Data (Use and Access) Act 2025 (DUAA): compliance checklist for schools
Changes introduced by the DUAA 2025 and a checklist to help schools review their data protection arrangements.
Schools are reminded that the requirements under the Data (Use and Access) Act 2025 (DUAA) have come into force. The Act updates UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), strengthening and refining expectations around how personal data is handled, shared and protected.
The changes include:
- updates to subject access requests (SARs)
- new requirements for handling data protection complaints
- wider use of automated decision-making where safeguards are in place
- the introduction of recognised legitimate interests as a lawful basis for certain processing activities
- changes to cookies and online tracking requirements
Schools should review their policies, procedures and privacy notices to make sure they reflect these changes.
DUAA compliance checklist
Use the checklists below to review your school’s arrangements and identify any actions that may be needed.
For additional guidance, refer to the Information Commissioner’s Office (ICO), which provides up-to-date advice and resources to help organisations comply.
What changed
Schools can now pause the one-month response period when they need clarification about an unclear request.
Schools only need to carry out reasonable and proportionate searches for information. Exhaustive searches are not required.
What you need to do:
- review and update your SAR procedure
- include a process for pausing timescales when clarification is needed
- set clear expectations for carrying out proportionate searches
- ensure staff who handle SARs understand the revised requirements
- create or update your decisions log to include details about the scope of searches and any clarification requested
What changed
Schools must have a clear process for handling data protection complaints.
Individuals must normally raise their complaint with the school before contacting the Information Commissioner’s Office (ICO).
Complaints must be acknowledged within 30 days and steps should be taken to deal with them without undue delay.
What you need to do:
- create or review your data protection complaints procedure.
- make it easy for individuals to submit a complaint in a range of different formats
- ensure staff know how to recognise and escalate a complaint
- clearly explain to individuals how complaints are managed and escalated
- keep complainants informed about progress and outcomes
- update privacy notices to explain how people can make a complaint
- maintain a log of complaints and outcomes - the ICO has detailed guidance on handling data protection complaints
What changed
DUAA allows wider use of automated decision-making, provided appropriate safeguards are in place.
Individuals must be informed when automated decisions are made about them. They must also be able to challenge decisions, make representations about decisions and request a human review.
What you need to do:
- identify any systems that use automated decision-making
- ensure a person can review decisions and change the outcome where appropriate
- update policies and guidance so that staff involved in reviews understand the requirements expected of them
- explain the use of automated decision-making in privacy notices
- tell individuals:
- when automated decision-making is used
- how decisions are made
- how the decision may affect them
- provide a simple process for individuals to:
- challenge a decision
- give additional information
- request a human review
- make information about this process easy to find
What changed
DUAA introduces a new lawful basis called recognised legitimate interests (RLI).
This applies only to specific activities set out in law, including:
- safeguarding vulnerable people
- preventing crime
- responding to emergencies
- national security
- sharing information for certain public purposes where permitted by law
Schools cannot create their own recognised legitimate interests, the activities in scope are defined.
Public authorities cannot rely on recognised legitimate interests to carry out their statutory functions. Public task will usually remain the most appropriate lawful basis where schools are carrying out their statutory functions.
What you need to do:
- consider whether any processing activity falls within one of the on recognised legitimate interests set out in legislation
- continue to use public task or legal requirement for processing carried out as part of the school’s official function.
- continue to complete legitimate interests assessments where standard legitimate interests are used
- update policies, guidance and staff training where needed to explain the use of the different lawful bases
- review and update privacy notices to ensure the lawful bases used for the different processing activities are correct
- update Records of Processing Activities (RoPA), data sharing agreements and related documentation if lawful bases change
What changed
DUAA reinforces existing UK GDPR requirements that children need extra protection when schools process their personal data.
It also confirms that data protection law supports appropriate information sharing when safeguarding children.
Schools should continue to ensure decisions about sharing safeguarding information are necessary, proportionate and properly recorded.
What you need to do:
- review safeguarding information sharing procedures
- provide clear guidance on when and how information can be shared safely and who needs to be consulted
- keep records of safeguarding decisions and information sharing
- make privacy information suitable for children and young people
- use clear and age-appropriate language when explaining data protection matters to account for a variety of age, maturity and vulnerabilities in pupils
- update internal guidance to reflect that children’s privacy is considered by default when introducing new systems and technologies
- carry out Data Protection Impact Assessments (DPIAs) where required, particularly for higher-risk processing involving:
- AI tools
- educational technology (EdTech)
- monitoring technologies
What changed
Privacy notice requirements remain largely unchanged.
However, schools may need to update privacy notices to reflect new DUAA requirements, including complaint processes, automated decision-making and lawful bases for processing.
What you need to do
Review all privacy notices to make sure they are:
- accurate and up to date
- easy to find
- written in plain English
- age-appropriate where relevant
Update privacy notices to include:
- lawful bases for processing, including recognised legitimate interests where used
- information about data protection complaints
- details of any automated decision-making
- information about scientific research activities where relevant
If carrying out scientific research:
- document any decision to rely on the “impossible or disproportionate effort” exemption
- record the reasons for that decision
- ensure privacy information remains publicly available
Set a regular review schedule for all privacy notices.
What changed
The Privacy and Electronic Communications Regulations (PECR) has been amended so that some low-risk cookies may no longer require consent.
This includes certain cookies used for:
- website statistics and service improvements
- user preferences such as language or accessibility settings
- emergency location services
What you need to do:
- review cookies and tracking technologies used on school websites
- identify which cookies may fall within the new exemptions
- update cookie policies where necessary
- review cookie banners and consent mechanisms
- keep records of decisions to rely on any exemptions
- check that third-party website services remain compliant with PECR requirements
What changed
DUAA introduces a framework for certified digital identity verification services.
Schools may choose to use certified providers, but there is no requirement to do so.
What you need to do
If using a DVS:
- confirm the provider appears on the official register
- assess data protection risks before implementation
- carry out a DPIA where required as this is a new and innovative technology
- identify and document the lawful basis for processing
- update privacy notices to explain how the service is used
- review contracts and data sharing arrangements with the provider