Transparency data

Privacy information: parents, carers and legal guardians

Updated 19 March 2025

Applies to England

This document provides details of the personal data we process about:

• parents, carers and legal guardians
• families

Details of the personal information that DfE holds and processes about your child are available in the privacy notice for children, young people and care leavers.

When we collect and use your personal information, we follow the relevant laws, including the:

• Data Protection Act (DPA) 2018
• UK General Data Protection Regulation (UK GDPR)

We must have a valid reason to collect your personal data. These reasons are called lawful basis in UK GDPR. You have information rights under UK GDPR about how your personal data is collected and used. Your rights change depending on the lawful basis for collecting the data.

Further information on the standards you can expect when we collect, hold or use your personal information is available in the DfE personal information charter.

1. Using your data to protect learners and children

1.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can protect learners.

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR.

When we use your special category data, it is because we have a substantial public interest under article 9(2)(g) of UK GDPR.

1.2 Data we collect

We collect information from educational settings, local authorities and other government departments to safeguard children and adults. We collect and use the following personal information about the person reporting or involved in the safeguarding case:

• name
• contact details

1.3 What we do with your data

We use your personal information to support children, young people and adults, and to monitor their progress.

We’ll use your personal information to:

• keep pupils or learners safe from potential harm
• identify issues and provide support for mental and physical health issues
• prevent extremism in the education system – DfE works to ensure children and young people are not exposed to extremists and extremist messages

The Teaching Regulation Agency (TRA) is an executive agency of DfE. TRA regulates the teaching profession in England and investigates cases of serious misconduct. If you are a witness or potential witness in a teacher misconduct investigation, TRA will process your information to investigate allegations of serious misconduct.

1.4 Who we share your data with

We may share your personal data with other organisations where DfE and its executive agencies are notified of an issue regarding safeguarding of children and young people.

Other people and organisations may also share personal data with DfE and its executive agencies – for example, when they make a complaint or raise a concern with us. This can include information shared in accordance with the statutory guidance:

• Keeping children safe in education
• Working together to safeguard children

This information will be used to investigate complaints and to ensure trusts and academies comply with the regulations. This includes independent schools, who muct comply with the Education (Independent School Standards) Regulations 2014.

The section on when we share your personal information in ‘Privacy information: education providers’ workforce, including teachers’ has more details.

1.5 How long we keep your data

For safeguarding cases, we keep your personal information for 10 years after the date of the allegation and then it is reviewed.

1.6 Your information rights under UK GDPR

Find out about your information rights when we process your personal data under the lawful basis of public task.

1.7 Data processors

We do not use any data processors for this processing activity.

2. Using your data to fund schools and childcare

2.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can fund learning in the following educational settings:

• schools
• academies
• colleges
• adult education training providers
• apprenticeships

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR.

When we use your special category data it is because we have a substantial public interest under article 9(2)(g) of UK GDPR.

2.2 Data we collect

We collect and use personal information, including your:

• name
• address
• email address
• phone number

We collect and use the following sensitive information:

• type of social benefit claimed
• episodes of being a child looked after by the local authority, if applicable

2.3 What we do with your data

We’ll use your personal information to:

• ensure that children entitled to free school meals receive them
• ensure that schools receive additional funding known as pupil premium
• enable us to identify children who are potentially eligible for the 2-year-old entitlement to free education and childcare
• ensure the protection of public funds
• prevent and detect fraud

2.4 How long we keep your data

We keep your personal information for 7 years. This meets legal requirements for the retention of finance data.

2.5 Your information rights under UK GDPR

Find out about your information rights when we process your personal data under the lawful basis of public task.

2.6 Data processors

For most of the personal data that schools or the multi-academy trusts collect, store and use, they are the data controller for your personal data.

If a school is required to send a copy of your personal data to us, DfE becomes an independent data controller of that data.

3. Using your child’s data when they are looked after by local authorities

Local authorities have a legal duty to provide DfE with information each year about the children they look after.

The section on using your data when a child is looked after by local authorities in the children’s privacy notice has more information.

4. Using your child’s data when your child is in need

Local authorities have a legal duty to provide DfE with information each year about the children in need.

A child in need is defined under the Children Act 1989 as a child:

• who is unlikely to reach or maintain a satisfactory level of health or development
• whose health or development will be significantly impaired without the provision of services
• who is disabled

The children’s privacy notice has more information on using your data when a child is looked after by local authorities.

5. Using your data when we receive a serious incident notification (SIN)

DfE has established a Child Safeguarding Practice Review Panel. The Panel commissions national reviews of child safeguarding cases that raise issues that are complex or of national importance.

Local authorities in England have to notify the Panel, under section 16C(1) of the Children Act 2004, if they know or suspect that a child has been abused or neglected and:

• the child has died or has been seriously harmed in the local authority’s area
• the child has died or been seriously harmed outside England, when they are normally resident in the local authority’s area

The local authority must notify the Panel, under Schedule 2 paragraph 20(1)(a) of the Children Act 1989, if a child who is being looked after by a local authority dies, whether or not neglect is known or suspected.

Once a notification is submitted, no local authority will have access to it, including the one that made the notification.

The section in the children’s privacy notice Using your data when we receive a serious incident notification (SIN) has more information.

6. Using your data to contact you for research or feedback on services we provide to you

6.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can:

• undertake research to learn how you interact with our services and to support our operational development and delivery.
• make improvements to the services we offer to you
• measure the impact and effectiveness of each of our services, our programmes or our events
• make improvements to the service we offer to you

We do this through surveys, public consultations and feedback about our helpdesks. 

We will always seek your permission to take part in any research.  

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR.

6.2 Data we collect

We collect and use the information you provide directly to us when you contact us, attend one of our programmes or events, or use our digital services or helpdesk. We collect your:

• full name
• email address
• phone number

6.3 What we do with your data

We use your data to:

• make improvements to the services we offer to you
• develop policy
• develop new services
• contact you to invite you to participate in research that is relevant to you

You are under no obligation to participate in any research we invite you to. We will not contact you about research using your data if you tell us not to.

Using your data to gather evidence for policy development and delivery has more information on how we process your personal information during research.

6.4 How long we keep your data

We keep your personal information until 2 years after the end of the survey or research. We keep a record of you being contacted for feedback for 5 years.

6.5 Your information rights under UK GDPR

Find out about  your information rights  when we process your personal data under the lawful basis of public task.

6.6 Data processors 

DfE uses a data processor to:

• provide our service desk
• contact you for feedback to take part in research

7. Using your data to gather evidence for policy development and delivery

7.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can undertake research and surveys to gather evidence to support our policy development and delivery. Having this evidence is important when improving outcomes for children, young people, families and adults.  

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR. When we use your special category data, it is because we have a substantial public interest under article 9(2)(g) of UK GDPR. 

Sometimes we link your survey responses to other government-held data. The lawful basis for this processing is ‘consent’, under article 6(1)(a) of the UK GDPR. If you have agreed that we can link your survey responses to other government-held data, we are undertaking this processing with your consent.

7.2 Data we collect

We collect and use the following personal information from you or your education provider, including your:

• full name
• address
• email address
• phone number
• date of birth

When we use your special category data, it is because we have a substantial public interest and you have given your ethical consent to participate in the research. As part of our research, we may need to collect information about your:

• heath or disability
• racial or ethnic origin
• gender

We also collect sensitive information about your:

• socio-economic classification
• caring responsibilities

Full details about how we process special category data are given in the DfE appropriate policy document and in the research information sheet. You will be given this research information sheet at the start of the research.

7.3 What we do with your data

We will use your personal information for research that we undertake to provide high-quality evidence. This will inform policy development and delivery.

Sometimes we link your survey responses to other government-held data. The lawful basis for this processing is consent. At any time, you can tell us you no longer want us to link your data to other data. You can do this by using our contact form.

We will publish a summary of the research and the full research report. Your responses may be attributed to an organisation, where this information has been provided, but our publications will not contain any personal data. We will anonymise or desensitise the data where possible.

Research reports published since May 2010 are available on GOV.UK.

Research published before May 2010 is available from the National Archives).

Research at DfE and parent, pupil and learner panel omnibus surveys has more information.

7.4 How long we keep your data

We keep your personal information until 12 months after the end of the survey or research.

7.5 Your information rights under UK GDPR 

Find out about  your information rights when we process your personal data under the lawful basis of public task or consent.

If you have agreed that we can link your survey responses to other government-held data, we are undertaking this processing with your consent. You have the right to withdraw that consent up until the data is analysed for the publication.

If you change your mind or are unhappy with our use of your personal data,  contact DfE  and state the project or initiative name. Further information on rights and the ways in which your data may be used are contained in the research consent form.

7.6 Data processors

We use a data processor to undertake the research by using contractors. Our contractors will get your personal data directly from you and DfE during the activity or initiative.

8. Using your data to take part in our consultations

8.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can undertake public consultations to develop our policies, programmes and guidance.

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR.

8.2 Data we collect

We collect and use the following personal information including your:

• full name
• job role
• address
• email address
• phone number
• internet protocol (IP) address

8.3 What we do with your data

We’ll use your personal information when gathering feedback to our public consultation.

Information provided in response to consultations, including personal information, may be subject to publication or disclosure under the:

• Freedom of Information Act 2000
• Data Protection Act 2018
• Environmental Information Regulations 2004

If you want all or any part of a response to be treated as confidential, you should explain why you consider it to be so in the relevant section of the consultation response.

8.4 How long we keep your data

We keep your personal data for 10 years, as it supports our policy-making.

8.5 Your information rights under UK GDPR 

Find out about your information rights  when we process your personal data under the lawful basis of public task.

8.6 Data processors

DfE uses Delib to manage our public consultations. Delib’s software enables you to provide feedback on the documents.

9. Using your data when you contact us to make an enquiry

9.1 Purpose and lawful basis for processing

We collect, process and store your personal data when you contact us by:

• using the contact us form
• telephone
• email
• message
• live chat

Telephone calls to our helplines may be recorded for training and monitoring purposes. If you provide it, we will also use your email address to send a customer satisfaction survey. 

We use this information to: 

• resolve your enquiry 
• progress a follow-up enquiry 
• action a request as appropriate 

It is also used to ensure our call agents are appropriately trained and to enable us to continually improve the quality of the service provided. 

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR.

9.2 Data we collect

DfE collect and use the following personal information directly from you:

• your full name
• email address
• phone number
• details about your enquiry or compliant
• IP address

9.3 What we do with your data

We need information from you to investigate your complaint or enquiry properly.

We use the IP address to detect and block malicious visitors to our websites.

9.4 How long we keep your data

We keep your personal information for 5 years from the date of the enquiry or complaint.

9.5 Your information rights under UK GDPR

Find out about  your information rights  when we process your personal data under the lawful basis of public task.

9.6 Data processors

We use data processors for this processing activity. Capita is our national curriculum assessment contractor.

10. Using your data when you use our websites

10.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can improve our website and search functionality. 

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR.

10.2 Data we collect

DfE websites use cookies to collect information from you about how you use the website. The section on cookies has more details.

DfE websites use Google Analytics, Hotjar or Microsoft Clarity. We do not collect or store your personal information through these tools, so it cannot be used to identify who you are.

You can find out which cookies are used in the footer section of each website.

10.3 What we do with your data

We use your personal information to:

• ensure we present our website content in the best way for you
• allow you to take part in interactive features of our service when you choose to do so

Data when you sign up to our notifications about learning opportunities or events has more information on when we use your data to:

• notify you about changes to our websites or services
• provide you with information or services that you request from us or that may interest you

10.4  How long we keep your data

Your personal information is retained for up to 2 years. Details about cookies on GOV.UK has more information.

If you create an account on our websites or sign up for an alert, your personal information is kept as long as you have an account. If you delete your account or cancel your alert, your data will also be deleted.

Using your data when you sign up to our notifications about learning opportunities or events has more information.

10.5 Your information rights under UK GDPR

Find out about your information rights when we process your personal data under the lawful basis of public task.

10.6 Data processors

DfE uses a data processor for collecting information about how you use GOV.UK. We use Google Analytics cookies and a Real User Monitoring (RUM) cookie from SpeedCurve.

11. Using your data when you use our social media channels

11.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can use social media to share news and views with people working in:

• schools
• colleges
• local authorities
• children’s services

We also use social media to communicate with parents, children and young people.

Our social media use policy has more details.

The lawful basis we rely on for this processing of your personal data is consent, under article 6(1)(a) of the UK GDPR.

At any time, you can tell us you no longer want us to use your data. The section on your rights has more information.

11.2 Data we collect

When you interact with our social media channels, we collect and use your name.

11.3 What we do with your data

When you use our websites and social media channels, we use your personal information to:

• allow you to take part in interactive features of our service when you choose to do so
• ensure we present our website content in the best way for you
• provide you with information or services that you request from us or that may interest you – we always get your consent when you request these DfE services
• notify you about changes to our websites or services

The DfE cookies policy has more information.

11.4 How long we keep your data

DfE social media channels are captured by the National Archives as a permanent record of DfE’s social media communication.

Your personal information is retained for up to 2 years. Details about cookies on GOV.UK has more details.

11.5 Your information rights under UK GDPR

Find out about  your information rights  when we process your personal data under the lawful basis of consent. 

As we are processing your personal data with your consent, you have the right to: 

• withdraw consent at any time, by using our contact form 
• ask us  to cease publication of your image, words or voice on our social media channels 

If you do so, we  will not publish further social media posts featuring this content, but we are not obligated to remove or delete existing posts. DfE social media channels are captured by the National Archives  as a permanent record of DfE’s social media communication. 

If you change your mind or are unhappy with our use of your personal data, contact DfE  and state the project or initiative name.

11.6 Data processors

We use a data processor for collecting information about how you use GOV.UK. We use Google Analytics cookies and a Real User Monitoring (RUM) cookie from SpeedCurve.

12. Using your data when you sign up to our notifications about learning opportunities

12.1 Purpose and lawful basis for processing

Our purpose for processing this information is so you can sign up for notifications. These could be about promoting university education, apprenticeships, or learning to specific groups – for example, to minority groups or disadvantaged children.

The lawful basis we rely on for this processing of your personal data is consent, under article 6(1)(a) of the UK GDPR.

At any time, you can tell us you no longer want us to use your data. The section on your rights has more information.

12.2 Data we collect

We collect and use personal information directly from you, including your:

• name
• email address

12.3 What we do with your data

We will use your personal information to enable you to sign up to specific messages such as when we are promoting apprenticeships or our careers service, or to invite you to events.

12.4 How long we keep your data

We keep your personal information for as long as you are signed up to our notifications or alerts. You can unsubscribe from our emails  at any time. You can also use the ‘unsubscribe’ or ‘change your email preferences’ links in the emails you get from GOV.UK.

12.5 Your information rights under UK GDPR

Find out about  your information rights when we process your personal data under the lawful basis of consent. 

As we are processing your personal data with your consent, you have the right to withdraw that consent. If you change your mind or are unhappy with our use of your personal data, contact us  and state which notification you are signed up to.

12.6 Data processors

We use data processors to send email and text notifications.

13. Using your data when you make a complaint about education providers, children’s social care or DfE

13.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can process your data when you make a complaint about:

• a school
• a college
• an early year’s provider
• children’s social care service
• a teacher
• DfE

Our  complaints procedure page has more information. 

The section on using your data when you make a referral of serious teacher misconduct to TRA has more information.

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR.

13.2 Data we collect

DfE collect and use the following personal information:

• your full name
• email or postal address
• phone number
• details about your enquiry or complaint
• information held by third parties, such as schools, colleges and local authorities

We collect and use sensitive data, including information about:

• safeguarding and child protection matters
• special educational needs assessments
• medical details

Full details about how we process special category data and sensitive data are given in the DfE appropriate policy document.

13.3 What we do with your data

We need information from you and potentially other third parties to consider your complaint.

13.4 Who we share your data with

Before we consider a complaint, we may need documentary evidence that the complaints procedure has been completed in full. We usually ask the complainant to provide this.

Depending on the nature of the complaint, we may then need additional documentation, such as CPOMS records or statements from staff and other pupils. CPOMS is an online system used by more than 16,500 schools across the globe.

We may contact the school, an early years provider, a children’s social care service or other local authority department to provide this information.

Schools have a legal duty to provide this information to the Secretary of State for Education under section 538 of the Education Act 1996.

Local authorities have a legal duty to provide this information to the Secretary of State for Education under section 29(1) of the Education Act 1996.

DfE may also share your data under public task with Ofsted, local authorities or police and criminal investigation authorities through court orders to safeguard and promote the welfare of children in the UK.

13.5 How long we keep your data

We keep your personal information for 10 years.

Where a complaint is made to TRA but it is not accepted as a referral, it will be treated as correspondence and kept for a period of 5 years from the closure of the complaint.

The education providers’ workforce privacy notice has more information on using your data when you make a referral of serious teacher misconduct to TRA.

13.6 Your rights under UK GDPR

Find out about  your information rights when we process your personal data under the lawful basis of public task.

13.7 Data processors

We do not use any data processors for this processing activity.

14. Using your data when you make a referral of serious teacher misconduct to the TRA

14.1 Purpose and lawful basis for processing

The Department for Education (DfE) has processes in place that enable anyone to complain about a teacher. Separately, DfE, through TRA, has a process to consider allegations of serious misconduct by a teacher.

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR.

14.2 Data collected

When you make a referral, DfE collects and uses the following personal information about you including your:

• name
• contact details

The section on using your data to investigate teacher misconduct in the privacy notice for the education providers’ workforce, including teachers has more information on:

• how we investigate a referral
• the data we collect about the teacher

14.3 What we do with your data

As a witness, potential witness or a person making an allegation within a teacher misconduct investigation, we receive your personal data from you and third parties including:

• employers
• supply agencies
• police forces
• DBS
• members of the public

We process this information to regulate the teaching profession by investigating allegations of serious misconduct.

14.4 Sharing your data

We sometimes need to make personal data available to other organisations. This also includes contracted partners. Where we need to share your personal data with others, we comply with data protection legislation.

Teachers who are subject to an investigation and their employer

If there is an investigation, we tell them the name of the person who made the referral and details of their allegation. If there is no investigation, we tell the teacher that there has been an allegation, but we do not share your personal data. If the teacher makes a subject access request, we give details of the allegation but not the name of the referrer. If the referral came from an organisation, then we give the name of the referring organisation. This is compliant with Education Acts 2002 and 2011.

Legal firms

If there is an investigation, legal firms we hold contracts with will process your personal data on our behalf. They process the data we provide to gather information to support misconduct investigations and hearings. Some legal firms will also review this data to provide impartial legal advice during misconduct hearings. This is compliant with Education Acts 2002 and 2011.

Professional conduct panels

We appoint independent panel members who sit on professional conduct panels to consider cases of serious misconduct and they may make recommendations on prohibition to the Secretary of State. They need this information to fulfil this role. This is compliant with Education Acts 2002 and 2011.

Published decisions

We will publish the teacher’s personal data within a decision document on GOV.UK if a    finding of serious misconduct is made. We will not publish the referrer’s data. This is accessible by members of the public. This is compliant with Regulations 8 and 15 of the Teachers’ Disciplinary (England) Regulations 2012 and section 141C of the Education Act 2002 (updated).

DBS and other organisations

We may need to share your personal data with DBS and other organisations. This includes, but is not limited to, local authority organisations and employers to safeguard children, young people and adults. This is compliant with Section 45 of the Safeguarding and Vulnerable Groups Act 2006.

Police

We may need to share your personal data with the police. The police also share information with DfE so that we can fulfil our statutory roles. This is compliant with section 31 of the Data Protection Act 2018.

If applicable, we may need to share your financial details with our finance team to pay any expense claims you make.

14.5 How long we keep your data

We keep your personal information for up to 50 years after the closure of a case. After 50 years it will be securely destroyed.

Your financial information (for expense purposes, if applicable) is retained for 7 years, then securely destroyed.

Where a complaint is made to TRA but it is not accepted as a referral, it will be treated as correspondence and kept for a period of 5 years from the closure of the complaint. The section on using your data when you make a complaint about education providers, children’s social care or DfE has more details.

14.6 Your rights under GDPR 

Find out about your information rights when we process your personal data under the lawful basis of public task.

14.7 Data processors

We do not use any data processors for this processing activity.

15. Using your data when you apply for an intercountry adoption

15.1 Purpose and lawful basis for processing

DfE is the central adoption authority for England. We are responsible for checking and processing your intercountry adoption application in line with the legislative requirements.

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR.

When we use your special category data it is because we have a substantial public interest under article 9(2)(g) of UK GDPR. This is to ensure that intercountry adoptions are:

• processed in compliance with the legislative framework and satisfactory child safeguarding procedures
• in a child’s best interest

15.2 Data we collect

Your intercountry adoption application and any other supporting documentation you have provided is forwarded to the central authority or relevant overseas authority of the country from which you wish to adopt.

It contains the information provided by you to your UK adoption agency during the adoption assessment process.

This will include information relating to your:

• personal identity
• family background information for you, your parents, siblings and any other significant people in your family
• life and any significant events that had an impact on you
• employment history and the occupation of your parents and siblings
• social interests and lifestyle
• marital status and the marital status of family members
• education history
• financial status, income and financial commitments, including information relating to your home

We use your sensitive or special category data when we have a substantial public interest. We need to collect information about your:

• health history and that of family members, if relevant
• nationality and religion

We need a copy of your:

• birth and marriage certificates
• Disclosure and Barring Service (DBS) enhanced disclosure certificate

The information may also contain your:

• medical assessment provided by medical professionals
• references provided by your nominated referees
• the minutes of the meeting of the adoption panel, which approved your adoption application

It may also include information provided by your current partner relating to their:

• relationship with you
• childhood information, including their family background
• date of birth
• marital status
• employment status
• social interests
• children

15.3 What we do with your data

DfE receives your intercountry adoption application from a UK adoption agency and processes it in compliance with the relevant legal framework.

We forward a copy of your application, supporting documents and your certificate of eligibility to adopt to the relevant central authority or the relevant overseas authority in the country from which you wish to adopt. We will use a courier service.

To enable the processing of intercountry adoptions we need to share your personal data with other organisations, both in the UK and overseas. We may need to share your personal data with:

• UK adoption agencies
• local authorities
• notary publics
• central authorities
• relevant overseas authorities
• legal representatives
• accredited agencies
• other government departments
• domestic and international embassies
• overseas agencies and lawyers
• translators

15.4 How long we keep your data

We keep your personal information for 100 years from the date of the adoption order.

15.5 Your information rights under UK GDPR

Find out about  your information rights  when we process your personal data under the lawful basis of public task.

15.6 Data processors

We do not use any data processors for this processing activity.

16. Using your data when we are testing or checking our IT systems

16.1 Purpose and lawful basis for processing

Our purpose for processing this information is so we can test or check our IT systems.

The lawful basis we rely on for this processing of your personal data is legitimate interest, under article 6(1)(f) of the UK GDPR. When we use your special category data it is because we have a substantial public interest under article 9(2)(g) of UK GDPR.

16.2 Data we collect

DfE collects information from educational settings, local authorities and other government departments. We will process the following information about you, including your:

• personal contact details
• date of birth
• ethnicity
• learning information, including your courses and assessments data

If the IT system or database contains special category data, we would be processing details about your:

• equality, diversity and inclusion information
• health

If the IT system or database contains sensitive information about you, we would be processing details about children that are looked after or are in care.

16.3 What we do with your data

When we are designing a new system or database, it is sometimes necessary to use ‘live’ personal data to test the design in a secure environment. This is because ‘dummy data’ is not capable of replicating the complexity of the data that is actually collected.

We may also invite users to try out our services, which can involve the collection of personal data. This helps us understand how users engage with our services, so we can keep improving them.

Similarly, it is necessary to extract copies and run quality checks so we can identify unnecessary duplication or conflicting data about the same data subject.

To maintain the accuracy of our data, if we identify duplicate records, we might:

• merge the duplicate records under one unique learner number
• keep the existing records but include cross referencing, so all the records are linked and are retrieved when searching for one data subject

16.4 How long we keep your data

This processing activity is for the length of time it takes to test or check the data. Any copies of the data created will be deleted as soon as the text or check is complete.

16.5 Your information rights under UK GDPR

Find out about your information rights  when we process your personal data under the lawful basis of legitimate interest.

16.6 Data processors

DfE uses a data processor for our IT health checks – a series of controlled tests and actions that check the security of our IT systems.

17. Using your data when we share your personal information

We will only share your personal data with others where it is lawful, secure and ethical to do so. Where these conditions are met, we can share your personal information with:

• schools and other education providers
• local authorities
• researchers, such as universities, think tanks and research organisations
• organisations connected with promoting the education or wellbeing of children in England
• organisations fighting or identifying crime, such as the police, courts and Home Office
• other crown and public bodies, such as Ofqual, Ofsted, UCAS and the Office for Students
• organisations working for DfE under contract, such as DfE commissioned research or training providers
• organisations that provide careers and other guidance
• organisations that provide statistics and research about education, training, employment and wellbeing, including Jisc (formerly the Higher Education Statistics Agency, or HESA) as detailed in Jisc’s collection notices

We also submit your data to Jisc, so you can take part in the graduate outcomes survey.

DfE shares personal data where this is a benefit to:

• education
• the children’s services sector
• the interests of the wider public or society, such as sharing data to fight crime or for policy development

How DfE shares personal data gives details of the protections DfE has in place when sharing your data, and the relevant legislation.

DfE’s Data Sharing Approval Panel (DSAP) must approve all data share requests. The panel of experts assesses each application for:

• public benefit
• proportionality
• legal underpinning
• strict information security standards

The DSAP panel has external members who analyse decisions to increase public trust in the data share process.

17.1 Purpose and lawful basis for processing

DfE will only share data with a third party where we have a lawful basis for the data share under article 6(1) of the UK GDPR.

In most cases, DfE relies on:

• article 6(1)(e) public task as the lawful basis, where the task or function has a clear basis in law
• article 6(1)(f) legitimate interest as the lawful basis, where the sharing of your data does not override your rights or when you expect us to share your data

When we share special category data, we have a lawful basis to data share under article 9(2) of the UK GDPR. Full details about how we process special category data are available on the following pages:

• DfE appropriate policy document
• How DfE shares personal data

DfE will review each data share request on a case-by-case basis to ensure the right lawful basis is used. The Information Commissioner’s Office (ICO) guide to lawful basis has more details.

For example, we share data under public task with:

• awarding organisations to allow exam outcomes to be accurately predicted
• the Children’s Commissioner’s Office to protect and promote the rights and interests of children in England, especially the most vulnerable
• fraud prevention and law enforcement agencies, such as the police and National Crime Agency to prevent and detect fraud in the funding of education and learning
• Home Office to prevent abuse of immigration control
• police and criminal investigation authorities, through court orders to safeguard and promote the welfare of children in the UK

We share data under legitimate interest with the:

• Education Policy Institute to identify if government policies are delivering a high-quality education system
• National Foundation for Educational Research and Scottish Qualifications Authority to investigate developments to the national curriculum

Full details of who we share data with are available from DfE external data shares.

18. How to contact us and how to make a complaint

Requesting your personal information from DfE gives details of how you can:

• ask questions about how we use your information
• make a complaint to the Data Protection Officer and ICO if you have concerns about how we use your personal information

18.1 How to access your personal information

You can make a request to access your personal information either verbally or in writing.

18.2 How to whistleblow

Our contact us form includes an option to make a ‘disclosure in the public interest’. This includes whistleblowing.

If you request anonymity, the form will be logged as ‘anonymous’. However, we will not be able to suggest other sources of information or to confirm if we have referred your report to another public body to consider.