Privacy information: key stage 4 and 5 and adult education

Question 1

1. Using your data to provide money for your learning

Accepted Answer

1.1 Using your data to fund your learning, including apprenticeships

This includes funding learning in the following educational settings:

schools
academies
colleges
sixth forms
adult education training providers
apprenticeships

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Section 11 of the Education Act 1996 allows us to do this.

When we use your sensitive information, this is ‘special category’ data. The reasons we use it because we have a substantial public interest under article 9(2)(g) of the UK GDPR. This processing is under Section 54 of the Further and Higher Education Act (1992).

Full details about how we process special category data are given in the DfE appropriate policy document.

Data we collect

We need enough information to work out how much funding is required for your learning. DfE provides funding for teaching as well as buildings and special programmes. Funding is calculated based upon the numbers of learners in each educational setting and if they have needs which need additional funding.

To do this we collect the following information from your educational setting or local authority about you:

personal contact details
date of birth
data and information about your learning, including your courses and assessments

We collect and use special category data, to work out any additional funding needs, this includes details about:

your equality, diversity and inclusion information
your health, including disabilities and special educational needs

Full details about how we process special category data are given in the DfE appropriate policy document.

For further details about safeguarding children with special educational needs and disability in schools, colleges and children’s services, see special educational needs and disability (SEND) and special educational needs and disability (SEND) and high needs.

What we do with your data

We use the data to work out how much funding is required and to publish statistics on funding.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 7 years for funding and financial purposes.

If the learning is funded by European Social Fund (ESF), we must retain the data until 31 December 2034.

If your personal information is included in any legal agreement classified as a Deed, we will retain it for 12 years from the point of the Deed’s expiry.

Your rights

We are relying on public task for this processing, this means you have:

the right to be informed about the collection and use of your personal data – this is called ’right to be informed’
the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
the right to ask us to stop using your information – this is called ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf.

Training providers are data processors for the adult education and apprenticeship data that they send to DfE.

For most of the personal data schools or the multi-academy trusts collect, store and use, they are the data controller. However, where a school is required to supply a copy of some personal data to the department, DfE also becomes an independent data controller of the copy it receives.

1.2 Using your data to ensure the protection of public funds by preventing and detecting fraud

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Section 11 of the Education Act 1996, providing funding for primary, secondary or further education, allows us to do this.

When we use your sensitive or ‘special category’ data. We use it because we have a substantial public interest, the Education Act 2002 or Apprenticeships, Skills, Children and Learning Act 2009 allow this. Full details about how we process special category data are given in the DfE appropriate policy document.

Data we collect

We use your personal data to ensure schools, academies, colleges, sixth forms, adult education training providers and apprenticeships have received the correct funding.

To do this we collect the following information from your educational setting or local authority about you:

personal contact details
date of birth
data and information about your learning, including your courses and assessments

We collect special category data, this includes details about:

your equality, diversity and inclusion information
your health

Full details about how we process special category data are given in the DfE appropriate policy document.

What we do with your data

We use your data to investigate suspected fraud or financial irregularity.

More details on how ESFA handles allegations of suspected fraud or financial irregularity are available.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 7 years after legal proceedings have been completed.

Your rights

We are relying on public task for this processing, this means you have:

the right to be informed about the collection and use of your personal data – this is called ’right to be informed’
the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
the right to ask us to stop using your information – this is called ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf.

The National Audit Office (NAO) audits the DfE accounts, to analyse public spending and to improve our services. The NAO is a controller for your personal data that they process.

When fraud is identified, your personal data will be shared by us as necessary for the purposes of preventing and detecting fraud. It will be shared with fraud prevention and law enforcement agencies, such as the Police and the National Crime Agency.

Question 2

2. Using your data to support your learning, including apprenticeships

Accepted Answer

2.1 Using your data to create your unique learner number (ULN) and your personal learning record (PLR)

Your unique learner number (ULN) is a unique 10-digit number. Most learners aged over 14 have one and it’s designed to work with your PLR as proof of your learning and achievements.

Your personal learning record (PLR) is a permanent online record of your qualifications and achievements.

The PLR includes learning that is funded by the DfE. It also includes learning that is not funded by the DfE, such as learning that is funded by the learner or training provider. Your training provider can send us details of this non-funded learning.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. The Education (Information About Individual Pupils) (England) Regulations 2013, Schedule 1, Part 1 and Education Act 1996 Section 537A, allows us to do this.

When we collect data on behalf of the Ministry of Justice, Section 107 of the Apprenticeships, Skills, Children and Learning Act 2009 allows us to do this.

However, to carry out these functions, the core set of mandatory pieces of information do not always enable us to confidently match learners to their records, so DfE collects the following additional information.

Data we collect

To create your personal learning record and your unique learner number, we collect the following information under public task. We collect the information from schools, academies, colleges and training providers:

first name, or if more than one, each first name
surname, and former surname, if known
preferred surname
gender
date of birth
current unique pupil number, and previous unique pupil number, if applicable
unique learner number

We collect these pieces of information to distinguish between learners and verify accuracy:

email address
date of address capture
last known address line 1
last known address Line 2
last known address county or city
school at age 16
family name at 16
Unique Candidate Number (UCI)
place of birth
Scottish candidate number, if applicable

We collect this information for awarding organisations (the organisation that awards your qualification), to verify your data:

learner date of birth
learner gender
learner post code

What we do with your data

We use your information to create a Unique Learner Number (ULN) and a Personal Learning Record (PLR). These enable us to record your learning achievements and to enable learning/training providers to claim public funds for your learning, to provide advice and guidance for career progression, employment opportunities or next steps in learning.

See more on how to access your personal learning record.

We store your ULN and PLR information in learning records service (LRS).

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

The PLR is a lifetime record of achievement for all learners. As learners are unlikely to return to learning after the age of 80. Therefore, all data in LRS will be retained for a minimum of 5 years from their latest learning event, or until the individuals 80th birthday (whichever is longer).

Your rights

We are relying on public task for this processing, this means you have:

the right to be informed about the collection and use of your personal data – this is called ’right to be informed’
the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
the right to ask us to stop using your information – this is called ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a training provider that process data about learners on behalf of the DfE.

For most of the personal data schools or the multi-academy trusts collect, store and use, they are the data controller. However, where a school is required to supply a copy of some personal data to the department, DfE also becomes an independent data controller of the copy it receives.

2.2 Using your data to enable you to apply for apprenticeships

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. The Apprenticeships, Skills, Children and Learning Act 2009 allows us to do this.

Data we collect

Your employer and training provider will have entered your apprenticeship details into our services on your behalf. They will have provided us with the following personal information:

first name
last name
date of birth
Unique Learner Number
email address

What we do with your data

The personal information provided will be used:

to match you to the details of your apprenticeship as provided by your employer and training provider
to provide help and support during the use of the service
to notify you of specific in-service updates and actions with regard to your apprenticeship
to contact you for feedback on services we provide to you
for administration and research purposes
to ensure the protection of public funds
to prevent and detect fraud

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for administration purposes for 20 years.

Your rights

We are relying on public task for this processing, this means you have:

the right to be informed about the collection and use of your personal data – this is called ’right to be informed’
the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
the right to ask us to stop using your information – this is called ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

You should review and confirm your apprenticeship details are correct when starting your apprenticeship. If you need to change any details, contact us or your training provider.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

2.3 Using your data to record, monitor and report on your learning achievements or attainments

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Section 11 of the Education Act 1996, allows us to do this, improving standards in education, encourage diversity and increase opportunities in learning and education.

When we use your sensitive or ‘special category’ data. We use it because we have a substantial public interest. The Education Act 2002, Apprenticeships, Skills, Children and Learning Act 2009 or the Further and Higher Education Act (1992) allows us to use your data.

DfE uses your data for research and to publish statistics on learners and funding. Our lawful basis for using your special category personal data is article 9(j) archiving, research and statistics (with a basis in law), this is in accordance with article 89(1) and schedule 1 part (4) of the DPA 2018.

Full details about how we process special category data are given in the DfE appropriate policy document.

Data we collect

We collect and use the following personal information. The information is sent to DfE from your school, academy, college, training provider or local authority:

your name and address
reference numbers that identify you as a pupil/learner
details of schools attended
information relating to exam and assessment results
information relating to what you did after you finished school

We collect special category data, this includes details about:

your gender or ethnicity
details of any special educational needs you may have, this includes health or disability information

We also collect sensitive information:

information relating to any contact with children’s services
information on absence and exclusions

Full details about how we process special category data are given in the DfE appropriate policy document.

What we do with your data

We need your personal data to:

monitor how well our education policies are working – our analysis of your data provides DfE, education providers, Parliament and the wider public with a clear picture of how the education and children’s services sectors are working in order to better target, and evaluate, policy interventions to help ensure all children are kept safe from harm and receive the best possible education
produce official statistics – see statistics at DfE for more details

Your personal data is shared by awarding organisations, they send DfE details of your qualifications so we have a record of your achievements.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

To enable DfE to use your education data for long-term research, we keep your personal data:

until aged 80 in the Longitudinal Education Outcomes (LEO) database, see the Longitudinal Education Outcomes (LEO): privacy notice for more information
until state retirement age, plus 3 years, in the National Pupil Database (NPD) and the Pupil Parent Matched Data (PPMD) database. See the National Pupil Database (NPD): privacy notice and the Pupil Parent Matched Data (PPMD): privacy notice for more information

We review this retention policy, and the need to retain the data held, on an annual basis. As part of these ongoing reviews, we consider whether the data needs to be retained and, if so, whether it is possible to fully anonymise or de-identify the data.

Your rights

We are relying on public task for this processing, this means you have:

the right to be informed about the collection and use of your personal data – this is called ’right to be informed’
the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR).
the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
the right to ask us to stop using your information – this is called ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf.

DfE uses a data processor for the following activities:

services that support the production of the school and college performance tables (and associated digital services including Find and Compare School Performance and Analyse School Performance) and National Pupil Database (NPD) pupil matching
training provider that process data about learners on behalf of the DfE

For most of the personal data schools or the multi-academy trusts collect, store and use, they are the data controller. However, where a school is required to supply a copy of some personal data to the department, DfE also becomes an independent data controller of the copy it receives.

2.4 Using your data to improve the education of children in England

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Section 11 of the Education Act 1996, allows us to do this, improving standards in education, encourage diversity and increase opportunities in learning/education.

When we use your sensitive or ‘special category’ data. We use it because we have a substantial public interest. The Education Act 2002, Apprenticeships, Skills, Children and Learning Act 2009 or the Further and Higher Education Act (1992) allows us to use your data. Full details about how we process special category data are given in the DfE appropriate policy document.

Data we collect

We collect and use the following personal information. The information is sent to DfE from your school, academy, college, training provider or local authority:

your name and address
reference numbers that identify you as a pupil/learner
details of schools attended
information relating to exam and assessment results
information relating to what you did after you finished school

We collect special category data, this includes details about:

your gender or ethnicity
details of any special educational needs you may have, this includes health or disability information

We also collect sensitive information:

information relating to any contact with children’s services
information on absence and exclusions

Full details about how we process special category data are given in the DfE appropriate policy document.

What we do with your data

We need your personal data to:

monitor how well our education policies are working – our analysis of your data provides DfE, education providers, Parliament and the wider public with a clear picture of how the education and children’s services sectors are working in order to better target, and evaluate, policy interventions to help ensure all children are kept safe from harm and receive the best possible education
produce official statistics – see statistics at DfE for more details

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

To enable DfE to use your education data for long-term research, we keep your personal data:

until aged 80 in the Longitudinal Education Outcomes (LEO) database, see the Longitudinal Education Outcomes (LEO): privacy notice for more information
Until state retirement age, plus 3 years, in the National Pupil Database (NPD) and the Pupil Parent Matched Data (PPMD) database. See the National Pupil Database (NPD): privacy notice and the Pupil Parent Matched Data (PPMD): privacy notice for more information

We review this retention policy, and the need to retain the data held, on an annual basis. As part of these ongoing reviews, we consider whether the data needs to be retained and, if so, whether it is possible to fully anonymise or de-identify the data.

Your rights

We are relying on public task for this processing, this means you have:

the right to be informed about the collection and use of your personal data – this is called ’right to be informed’
the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
the right to ask us to stop using your information – this is called ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activities:

services that support the production of the school and college performance tables (and associated digital services including Find and Compare School Performance and Analyse School Performance) and National Pupil Database (NPD) pupil matching
the Office for National Statistics (ONS) act as a processor on behalf of DfE for requests where DfE data has been made available to external researchers within the ONS Secure Research Service following approval and instructions by DfE - see the section on long-term research for details
training provider that process data about learners on behalf of the DfE

For most of the personal data schools or the multi-academy trusts collect, store and use, they are the data controller. However, where a school is required to supply a copy of some personal data to the department, DfE also becomes an independent data controller of the copy it receives.

2.5 Using your data to monitor attendance in education and learning

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Section 11 of the Education Act 1996 allows us to do this.

When we use your sensitive or ‘special category’ data. We use it because we have a substantial public interest. The Education Act 2002, Apprenticeships, Skills, Children and Learning Act 2009 or the Further and Higher Education Act (1992) allows us to use your data.

DfE uses your data for research and to publish statistics on learners and funding. Our lawful basis for using your special category personal data is article 9(j) archiving, research and statistics (with a basis in law), this is in accordance with article 89(1) and schedule 1 part (4) of the DPA 2018.

Full details about how we process special category data are given in the DfE appropriate policy document.

Data we collect

We collect and use the following personal information. The information is sent to DfE from your school, academy, college, training provider or local authority:

your name and address
reference numbers that identify you as a pupil or learner

We collect special category data, this includes details about:

your gender or ethnicity
details of any special educational needs you may have, this may include health or disability information

We also collect sensitive information on absence and exclusions.

Full details about how we process special category data are given in the DfE appropriate policy document.

What we do with your data

We need your personal data to:

monitor how well our education policies are working – our analysis of your data provides DfE, education providers, Parliament and the wider public with a clear picture of how the education and children’s services sectors are working in order to better target, and evaluate, policy interventions to help ensure all children are kept safe from harm and receive the best possible education
produce official statistics – see statistics at DfE for more details

Your personal data is shared by awarding organisations, they send DfE details of your qualifications so we have a record of your achievements.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

To enable DfE to use your education data for long-term research , we keep your personal data:

until aged 80 in the Longitudinal Education Outcomes (LEO) database, see the Longitudinal Education Outcomes (LEO): privacy notice for more information
until state retirement age, plus 3 years, in the National Pupil Database (NPD) and the Pupil Parent Matched Data (PPMD) database. See the National Pupil Database (NPD): privacy notice and the Pupil Parent Matched Data (PPMD): privacy notice for more information

We review this retention policy, and the need to retain the data held, on an annual basis. As part of these ongoing reviews, we consider whether the data needs to be retained and, if so, whether it is possible to fully anonymise or de-identify the data.

Your rights

We are relying on public task for this processing, this means you have:

the right to be informed about the collection and use of your personal data – this is called ’right to be informed’
the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
the right to ask us to stop using your information – this is called ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activities:

services that support the production of the school and college performance tables (and associated digital services including Find and Compare School Performance and Analyse School Performance) and National Pupil Database (NPD) pupil matching
training provider that process data about learners on behalf of the DfE

2.6 Using your data when you continue your learning at another training provider

If your training provider closes, we may need to transfer your learner records to a new provider to enable your learning to continue.

See more about how schools share personal data when you transfer to a new school.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Sections 10 and 11 of the Education Act 1996 allow us to do this.

When a training provider closes or exits the market, the DfE takes on the role of data controller for the provider’s learner administration records until they can be destroyed once they reach the end of their retention period or the learner records can be transferred to a new training provider. This is specified in the funding agreement. Details of the ESFA funding agreements can be found at ESFA education and skills agreements 2022 to 2023.

When we use your sensitive or ‘special category’ data we use it because we have a substantial public interest, the Apprenticeships, Skills, Children and Learning Act 2009 allows this. Full details about how we process special category data are given in the DfE appropriate policy document.

Data we collect

We collect and use the following personal information. The information is sent to DfE from your training provider:

your name and address
reference numbers that identify you as a learner
details of schools attended
information relating to exam and assessment results

We collect special category data, this includes details about:

your gender or ethnicity
details of any special educational needs you may have, this may include health or disability information

Full details about how we process special category data are given in the DfE appropriate policy document.

What we do with your data

We use your information so that your new training provider has access to the information about you as a learner so that you can continue your learning.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 6 years from the end of the financial year in which the last payment is made under the contract. If the learner records have also been used for match funding purposes for the European Social Fund. DfE is required to retain these records until the destruction date relevant to this 2014 to 2020 Programme, which is until 31 December 2034.

Your rights

We are relying on public task for this processing, this means you have:

the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
the right to ask us to stop using your information – this is called ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a training provider to process data about learners on behalf of DfE.

Question 3

3. Using your data to get your views

Accepted Answer

3.1 Using your data to contact you for feedback

DfE measures the impact and effectiveness of each of our services, our programmes or our events to make improvements to the service we offer to you. We do this through surveys, public consultations and feedback about our help desks.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Sections 10 and 11 of the Education Act 1996 allows us to do this.

Data we collect

We collect and use the following personal information directly from you. We use the information you provide to us when you contact DfE or attend one of your programmes or events:

your full name
email address
phone number
your date of birth
your address

See using your data to contact you for research for more information.

What we do with your data

We use your data to make improvements to the services we offer to you.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 5 years. This is in line with the DfE retention policy for business operational data.

Your rights

We are relying on public task for this processing, this means you have:

the right to be informed about the collection and use of your personal data – this is called ’right to be informed’
the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
the right to ask us to stop using your information – this is called ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activities:

we use Arvato to provide our service desk

Question 4

4. Using your data to contact you for research

Accepted Answer

DfE undertakes research to learn how you interact with our services and to support our operational development and delivery. We do this research to make improvements to the services we offer to you. We will always seek your permission to take part in any research.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Section 10 of the Education Act 1996 allows us to do this.

Data we collect

We collect and use the following personal information. We use the information you provide directly to us when you contact DfE or attend one of your programmes or events or use our digital services or helpdesk:

your full name
email address
phone number

What we do with your data

We use your data to make improvements to the services we offer to you, to develop policy and to develop new services. We use your data to contact you to invite you to participate in research that is relevant to you. You are under no obligation to participate in any research we invite you to. We will not contact you about research using your data if you tell us not to. See using your data to gather evidence for policy development and delivery for more information on how we process your personal information during the research.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information until 2 years after the end of the survey or research.

Your rights

We are relying on public task for this processing, this means you have:

the right to be informed about the collection and use of your personal data – this is called ’right to be informed’
the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
the right to ask us to stop using your information – this is called ‘right to restriction of processing’
the ‘right to object to processing’ of your information
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

As we are processing your personal data with your consent, you have the right to withdraw consent to the processing of your personal data at any time. If you change your mind, or you are unhappy with our use of your personal data, contact DfE and state the project or initiative name.

Question 5

5. Using your data to carry out research

Accepted Answer

5.1 Using your data to gather evidence for policy development and delivery

DfE undertakes research and surveys to gather evidence to support our policy development and delivery. Having this evidence is important when improving outcomes for children, young people, families and adults. See research at DfE for more details.

Purpose and lawful basis for processing

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Section 10 of the Education Act 1996 allows us to do this.

When we use your sensitive information, this is ‘special category’ data. The reasons we use it because we have a substantial public interest under article 9(2)(g) of UK GDPR, the Education Act 2002 allows this.

Sometimes we link your survey responses to other government-held data, the lawful basis for this processing is ‘consent’ under article 6(1)(a) of the UK GDPR.

Data we collect

We collect and use the following personal information directly from you:

your full name
email address
phone number
your date of birth
your address

When we use your sensitive or ‘special category’ data. We use it because we have a substantial public interest and you have given your ethical consent to participate in the research. As part of our research we may need to collect information about your:

heath or disability
racial or ethnic origin
gender

Full details about how we process special category data are given in the DfE appropriate policy document and in the research information sheet. You will be given this research information sheet at the start of the research.

What we do with your data

We’ll use your personal information for research that DfE undertakes to provide high-quality evidence to inform policy development and delivery.

Sometimes we link your survey responses to other government-held data, the lawful basis for this processing is ‘consent’. At any time, you can tell us you no longer want us to link your data to other data. You can do this by using our contact form.

We will publish a summary of the research and the full research report. Your responses may be attributed to an organisation where this information has been provided but our publications will not contain any personal data. DfE will anonymise or desensitise the data where possible.

Research reports published since May 2010 are available on GOV.UK.

Research published before May 2010 is available from the UK government web archive.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information until 12 months after the end of the survey or research.

See research at DfE and parent, pupil and learner panel omnibus surveys for more information.

Your rights

We are relying on public task for this processing, this means you have:

the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
the right to ask us to stop using your information – this is called ‘right to restriction of processing’, and
your ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling
the right to withdraw consent at any time, by using our contact form
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

If you have agreed that we can link your survey responses to other government-held data, we are undertaking this processing with your consent. You have the right to withdraw that consent up until the data is analysed for the publication. If you change your mind, or you are unhappy with our use of your personal data, contact DfE and state the project or initiative name.

Further information on rights and the ways in which your data may be used are contained in the research consent form.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activities:

DfE uses contractors to work on behalf of DfE to undertake the research, our contractors will receive your personal data directly from you during the activity or initiative
The Programme for International Student Assessment (PISA) is an international comparison of reading, maths and science performance of 15-year-old pupils. Pearson will process your personal data to deliver the PISA 2025 study on behalf of DfE. See their website for more information About PISA25

5.2 Using your data so we can undertake long-term research and publish official statistics

DfE undertakes long-term research to show the impact of education or training on outcomes later in life. We process the data already collected about your learning and achievements from the following educational settings:

schools
academies
colleges
sixth forms
adult education training providers
apprenticeships

We also collect data from local authorities about children in care or who have been in care.

We also collect data as part of specific research – see Research at DfE for more details.

This data is used to provide long-term research and statistics on education. DfE undertakes long-term research to show us how learning can affect your future earning and employment outcomes.

DfE publishes official statistics on early years, schools, further education, higher education, children and young people. This is carried out in line with the code of practice for official statistics and DfE official statistics: standards and policies.

DfE takes part in the OECD’s Programme for International Student Assessment (PISA), the next study will be PISA 2025. For previous results see PISA 2018: national report for England.

Purpose and lawful basis for processing

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Section 10 of the Education Act 1996, Section 83 of the Children’s Act 1989, Section 78 of the Small Business, Enterprise and Employment Act 2015 and Sections 87 to 91 of the Education and Skills Act 2008 allow us to do this. For the PISA study, Section 20 of the Education Act 2011 allows us to do this.

When we use your sensitive or ‘special category’ data. We use it because we have a substantial public interest. The Education Act 2002, Apprenticeships, Skills, Children and Learning Act 2009 or the Further and Higher Education Act (1992) allows us to use your data.

DfE uses your data for research and to publish statistics on learners and funding. Our lawful basis for using your special category personal data is article 9(j) archiving, research and statistics (with a basis in law), this is in accordance with article 89(1) and schedule 1 part (4) of the DPA 2018.

Full details about how we process special category data are given in the DfE appropriate policy document.

We’ll use your personal information for research that DfE undertakes to provide high-quality evidence to inform policy development and delivery.

Data we collect

The information is sent to DfE from your school, academy, college, training provider or local authority. The categories of data we hold include:

your name and address
unique pupil and learner numbers
pupil matching reference numbers
details of schools, academies, colleges, universities, training providers and other education providers attended
information relating to exam results
information relating to what you did after you finished school

We collect and use special category data, this includes details about:

characteristics such as your gender or ethnicity
your equality, diversity and inclusion information
your health, including disabilities.
details of any special educational needs you may have

We also collect sensitive information:

information relating to any contact with children’s services
information on absence and exclusions

Full details about how we process special category data are given in the DfE appropriate policy document.

Linking your data to other databases

We connect or link your education data with your employment, benefits and earnings data to create a de-identified person level database. The personal information we use to link this data together are:

name
date of birth
gender
postcode
national insurance number

Personal identifiers from our education databases are sent to the Department for Work and Pensions (DWP) who match the records against their customer information system. The matched records are then linked to your employment, earnings and benefit data that is held at DWP. All personal identifiers are then removed. Once the link is made, we can then link to other information, such as:

if you qualified for free school meals
schools attended, courses taken and qualifications achieved
any benefits claimed
employment and earned income

And special category data, such as:

personal characteristics including gender and ethnic group
if the young person had special educational needs during their education, this may include health or disability information

Full details about how we process special category data are given in the DfE appropriate policy document.

What we do with your data

DfE has 2 long-term research databases that are used for research and statistical purposes – the National Pupil Database (NPD) and the Longitudinal Education Outcomes (LEO) database.

The data stored in the NPD is provided by educational settings or local authorities as part of the operation of the education system, such as to fund your learning. This data is used for research and statistical purposes to improve and promote, the education and well-being of children in England.

The LEO database compares students’ levels of education to their levels of employment and earnings in later life. To do this, we link personal information obtained from the NPD to other government departments relating to education, employment and benefit claims in order to:

enable comparisons of the performances of schools, colleges and universities
provide statistical information to support education and career decisions
evaluate and monitor the impact of education or training on outcomes
support government decision making in order to improve services

DfE works with 4 government departments on the LEO study: Welsh Government, Department for Work and Pensions (DWP), His Majesty’s Revenue and Customs (HMRC) and Scottish Government.

See apply to access the Longitudinal Education Outcomes (LEO) dataset for more details about LEO.

For more details about NPD see apply for Department for Education (DfE) personal data.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

Your personal information is kept for your learning and working life. To enable DfE to use your education data for long-term research, we keep your personal data:

until aged 80 in the Longitudinal Education Outcomes (LEO) database, see the Longitudinal Education Outcomes (LEO): privacy notice for more information
Until state retirement age, plus 3 years, in the National Pupil Database (NPD) and the Pupil Parent Matched Data (PPMD) database. See the National Pupil Database (NPD): privacy notice and the Pupil Parent Matched Data (PPMD): privacy notice for more information

We review this retention policy, and the need to retain the data held, on an annual basis. As part of these ongoing reviews, we consider whether the data needs to be retained and, if so, whether it is possible to fully anonymise or de-identify the data.

Your rights

We are relying on public task for this processing, this means you have:

the right to be informed about the collection and use of your personal data – this is called ’right to be informed’
the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
the right to ask us to stop using your information – this is called ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

Question 6

6. Using your data to protect you

Accepted Answer

6.1 Using your data so we can protect you

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Section 11 of the Children Act 2004, section 175 of the Education Act 2002 and the Education and Inspections Act 2006 allows us to do this.

Special categories of personal data need to also be processed for reasons of substantial public interest under section 10 (3) of the DPA 2018 (Special categories of personal data) and 18 (Safeguarding of children and individuals at risk). We use it because we have a substantial public interest, the Education Act 2002 allows this. Full details about how we process special category data are given in the DfE appropriate policy document.

Data we collect

DfE collects information from educational settings, local authorities, your employer and other government departments to safeguard children and adults. We collect and use the following personal information:

name, date of birth and address

We collect and use the following special category data:

characteristics (such as gender, ethnicity and disability)

We collect and use the following sensitive information:

episodes of being a child in need, if applicable
notes about the concern

Full details about how we process special category data are given in the DfE appropriate policy document.

For further details about safeguarding children with special educational needs and disability in schools, colleges and children’s services, see special educational needs and disability (SEND) and special educational needs and disability (SEND) and high needs.

What we do with your data

We’ll use your personal information to:

keep you or another pupil or learner safe from potential harm
identifying issues and providing support for mental and physical health issues
prevent extremism in the education system - DfE works to ensure children and young people are not exposed to extremists and extremist messages

The Teaching Regulation Agency (TRA) is an executive agency of the Department for Education (DfE). TRA regulate the teaching profession in England and investigate cases of serious misconduct. If you are a witness or potential witness within a teacher misconduct investigation, TRA processes your information to investigate allegations of serious misconduct.

We may share your personal data with other organisations where DfE and its executive agencies are notified of an issue regarding safeguarding of children and young people.

Other people and organisations may also share personal data with DfE and its executive agencies, for example, when they make a complaint or raise a concern with us. This can include information shared in accordance with the statutory guidance keeping children safe in education and working together to safeguard children. This information will be used to investigate complaints and to ensure trusts and academies comply with the regulations (including Independent schools (Education (Independent School Standards) Regulations 2014 (PDF, 131KB)).

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

For safeguarding cases, we keep your personal information until you are aged 25, or 10 years after the date of the allegation, whichever is longer, then it is reviewed.

The TRA will only keep your personal data for as long as they need to for the purpose of regulating the teaching profession, specifically up to 50 years after the closure of a case. After 50 years it will be securely destroyed.

Your rights

We are relying on public task for this processing, this means you have:

the right to be informed about the collection and use of your personal data – this is called ’right to be informed’
the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
the right to ask us to stop using your information – this is called ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

6.2 Using your data to improve the well-being of children in England

DfE collects information about vulnerable children and children who have been, or are, in care.

Purpose and lawful basis for processing

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Section 10 of the Education Act 1996 and section 7 of the Children and Young Persons Act 2008 allows us to do this as DfE is promoting the well-being of children (persons under the age of 18) in England.

When we use your sensitive or ‘special category’ data. We use it because we have a substantial public interest. The Education Act 2002, Apprenticeships, Skills, Children and Learning Act 2009 or the Further and Higher Education Act (1992) allows us to use your data. Full details about how we process special category data are given in the DfE appropriate policy document.

What data we collect

DfE collects information from educational settings, local authorities, your employer and other government departments. We collect and use the following personal information:

name, date of birth and address
characteristics (such as gender, ethnicity and disability)
episodes of being a child in need (such as referral information, assessment information, Section 47 information, Initial Child Protection information and Child Protection Plan information)
episodes of being looked after (such as important dates, information on placements)
outcomes for looked after children (such as whether health and dental assessments are up to date, strengths and difficulties questionnaire scores and offending)
adoptions (such as dates of key court orders and decisions)
care leavers (such as their activity and what type of accommodation they have)

What we do with it

We use this personal data to:

support these children and monitor their progress
provide them with pastoral care
assess the quality of our services
evaluate and improve our policies on children’s social care

How long we keep it

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. We call this our retention and disposal schedule.

To enable DfE to use your education data for long-term research,we keep your personal data:

to enable DfE to use your education data for long-term research:
until aged 80 in the Longitudinal Education Outcomes (LEO) database – see the Longitudinal Education Outcomes (LEO): privacy notice for more information
until state retirement age, plus 3 years, in the National Pupil Database (NPD) and the Pupil Parent Matched Data (PPMD) database. See the National Pupil Database (NPD): privacy notice and the Pupil Parent Matched Data (PPMD): privacy notice for more information

We review this retention policy, and the need to retain the data held, on an annual basis. As part of these ongoing reviews, we consider whether the data needs to be retained and, if so, whether it is possible to fully anonymise or de-identify the data.

Your rights

We are relying on public task for this processing, this means you have:

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

See Privacy information: children and young people under 18 for details on:

using data when a child is looked after by local authorities
using data when a child is in need
using data when we receive a Serious Incident Notification (SIN)

Question 7

7. Using your data to promote learning opportunities

Accepted Answer

7.1 When we promote learning or career opportunities to you

DfE has campaigns to promote university education or apprenticeships or learning to specific groups, for example to minority groups or disadvantaged children.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is Legitimate Interest, under article 6(1)(f) of the UK GDPR.

Data we collect

DfE collect and use the following personal information directly from you:

full name
address
email
mobile number, if applicable

DfE may purchase mailing lists to support these DfE campaigns.

You have the right to opt out of these messages. If you do not want to receive these messages, click on the ‘unsubscribe’ link in the email. Alternatively, let us know, stating the title of the email message.

What we do with your data

We use your personal information for inspiration campaigns that promote and encourage uptake of learning.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 5 years from the date of the campaign.

Your rights

We are relying on legitimate interest for this processing, this means you have:

the right to be informed about the collection and use of your personal data – this is called ’right to be informed’
the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to delete your personal information – this is called ‘right to erasure’
the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
the right to ask us to stop using your information – this is called ‘right to restriction of processing’
the ‘right to object to processing’ of your information
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

You have the right to opt out of these messages. If you do not want to receive these messages, click on the ‘unsubscribe’ link in the email, or let us know by contacting DfE and stating the title of the email message.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activities:

DfE uses contractors to process our communications campaigns, such as creative agencies and PR agencies

7.2 Using your data when we create case studies about you

We write case studies to demonstrate the benefits of learning, like case studies about apprentices. DfE apprenticeship campaigns are aimed at 14 to 19-year-olds. These could be written, audio or video case studies.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is consent, under article 6(1)(a) of the UK GDPR. DfE processes your personal data in relation to filming, photography and/or audio recordings on the basis of your consent. This consent is for a specific purpose and your media will not be used for any other purpose. Should we wish to use it for a different purpose we will contact you direct and ask for your consent for the new purpose.

By signing the filming, photography and audio recordings consent form, you are agreeing that we can record, process and publish your image, words or voice in both printed and digital form as applicable, for the creation of internal and external promotional and follow-up communications material. This includes content that will be posted across some or all of our social media channels. See our social media use policy for more details.

When we use your sensitive or ‘special category’ data. We use it because you have given your explicit consent. Full details about how we process special category data are given in the DfE appropriate policy document.

Data we collect

DfE collect and use the following personal information directly from you:

full name
address
email
mobile number
date of birth

We collect and use the following special category data:

ethnicity
disability, if applicable
gender

Full details about how we process special category data are given in the DfE appropriate policy document.

What we do with your data

We use your personal information to create case studies that are used to promote apprenticeships, they are published in magazines, website, social media etc. DfE also use case studies for TV and YouTube advertisements.

We provide information, insight and engagement to influence a range of stakeholders through members’ individual experience and story of an apprenticeship.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 5 years from when you sign off the case study.

The DfE social media channels are captured by the National Archives’ government web archive as a permanent record of DfE’s social media channels.

Your rights

We are relying on consent for this processing, this means you have:

the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
the right to ask us to delete your personal information – this is called ‘right to erasure’
the right to ask us to stop using your information – this is called ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling
the right to withdraw consent at any time (where relevant), by using our contact form

As we are processing your personal data with your consent, you have the right to:

If you change your mind, or you are unhappy with our use of your personal data, contact DfE state the project or initiative name.

Further information on rights and the ways in which your data may be used are contained in the filming, photography and audio recordings consent form.

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activities:

DfE may use contractors (such as PR companies) to collect data for our case studies

We use social media to share news and views with people working in:

schools
colleges
local authorities
children’s services

We also use social media to communicate with parents, children and young people.

See our social media use policy for more details.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is consent under article 6(1)(a) of the UK GDPR – this is when we ask your consent to use your information.

Data we collect

When you interact with our social media channels we collect and use:

your name

What we do with your data

When you use our websites and social media channels, we use your personal information to:

allow you to take part in interactive features of our service, when you choose to do so
ensure we present our website content in the best way for you
provide you with information or services that you request from us or which may interest you - we always get your consent when you request these DfE services
notify you about changes to our website or services

See the DfE cookies policy.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

The DfE social media channels are captured by the National Archives’ government web archive as a permanent record of DfE’s social media communication.

Your personal information is retained for up to 2 years, see the details about cookies on GOV.UK page for more information.

Your rights

We are relying on consent for this processing, this means you have:

the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
the right to ask us to delete your personal information – this is called ‘right to erasure’
the right to ask us to stop using your information – this is called ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling
the right to withdraw consent at any time (where relevant), by using our contact form.

As we are processing your personal data with your consent, you have the right to:

withdraw consent to the processing of your personal data at any time, by using our contact form
ask DfE to cease publication of your image, words or voice on its social media channels, if you do so, DfE will not publish further social media posts featuring this content, but it is not obligated to remove or delete existing posts - the DfE social media channels are captured by the National Archives’ government web archive as a permanent record of DfE’s social media communication

If you change your mind, or you are unhappy with our use of your personal data, contact DfE and state the name of this project.

Further information on rights and the ways in which your data may be used are contained in the filming, photography and audio recordings consent form.

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activities:

we use Google Analytics cookies and a Real User Monitoring (RUM) cookie from SpeedCurve to collect information about how you use GOV.UK

Question 8

8. Using your data when you contact us

Accepted Answer

8.1 Contacting us to make an enquiry or complaint

We collect, process and store your personal data when you contact the Department by DfE contact us form, telephone, email, message us or live chat.

Telephone calls to our helplines may be recorded for training and monitoring purposes. If provided, we will also use your email address to send a customer satisfaction survey.

We use this information to:

resolve your enquiry
progress a follow up enquiry
action a request as appropriate

It is also used to ensure our call agents are appropriately trained and to enable us to continually improve the quality of the service provided.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department.

Data we collect

DfE collect and use the following personal information directly from you:

your full name
email address
phone number
details about your enquiry or compliant
IP address

What we do with your data

We need information from you to investigate your complaint or enquiry properly.

We use the IP address to detect and block malicious visitors to our websites.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 5 years from the date of the enquiry or complaint.

Your rights

We are relying on public task for this processing, this means you have:

the right to be informed about the collection and use of your personal data – this is called ’right to be informed’
the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
the right to ask us to stop using your information – this is called ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

8.2 Data when you use our websites

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department.

Data we collect

We use Google Analytics to collect information from you about how you use this website. We do not collect or store your personal information through Google Analytics so it cannot be used to identify who you are.

Google Analytics uses 3 types of cookies. See the DfE cookies policy.

What we do with your data

We use your personal information to:

ensure we present our website content in the best way for you.
allow you to take part in interactive features of our service, when you choose to do so

See data when you sign up to our notifications about learning opportunities or events for more information on when we use your data to:

notify you about changes to our website or services
provide you with information or services that you request from us or which may interest you

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

Your personal information is retained for up to 2 years. See details about cookies on GOV.UK for more information.

If you create an account on our websites or sign up for an alert your personal information is kept as long as you have an account. If you delete your account or cancel your alert, your data will also be deleted. See data when you sign up to our notifications about learning opportunities or events for more information.

Your rights

We are relying on legitimate interest for this processing, this means you have:

the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
the right to ask us to delete your personal information – this is called ‘right to erasure’
the right to ask us to stop using your information – this is called ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activities:

we use Google Analytics cookies and a Real User Monitoring (RUM) cookie from SpeedCurve to collect information about how you use GOV.UK

You can sign up for notifications, such as about apprenticeships or our careers service, or about our events.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is consent under article 6(1)(a) of the UK GDPR – this is when we ask your consent to use your information.

Data we collect

DfE collect and use the following personal information directly from you:

name
email address

What we do with your data

We’ll use your personal information to enable you to sign-up to specific messages, like when promoting apprenticeships or our careers service, or to invite you to events, etc.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for as long as you are signed-up to our notifications or alerts.

Your rights

We are relying on consent for this processing, this means you have:

the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
the right to ask us to delete your personal information – this is called ‘right to erasure’
the right to ask us to stop using your information – this is called ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling
the right to withdraw consent at any time (where relevant), by using our contact form
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

You can unsubscribe from our emails at any time. You can also use the ‘unsubscribe’ or ‘change your email preferences’ links in the emails you get from GOV.UK.

As we are processing your personal data with your consent, you have the right to withdraw consent to the processing of your personal data at any time. If you change your mind, or you are unhappy with our use of your personal data, contact DfE and state the project or initiative name.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We use data processors to send the email and text notifications.

Question 9

9. Using your data when you attend our events or webinars

Accepted Answer

9.1 Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is consent under article 6(1)(a) of the UK GDPR – this is when we ask your consent to use your information. At any time, you can tell us you no longer want us to use it. You can do this by using our online contact form.

Data we collect

DfE collect and use the following personal information:

first name and surname
your job role
establishment name
email address or telephone number (where you want to receive communication about the event or webinar)
IP address (if applicable)

What we do with your data

We use your email address to provide you with event details. This will include information about any recording taking place. For recorded events we will also email you a link to the recording once the event has concluded.

For some events we may publish the recording on our website or YouTube channels so this is accessible to a wider audience. If an event recording will be published, we will always notify you before the event.

We don’t publish delegate lists for event or webinars but your name and email address may be visible to others in attendance during the event.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 5 years after the event.

Your rights

We are relying on consent for this processing, this means you have:

the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
the right to ask us to delete your personal information – this is called ‘right to erasure’
the right to ask us to stop using your information – this is called ‘right to restriction of processing’
your ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling
the right to withdraw consent at any time (where relevant)
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

As we are processing your personal data with your consent, you have the right to withdraw that consent. You can withdraw your consent up until the webinar recording is published. If you change your mind, or you are unhappy with our use of your personal data, let us know, stating the name of the event or webinar.

Do we use any data processors?

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activities:

to help organise our events - the organiser of the event is provided in the sign-up email

Question 10

10. Using your data to check our IT systems

Accepted Answer

10.1 Using your data when we are testing or checking our IT systems

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is legitimate interest, under article 6(1)(f) of the UK GDPR.

When we use your sensitive information, this is ‘special category’ data. The reasons we use it because we have a substantial public interest under article 9(2)(g) of UK GDPR. The Education Act 2002 and Section 54 of the Further and Higher Education Act (1992) allows this.

Full details about how we process special category data are given in the DfE appropriate policy document.

Data we collect

DfE collects information from educational settings, local authorities, your employer and other government departments. We will process the following information about you:

personal contact details
date of birth
ethnicity
data and information about your learning, including your courses and assessments

If the IT system or database contains special category data, we would be processing details about:

your equality, diversity and inclusion information
your health

If the IT system or database contains sensitive information about you, we would be processing details about:

children that are looked after or are in care

What we do with your data

When we are designing a new system or database. It is sometimes necessary to use ‘live’ personal data to test the design in a secure environment. This is because ‘dummy data’ is not capable of replicating the complexity of the data that is actually collected.

Similarly, it is necessary to extract copies and run quality checks for the purposes of identifying unnecessary duplication or even conflicting data about the same data subject. In order to maintain the accuracy of our data, if duplicate records are identified, we would either merge the duplicate records under one Unique Learner Number or maintain existing records but include cross referencing so all the records are linked and are retrieved when searching for the one data subject.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

This processing activity is for the length of time it takes to test or check the data, any copies of the data created would be deleted as soon as the text or check is complete.

Your rights

We are relying on legitimate interest for this processing, this means you have:

the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
the right to ask us to delete your personal information – this is called ‘right to erasure’
the right to ask us to stop using your information – this is called ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activities:

we use contractors to do our IT Health Checks (ITHC) - an ITHC is a series of controlled tests and actions that check the security of our IT systems

Question 11

11. Using your data when we share your personal information

Accepted Answer

We will only share your personal data with others where it is lawful, secure and ethical to do so. Where these conditions are met, we can share your personal information with:

schools and other education providers
local authorities
researchers (like universities, think tanks, research organisations)
organisations connected with promoting the education or wellbeing of children in England
organisations fighting or identifying crime (like police, courts, Home Office, etc)
other specified crown and public bodies (like Ofqual, Ofsted, UCAS, Office for Students, etc)
organisations working for DfE under contract (like DfE commissioned research or training providers)
organisations who provide careers and other guidance
organisations who provide statistics and research about education, training, employment and well-being, including Jisc (formerly the Higher Education Statistics Agency or ‘HESA’) as detailed in Jisc’s collection notices - your data is also submitted to Jisc so that you can take part in the graduate outcomes survey

DfE shares personal data where this is a benefit to education, the children’s services sector or it is in the interests of the wider public or society - such as sharing data to fight crime or for policy development is in the interests of society.

How DfE shares personal data gives details of the protections DfE has in place when sharing your data and the relevant legislation.

The DfE Data Sharing Approval Panel (DSAP) must approve all data share requests. The panel of experts assesses each application for public benefit, proportionality, legal underpinning and strict information security standards. The DSAP panel has external members who analyse decisions to increase public trust in the data share process.

DfE will only share data with a third party where we have a lawful basis for the data share under article 6(1) of the UK GDPR. In most cases, DfE relies on article 6(1)(e) ‘public task’ as the lawful basis where the task or function has a clear basis in law or 6(1)(f) ‘legitimate interest’ where the sharing of your data does not override your rights or when you expect us to share your data. But DfE will review each data share request on a case-by-case basis to ensure the right lawful basis is used. See the ICO guide to lawful basis for processing for more details.

For example, we share data under public task with:

awarding organisations – to allow exam outcomes to be accurately predicted
Children’s Commissioner’s Office (CCO) - to protect and promote the rights and interests of children in England, especially the most vulnerable
fraud prevention and law enforcement agencies such as the police and the National Crime Agency - to prevent and detect fraud in the funding of education and learning.
Home Office (HO) - to prevent abuse of immigration control
police and criminal investigation authorities, through court orders - to safeguard and promote welfare of children in the UK

For example, we share data under legitimate interest with:

Education Policy Institute (EPI) - to identify if government policies are delivering a high-quality education system
National Foundation for Educational Research (NFER) and Scottish Qualifications Authority (SQA) - to investigate developments to the national curriculum

Full details of who we share data with are available: DfE external data shares.

Question 12

12. How to contact us and how to make a complaint

Accepted Answer

12.1 How to contact us

Contact the Data Protection Team with questions about this document or how we use your information.

12.2 How to make a complaint

If you have concerns about how we use your personal information, you can make a complaint in writing to the Data Protection Officer and Information Commissioner’s Office.

12.3 How to access your personal information

A request to access your personal information can be made verbally or in writing.

Cookies on GOV.UK

Applies to England

1. Using your data to provide money for your learning

1.1 Using your data to fund your learning, including apprenticeships

Purpose and lawful basis for processing

Data we collect

What we do with your data

How long we keep your data

Your rights

Data processors

1.2 Using your data to ensure the protection of public funds by preventing and detecting fraud

Purpose and lawful basis for processing

Data we collect

What we do with your data

How long we keep your data

Your rights

Data processors

2. Using your data to support your learning, including apprenticeships

2.1 Using your data to create your unique learner number (ULN) and your personal learning record (PLR)

Purpose and lawful basis for processing

Data we collect

What we do with your data

How long we keep your data

Your rights

Data processors

2.2 Using your data to enable you to apply for apprenticeships

Purpose and lawful basis for processing

Data we collect

What we do with your data

How long we keep your data

Your rights

Data processors

2.3 Using your data to record, monitor and report on your learning achievements or attainments

Purpose and lawful basis for processing

Data we collect

What we do with your data

How long we keep your data

Your rights

Data processors

2.4 Using your data to improve the education of children in England

Purpose and lawful basis for processing

Data we collect

What we do with your data

How long we keep your data

Your rights

Data processors

2.5 Using your data to monitor attendance in education and learning

Purpose and lawful basis for processing

Data we collect

What we do with your data

How long we keep your data

Your rights

Data processors

2.6 Using your data when you continue your learning at another training provider

Purpose and lawful basis for processing

Data we collect

What we do with your data

How long we keep your data

Your rights

Data processors

3. Using your data to get your views

3.1 Using your data to contact you for feedback

Purpose and lawful basis for processing

Data we collect

What we do with your data

How long we keep your data

Your rights

Data processors

4. Using your data to contact you for research

Purpose and lawful basis for processing

Data we collect

What we do with your data

How long we keep your data

Your rights

5. Using your data to carry out research

5.1 Using your data to gather evidence for policy development and delivery

Purpose and lawful basis for processing

Data we collect

What we do with your data

How long we keep your data