16.5 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of consent. 

As we are processing your personal data with your consent, you have the right to: 

• withdraw consent at any time, by using our contact form 
• ask DfE to cease publication of your image, words or voice on its social media channels 

If you do so, DfE will not publish further social media posts featuring this content, but it is not obligated to remove or delete existing posts. DfE social media channels are captured by the National Archives as a permanent record of DfE’s social media communication. 

If you change your mind, or you are unhappy with our use of your personal data, contact DfE and state the project or initiative name.

16.6 Data processors

We use a data processor for collecting information about how you use GOV.UK. We use Google Analytics cookies and a Real User Monitoring (RUM) cookie from SpeedCurve.

17. Using your data when you contact us to make an enquiry

17.1 Purpose and lawful basis for processing

We collect, process and store your personal data when you contact us by:

• using the contact us form
• telephone
• email
• message
• live chat

Telephone calls to our helplines may be recorded for training and monitoring purposes. If provided, we will also use your email address to send a customer satisfaction survey. 

We use this information to: 

• resolve your enquiry 
• progress a follow up enquiry 
• action a request as appropriate 
• respond to your information rights request (IRR)

It is also used to ensure our call agents are appropriately trained and to enable us to continually improve the quality of the service provided. 

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR.

17.2 Data we collect

DfE collects and uses the following personal information directly from you:

• full name
• email address
• phone number
• details about your enquiry
• IP address

17.3 What we do with your data

We need information from you to investigate your enquiry properly.

We use the IP address to detect and block malicious visitors to our websites.

17.4 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

17.5 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of public task.

17.6 Data processors

We do not use any data processors for this processing activity.

18. Using your data when you use our websites

18.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can improve our website and search functionality. 

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR.

18.2 Data we collect

When you use our website and digital services hosted on our websites we collect your IP address.

DfE websites use cookies to collect information from you about how you use this website. The section on cookies in the Personal information charter has more details.

DfE websites use Google Analytics, Hotjar or Microsoft Clarity. We do not collect or store your personal information through these tools, so it cannot be used to identify who you are.

You can find out which cookies are used in the footer section of each website.

18.3 What we do with your data

We use your personal information to:

• ensure we present our website content in the best way for you
• allow you to take part in interactive features of our service, when you choose to do so

If you create an account on our websites or sign up for an alert your personal information is kept as long as you have an account. Using your data when you sign up to our notifications about learning opportunities or events has more information on when we use your data to:

• notify you about changes to our website or services
• provide you with information or services that you request from us or which may interest you

18.4 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

18.5 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of public task.

18.6 Data processors

DfE uses a data processor for collecting information about how you use GOV.UK. We use Google Analytics cookies and a Real User Monitoring (RUM) cookie from SpeedCurve.

19. Using your data when you sign up to our notifications about learning opportunities or events

19.1 Purpose and lawful basis for processing

Our purpose for processing this information is so you can sign up for notifications, such as about apprenticeships or our careers service, or about our events. 

The lawful basis we rely on for this processing of your personal data is consent under article 6(1)(a) of the UK GDPR.

At any time, you can tell us you no longer want us to use your data. The section on your rights has more information.

19.2 Data we collect

DfE collect and use the following personal information directly from you:

• name
• email address

19.3 What we do with your data

We will use your personal information to enable you to sign up to specific messages, like when promoting apprenticeships or our careers service, or to invite you to events.

19.4 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

You can unsubscribe from our emails at any time. You can also use the ‘unsubscribe’ or ‘change your email preferences’ links in the emails you get from GOV.UK.

19.5 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of consent. 

As we are processing your personal data with your consent, you have the right to withdraw that consent. If you change your mind, or you are unhappy with our use of your personal data, contact us and state which notification you are signed up to.

19.6 Data processors

We use data processors to send the email and text notifications.

20. Using your data when you make a complaint about education providers, children’s social care or DfE

20.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can process your data when you make a complaint about:

• a school
• a college
• an early year’s provider
• children’s social care service
• a teacher
• DfE

Our complaints procedure page has more information. 

The section on Using your data when you make a referral of serious teacher misconduct to the Teaching Regulation Agency (TRA) has more information.

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR.

When we use your special category data it is because we have a substantial public interest under article 9(2)(g) of UK GDPR.

20.2 Data we collect

As part of our complaints processes, we may process personal data relating to the following:

• complainant
• subject of the complaint
• any other individuals related to the complaint

DfE collects and uses the following personal information:

• full name
• email or postal address
• phone number
• details about your complaint
• information held by third parties, such as schools, colleges and local authorities

We collect and use special category data, this includes medical details.

We collect and use sensitive data. This includes details about:

• safeguarding and child protection matters
• special educational needs assessments

Full details about how we process special category data and sensitive data are given in the DfE appropriate policy document.

20.3 What we do with your data

We need information from you and potentially other third parties to consider your complaint.

20.4 Who we share your data with

Before we consider a complaint, we may need documentary evidence that the complaints procedure has been completed in full, which we usually ask the complainant to provide.

Depending on the nature of the complaint, we may then need additional documentation, such as CPOMS records or statements from staff and other pupils. CPOMS is an online system, used by over 16,500 schools across the globe.
We may contact the school, an early year’s provider, a children’s social care service or other local authority department to provide this information.

Schools have a legal duty to provide this information to the Secretary of State for Education under section 538 of the Education Act 1996.

Local authorities have a legal duty to provide this information to the Secretary of State for Education under section 29(1) of the Education Act 1996

DfE may also share your data under public task with Ofsted, local authorities or police and criminal investigation authorities, through court orders – to safeguard and promote welfare of children in the UK.

20.5 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

Where a complaint is made to TRA but it is not accepted as a referral, it will be treated as correspondence. The section on Using your data when you make a complaint about education providers, children’s social care or DfE  has more information.

20.6 Your rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of public task.

20.7 Data processors

We do not use any data processors for this processing activity.

21. Using your data when you attend our events or webinars

21.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can organise the event or webinar.

The lawful basis we rely on for processing your personal data is consent under article 6(1)(a) of the UK GDPR.

When we collect any information about dietary or access requirements, we also need your explicit consent under article 9(2)(a) of UK GDPR.

At any time, you can tell us you no longer want us to use your data. The information on your rights has more details.

21.2 Data we collect

DfE collects and uses the following personal information:

• first name and surname
• job role (if applicable)
• establishment name
• email address or telephone number (where you want to receive communication about the event or webinar)
• IP address (if applicable)
• your image and audio (when participating in an online event)

We collect and use special category data. This includes details about dietary or access requirements.

Full details about how we process special category data are given in the DfE appropriate policy document.

21.3 What we do with your data

We use your email address to provide you with event details. This will include information about any recording taking place. For recorded events we will also email you a link to the recording once the event has concluded.

For some events we may publish the recording on our website or YouTube channels so this is accessible to a wider audience. If an event recording will be published, we will always notify you before the event.

We don’t publish delegate lists for event or webinars but your name and email address may be visible to others in attendance during the event.

21.4 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

21.5 Your rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of consent. 

As we are processing your personal data with your consent, you have the right to withdraw that consent. You can withdraw your consent up until the webinar recording is published. If you change your mind, or you are unhappy with our use of your personal data, contact us and state the name of the event or webinar.

21.6 Data processors

DfE uses a data processor to help organise our events. The organiser of the event is provided in the sign-up email.

For National Centre for Computing Education (NCCE), see the Privacy notice - Teach Computing or Privacy policy - Isaac Computer Science for information.

22. Using your data for the risk protection arrangement (RPA) claims handling services

22.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can manage the DfE risk protection arrangement (RPA). This is an alternative to commercial insurance for schools, and an initiative that seeks to help public sector schools achieve savings on their non-staff spend. 

The aim of the RPA claims handling services is to support the effective management of the DfE risk protection arrangement for the benefit of RPA members. This includes processing RPA member claims to an appropriate conclusion. 

The lawful basis we rely on for this processing of your personal data is legitimate interest under article 6(1)(f) of the UK GDPR. When we use your special category data it is because we have a substantial public interest under article 9(2)(g) of UK GDPR.

22.2 Data we collect

We receive your personal data from RPA claims you raise as a RPA member or RPA claims that you make against a RPA member.

We also receive personal data of yours due to your involvement in the investigation and resolution of RPA claims, for example as a witness or from:

• third parties acting on behalf of a claimant
• legal representatives
• loss adjusters
• valuation experts or supplier involved in processing the claim on our behalf via our claims handling supplier

DfE collect and use the following personal information:

• names of people involved in the claim (which can include children)
• personal addresses
• telephone numbers
• date of birth
• bank account details
• the extent of damage (which could include injury to children or adults and medical reports)
• car registration numbers
• solicitor names, telephone numbers, addresses
• names and contact numbers of others involved in helping bring the claim to a resolution such as:
  • loss adjusters
  • school project managers
  • suppliers involved in property reinstatement
• any other necessary personal data required to be able to process the claims to resolution

We collect and use special category data, this includes details about the extent of damage (which could include injury to children or adults and medical reports).

Full details about how we process special category data are given in the DfE appropriate policy document.

22.3 What we do with your data

The RPA claims handling service uses your personal data to ensure claims that fall within the RPA membership rules are professionally processed and resolved for RPA members.

22.4 Who we share your data with

We sometimes need to make personal data available to other organisations. These might include:

• contracted partners who we have employed to process your personal data on our behalf
• other organisations with whom we need to share your personal data for specific purposes

Where we need to share your personal data with others, we ensure that this data sharing complies with data protection legislation. For this project, we will share personal data with:

• our claims handling supplier
• the supply chain involved in the investigation or resolution of the RPA claim
• supporting delivery partners of the RPA service as required, which include but not limited to risk management, actuarial and research support services

22.5 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

22.6 Your information rights under UK GDPR

Find out about  your rights when we process your personal data under the lawful basis of legitimate interest.

22.7 Data processors

DfE uses a data processor for RPA claims handling services.

23. Using your data when you make a referral of serious teacher misconduct to the TRA

23.1 Purpose and lawful basis for processing

DfE has processes in place that enable anyone to complain about a teacher. The Teaching Regulation Agency (TRA) has a process to consider allegations of serious misconduct by a teacher.

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR.

23.2 Data collected

When you make a referral, DfE collects and uses the following personal information about you including your:

• name
• contact details

The section on ‘Using your data to investigate teacher misconduct’ in the education providers’ workforce, including teachers privacy information has more information.

23.3 What we do with your data

As a witness, potential witness or a person making an allegation within a teacher misconduct investigation, we receive your personal data from you and third parties including:

• employers
• supply agencies
• police forces
• the DBS 
• members of the public

We process this information to regulate the teaching profession by investigating allegations of serious misconduct.

23.4 Sharing your data

We sometimes need to make personal data available to other organisations. This also includes contracted partners. Where we need to share your personal data with others, we comply with data protection legislation.

Teachers who are subject to an investigation and their employer

If there is an investigation, we tell them the name of the person who made the referral and details of their allegation. If there is no investigation, we tell the teacher that there has been an allegation, but we do not share your personal data. If the teacher makes a subject access request, we give details of the allegation but not the name of the referrer. If the referral came from an organisation, then we give the name of the referring organisation. This is compliant with Education Acts 2002 and 2011.

Legal firms

If there is an investigation, legal firms we hold contracts with will process your personal data on our behalf. They process the data we provide to gather information to support misconduct investigations and hearings. Some legal firms will also review this data to provide impartial legal advice during misconduct hearings. This is compliant with Education Acts 2002 and 2011.

Professional conduct panels

We appoint independent panel members who sit on professional conduct panels to consider cases of serious misconduct and they may make recommendations on prohibition to the Secretary of State. They need this information to fulfil this role. This is compliant with Education Acts 2002 and 2011.

Published decisions

We will publish the teacher’s personal data within a decision document on GOV.UK if a finding of serious misconduct is made. We will not publish the referrer’s data. This is accessible by members of the public. This is compliant with Regulations 8 and 15 of the Teachers’ Disciplinary (England) Regulations 2012 and section 141C of the Education Act 2002 (updated).

DBS and other organisations

We may need to share your personal data with DBS and other organisations (including, but not limited to, local authority organisations and employers) to safeguard children, young people and adults. This is compliant with section 45 of the Safeguarding and Vulnerable Groups Act 2006.

Police

We may need to share your personal data with the police and the police share information with DfE so we can fulfil our statutory roles. This is compliant with section 31 of the Data Protection Act 2018.

If applicable, we may need to share your financial details with our finance team to pay any expense claims you make.

23.5 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

Where a complaint is made to TRA but it is not accepted as a referral, it will be treated as correspondence. The section on Using your data when you make a complaint about education providers children’s social care or DfE has more details.

23.6 Your rights under GDPR 

Find out about your rights when we process your personal data under the lawful basis of public task.

23.7 Data processors

We do not use any data processors for this processing activity.

24. Using your data so we can support the boards and panels

24.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can support apprenticeship boards and panels. These boards and panels use knowledge, professional expertise and experience to consider proposals brought forward by DfE and offer advice and challenge to DfE to inform those decisions.

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR.

24.2 Data we collect

DfE collects and uses the following personal information:

• full name
• address
• email
• mobile number, if applicable
• audio/video recordings of you, if applicable

24.3 What we do with your data

We use your personal information to manage the boards and panels, including circulating meeting invites, agendas, meeting documents and meeting minutes.

Membership of the apprentice panel is published on the apprenticeship panel page.

24.4 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

24.5 Your information rights under UK GDPR

Find out about your rights when we process your personal data under the lawful basis of public task.

24.6 Data processors

We do not use any data processors for this processing activity.

25. Using your data when we use your student loan data

25.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can model how student finance affects education and employment outcome. We use these models to develop student finance policy.  

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR.  

Our lawful basis for using your special category personal data is reasons of substantial public interest, under article 9(g) under UK GDPR.

25.2 Data we collect

DfE receives the following personal information data twice yearly from the Student Loan Company (SLC). The data is pseudonymised before DfE receives the data: 

• National Insurance Number 
• address 
• sex
• date of birth 
• marital status 
• student support number (SSN)

We collect and use special category data, which includes details about: 

• nationality 
• date of disability  
• receipt of Disability Support Allowance

We collect and use sensitive data, which includes details about:

• household income (this could be the parent or carer or guardian’s household income)
• grant payments - this includes Care Leavers Grant, Adult Dependant Grant, Child Care Grant, Parental Learning Allowance, Lone Parents Grant, HE Grant, HE Bursary, HE Maintenance Grant, Assembly Learning Grant, Special Support Grant
• earnings for customer from HMRC (PAYE or self-assessed)
• reason for independent status - this could be both parents deceased, one parent deceased, dependents under 18, married or civil partnership at start of academic year, over 25 at start of academic year, parents unable to contribute, parents estranged, parents’ jeopardy, parents not reachable, self-supporting, care leaver
• reason for special support grant - illness or caring responsibilities, registered deaf, registered disability, in receipt of employment support allowance, incapable of work, in receipt of income support, lone parent, over 60, responsible child
• behind with repayments on previous loan

Full details about how we process special category data are given in DfE’s appropriate policy document.

25.3 What we do with your data

These forecasts help assess value for money for students taking loans and the cost of student loans to the government. A summary of loan and grant forecasts is published for public interest and included in the Office for Budget Responsibility’s public expenditure forecast. Additionally, analysis of student loans and grants is carried out to inform policy decisions on student support, showing the impact on students and the cost to the government and taxpayers.

25.4 How long we keep your data

Our retention schedule includes information about how long we hold your personal data.

25.5 Your information rights under UK GDPR

Find out about  your rights when we process your personal data under the lawful basis of public task.

25.6 Data processors

DfE does not use a data processor for this activity.

26. Using your data when we are testing or checking our IT systems

26.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can test or check our IT systems.

The lawful basis we rely on for this processing of your personal data is legitimate interest, under article 6(1)(f) of the UK GDPR. When we use your special category data it is because we have a substantial public interest under article 9(2)(g) of UK GDPR.

26.2 Data we collect

DfE collects information from educational settings, local authorities, your employer and other government departments. We will process the following information about you:

• personal contact details
• date of birth
• data and information about your learning, including your courses and assessments

If the IT system or database contains special category data, we would be processing details about:

• equality, diversity and inclusion information
• ethnicity
• health

If the IT system or database contains sensitive information about you, we would be processing details about children that are looked after or are in care.

26.3 What we do with your data

When we are designing or maintaining a system or database. It is sometimes necessary to use ‘live’ personal data to test the design in a secure environment. This is because ‘dummy data’ is not capable of replicating the complexity of the data that is actually collected.

We may also invite users to try out our services, which can involve the collection of personal data. This helps us understand how users engage with our services, so we can keep improving them.

Similarly, it is necessary to extract copies and run quality checks so that we can identify unnecessary duplication or conflicting data about the same data subject.

To maintain the accuracy of our data, if we identify duplicate records we might:

• merge the duplicate records under one Unique Learner Number
• keep the existing records but include cross referencing so that all the records are linked and are retrieved when searching for the one data subject

26.4 How long we keep your data

For information about how long we hold personal data, see our retention schedule.

26.5 Your information rights under UK GDPR

Find out about  your rights when we process your personal data under the lawful basis of legitimate interest.

26.6 Data processors

DfE uses a data processor to support the building and testing of our IT systems and for our IT Health Checks (ITHC). An ITHC is a series of controlled tests and actions that check the security of our IT systems.

27. Using your data when we share your personal information

We will only share your personal data with others where it is lawful, secure and ethical to do so. Where these conditions are met, we can share your personal information with:

• schools and other education providers
• local authorities
• researchers like universities, think tanks and research organisations, either directly or vis the Office for National Statistics (ONS) or UK Data Service (UKDS) (University of Essex)
• organisations connected with promoting the education or wellbeing of children in England
• organisations fighting or identifying crime like police, courts and Home Office
• other crown and public bodies like Ofqual, Ofsted, UCAS and Office for Students
• organisations working for DfE under contract like DfE commissioned research or training providers
• organisations who provide careers and other guidance
• organisations who provide statistics and research about education, training, employment and well-being, including Jisc (formerly the Higher Education Statistics Agency or ‘HESA’) as detailed in Jisc’s collection notices

ONS and UKDS hold pseudonymised DfE datasets for as long as researchers need them. Once we know that researchers do not want to use it anymore, it will be destroyed. How DfE shares personal data includes further information about sharing data with ONS and UKDS.

Your data is also submitted to Jisc so that you can take part in the graduate outcomes survey

DfE shares personal data where this is a benefit to:

• education
• the children’s services sector
• the interests of the wider public or society such as sharing data to fight crime or for policy development

How DfE shares personal data gives details of the protections DfE has in place when sharing your data and the relevant legislation.

The DfE Data Sharing Approval Panel (DSAP) must approve all data share requests. The panel of experts assesses each application for:

• public benefit
• proportionality
• legal underpinning
• strict information security standards

The DSAP panel has external members who analyse decisions to increase public trust in the data share process.

27.1 Purpose and lawful basis for processing

DfE will only share data with a third party where we have a lawful basis for the data share under article 6(1) of the UK GDPR.

In most cases, DfE relies on article 6(1)(e) ‘public task’ as the lawful basis where the task or function has a clear basis in law or 6(1)(f) ‘legitimate interest’ where the sharing of your data does not override your rights or when you expect us to share your data.

When we share special category data, we have a lawful basis to data share under article 9(2) of the UK GDPR. Full details about how we process special category data are given in the DfE appropriate policy document and How DfE shares personal data..

DfE will review each data share request on a case-by-case basis to ensure the right lawful basis is used. The ICO guide to lawful basis has more details.

For example, we share data under public task with:

• awarding organisations to allow exam outcomes to be accurately predicted
• Children’s Commissioner’s Office (CCO) to protect and promote the rights and interests of children in England, especially the most vulnerable
• fraud prevention and law enforcement agencies such as the police and the National Crime Agency to prevent and detect fraud in the funding of education and learning.
• Home Office (HO) to prevent abuse of immigration control
• police and criminal investigation authorities, through court orders to safeguard and promote welfare of children in the UK

We share data under legitimate interest with:

• Education Policy Institute (EPI) to identify if government policies are delivering a high-quality education system
• National Foundation for Educational Research (NFER) and Scottish Qualifications Authority (SQA) to investigate developments to the national curriculum

We share under legal obligation with:

• other official bodies appointed in the public interest for a specific investigatory or advisory purpose, such as a public inquiry

Full details of who we share data with are available: DfE external data shares.

28. How to contact us and how to make a complaint

28.1 How to contact us

Requesting your personal information from DfE has information on how you can:

• ask questions about how we use your information
• make a complaint to the Data Protection Officer and the Information Commissioner’s Office if you have concerns about how we use your personal information

28.2 How to access your personal information

You can make a request to access your personal information verbally or in writing.