Guidance

Reception baseline assessment: privacy notice for pupil data from September 2025

Published 2 June 2025

© Crown copyright 2025

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/reception-baseline-assessment-privacy-notice/reception-baseline-assessment-privacy-notice-for-pupil-data-from-september-2025

Who is collecting and processing this data?

The reception baseline assessment (RBA) is delivered by the Standards and Testing Agency (STA), which is an executive agency of the Department for Education (DfE).

DfE is the data controller for any personal information used for the RBA services. We also currently use the following contracted data processors:

  • Madetech, to support the development and delivery of the RBA services
  • Avarto, to provide helpdesk support

Schools and academy trusts will also process personal data which they have already collected about your child

What data will be collected?

The RBA will use the following personal information for all participating pupils:

  • name
  • date of birth
  • unique pupil number (UPN)
  • sex
  • results from the assessment

To use your child’s personal information, we need to meet one or more conditions in the data protection legislation. For the RBA, STA will use your child’s information as part of STA’s public task in providing a statutory assessment. There are separate regulations which set out the statutory basis of the RBA.

For the processing of personal data, the relevant condition is the UK General Data Protection Regulation (UK GDPR) Article 6 (1) (e) Public task. The Early Years Foundation Stage (Miscellaneous Amendments) and Childcare Fees (Amendment) Regulations 2021 set out the statutory basis of the RBA. Your child’s data is collected for the RBA to ensure the administration of this statutory assessment.

Who is my child’s data shared with?

Other than the contracted data processors outlined in Who is collecting and processing this data?, your child’s personal information will not be shared with any other organisations, unless there is a legal obligation to do so. Where we need to share your personal data with others, we ensure that this complies with data protection legislation and is done securely.

How long will the data be kept?

Your child’s data will be stored and safeguarded for up to 10 years. During this period, access to this information will be restricted so that it is not used for purposes other than the RBA. Afterwards, the data will be anonymised so that it will no longer be attributable to your child.

Storing personal data outside the UK

When we store personal data outside the UK, we will ensure that we comply with the data protection law and take additional steps to keep personal data safe. This can include additional technical and security arrangements, contractual agreements and data sharing agreements.

Individual rights

Under the Data Protection Act (DPA) 2018, you are entitled to ask if we hold information relating to your child. You can read further information about your data protection rights on the Information Commissioner’s Office (ICO) website. Under certain circumstances, you have the right:

  • to request access to information that we hold about your child (subject access request)
  • to have your child’s personal data rectified, if it is inaccurate or incomplete
  • to request the deletion or removal of personal data where there is no compelling reason for its continued processing
  • to restrict our processing of your child’s personal data (for example, permitting its storage but no further processing)
  • to object to our processing
  • not to be subject to decisions based purely on automated processing where it produces a legal or similarly significant effect on your child.

However, access to the numerical score from the assessment is exempt from release under paragraph 27 of Schedule 2 to the DPA 2018. You can find more information on this and on the use of personal data for the RBA in the RBA information for parents.

Who can I contact about the use of personal data?

As an executive agency of DfE, STA determines the purposes and means of processing personal data as part of the administration of the national curriculum assessments, checks, trials and sampling exercises. You can find more information about this in DfE’s personal information charter.

If you have any questions relating to the processing of your child’s data as part of their participation in the RBA, please contact DfE and quote ‘Use of reception baseline assessment data’ as a reference.

If you want to contact the Data Protection Officer (DPO), please contact DfE and mark it ‘for the attention of the DPO’.

If you remain dissatisfied with the way the RBA processes personal data, you have the right to lodge a complaint about data protection issues with the ICO. For more information, visit the ICO website.

Updates

We keep this privacy notice under review to make sure it is up to date and accurate. This privacy notice was last reviewed in June 2025.

Back to top