Transparency data

Privacy information: education providers' workforce, including teachers

Updated 7 March 2024

Applies to England

This document provides details of what personal data we process about the education providers’ workforce, including teachers and staff working in schools, academies or academy trusts, colleges or for training providers, as well as education consultants. For employers of apprentices, see the Business contacts privacy notice.

When we collect and use your personal information, we need to follow the law. The main laws are the Data Protection Act (DPA) and the UK General Data Protection Regulation (UK GDPR).

DfE is the data controller for the personal information we process. This includes when the information is collected or processed by third parties on our behalf.

We must have a valid reason to collect your personal data. These reasons are called ‘lawful basis’ in UK GDPR.

When we process your information, we maintain your information’s confidentiality, integrity and availability:

  • confidentiality means only authorised users can view access, change or use your information
  • integrity means we ensure your information is correct and accurate
  • availability means we ensure your information is available, in a secure system, when required

The department carries out due diligence checks (including internet searches) into public social media of individuals who apply for roles to support us in policy making. For example, those applying to be part of the Teacher and Headteacher Reference Groups. Below are non-exhaustive examples of where DfE may carry out these checks:

  • speakers for DfE funded or sponsored events and communications activities
  • actors used in DfE media campaigns and those involved in communications activity, such as influencers
  • stakeholder commentary on DfE campaigns, policy, news, events and appointments
  • public appointment processes
  • briefing requests, where officials provide insight about external affairs engagement with stakeholders and their priorities

Any personal data processed as part of this checks will be stored in line with DfE policies and requirements under UK GDPR on data retention.

The DfE personal information charter has more information on the standards you can expect when we collect, hold or use your personal information.

1. Using your data to provide funding

1.1 Using your data to fund learning, including apprenticeships

This includes funding learning in the following educational settings:

  • schools
  • academies
  • colleges
  • adult education training providers
  • teacher training
  • apprenticeships

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under section 11 of the Education Act 1996, providing funding for education.

When we use your sensitive information, this is ‘special category’ data. The reason we use it is because we have a substantial public interest under article 9(2)(g) of UK GDPR, and the Education Acts 1996 and 2005 allow this. Full details about how we process special category data are given in DfE’s appropriate policy document.

Data we collect

We need enough information to work out how much funding is required. Funding is calculated based upon the numbers of learners in each educational setting and if they have needs which need additional funding.

To do this, we require information from educational settings or local authorities about learners – see privacy information: early years foundation stage to key stage 3 and privacy information: key stage 4 and 5 and adult education for details.

We also require the following information about the workforce in schools, academies, colleges or training providers:

  • personal contact details of employees and staff members – name, address, email address and phone numbers
  • IP address

When we use your sensitive or ‘special category’ data, the reason we use it is because we have a substantial public interest under article 9(2)(g) of UK GDPR. We collect information about your:

  • ethnicity and gender
  • disability, if applicable

What we do with your data

We use the data to work out how much funding is required and to publish statistics on funding.

We use your personal information to determine whether a provider is entitled to claim funding from DfE. For example, some learning will not be eligible for state funding because the programme of learning, or perhaps an element of it, has already been achieved by the learner.

DfE uses your data:

  • for security purposes, we collect the IP addresses of people visiting the DfE data collection forms on our websites - for example, if we were receiving continuous direct denial of service attacks from an IP address range, we could block it
  • to enable users to use the service and receive updates

We will not share this information with any other parties.

Sharing your data

We sometimes need to make personal data available to other organisations. These might include contracted partners or other organisations with which we need to share your personal data for specific purposes.

Where we need to share your personal data with others, we ensure that this data sharing complies with data protection legislation. For example, in order to assess funding applications, we may need to share your personal data with:

  • the National Schools Commissioner (NSC)
  • Regional Schools Commissioners (RSC)
  • DfE-funded educational experts and their teams
  • DfE-contracted external assessors, if appropriate

See the section on Using your data when we share your personal information for more details.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information:

  • for 7 years for funding or financial purposes
  • until 31 December 2034, if the learning is funded by the European Social Fund

If your personal information is included in any legal agreement classified as a Deed, we will retain it for 12 years from the point of the Deed’s expiry.

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

  • training providers are data processors for the adult education and apprenticeship data that they send to DfE

For most of the personal data that schools or multi-academy trusts collect, store and use, they are the data controller. However, where a school is required to supply a copy of some personal data to DfE, DfE also becomes an independent data controller of the copy it receives.

1.2 Using your data to fund school, academy or college buildings

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under section 11 of the Education Act 1996, providing funding for primary, secondary or further education.

Data we collect

We need enough information to work out how much funding is required for school, academy or college buildings.

We require the following information about the workforce in schools, academies or colleges:

  • personal contact details for the staff member

What we do with your data

We use the data to fund school, academy or college buildings and to publish statistics on funding.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for:

  • 7 years for funding or financial purposes

If your personal information is included in any legal agreement classified as a Deed, we will retain it for 12 years from the point of the Deed’s expiry.

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a SAR, data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

1.3 Using your data to ensure the protection of public funds by preventing and detecting fraud 

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under section 11 of the Education Act 1996, providing funding for primary, secondary or further education.

Data we collect

We use your personal data to ensure schools, academies, colleges, sixth forms, adult education training providers and apprenticeships have received the correct funding. To do this we require information from educational settings or the local authority about learners – see privacy information: early years foundation stage to key stage 3 and privacy information: key stage 4 and 5 and adult education for details.

We also require the following information about the workforce in schools, academies, colleges or training providers:

  • personal contact details of employees and staff members

What we do with your data

We use your data to validate funding applications and investigate suspected fraud or financial irregularity. See further details on how ESFA handles allegations of suspected fraud or financial irregularity.

Sharing your data

We sometimes need to make personal data available to other organisations. These might include contracted partners or other organisations with which we need to share your personal data for specific purposes.

Where we need to share your personal data with others, we ensure that this data sharing complies with data protection legislation. For example, in order to assess funding applications, we may need to share your personal data with:

  • the National Schools Commissioner (NSC)
  • Regional Schools Commissioners (RSC)
  • DfE-funded educational experts and their teams
  • DfE-contracted external assessors, if appropriate

See the section on Using your data when we share your personal information for more details.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information:

  • for 7 years for funding or financial purposes
  • until 31 December 2034, if the learning is funded by the European Social Fund

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

  • training providers are data processors for the adult education and apprenticeship data that they send to DfE

For most of the personal data schools or the multi-academy trusts collect, store and use, they are the data controller. However, where a school is required to supply a copy of some personal data to DfE, DfE also becomes an independent data controller of the copy it receives.

1.4 Using your data to process expense claims

If you submit an expense to DfE for expenses incurred while attending a DfE stakeholder or user group, advisory board, DfE research session or DfE programme, etc.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is legal obligation, under article 6(1)(c) of the UK GDPR.

Data we collect

We need enough information to process the expense claim:

  • your name
  • your bank account details
  • your telephone number or email address (in case of queries)

What we do with your data

We use the data to:

  • check, verify and validate the expense claim details.
  • process payments to the nominated bank account

We are also required to share this information with the National Audit Office for auditing purposes.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information:

  • for 7 years for funding and financial purposes
  • until 31 December 2034, if the expense is funded by the European Social Fund

Your rights

We are relying on legal obligation for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

1.5 Using your data when you claim additional payments for teaching

These payments aim to increase the recruitment and retention of teachers. See additional payments for teaching: eligibility and payment details.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under section 11 of the Education Act 1996, providing funding for primary, secondary or further education.

Data we collect

We receive your personal data directly from you when you submit it:

  • to claim a payment
  • when contacting us for support using the service
  • to leave feedback or for any other matters
  • in response to our evaluations of the effectiveness of the service

If you make a claim, we will collect your personal information including:

  • your name, postal address, email and your phone number when you contact us
  • your email address if you include it with feedback to us on the service or agree to be contacted for user research purposes
  • your teacher reference number (TRN) to verify your claim
  • we collect the IP addresses of people visiting the additional payments for teaching website for security reasons.

DfE will also need additional information to process payments in accordance with the Pay As You Earn (PAYE) tax rules:

  • National Insurance number
  • bank account details
  • name
  • address
  • date of birth
  • gender
  • information relating to your student loans, if applicable, which are needed for the operation of payroll

What we do with your data

DfE will use your name and personal information for the purposes of:

  • providing support with your claim
  • informing you of future opportunities to claim
  • evaluating the effectiveness of the service and the policy
  • verifying your eligibility to claim

For the purposes of paying you, this will involve sharing personal data with HMRC.

How DfE uses your data:

  • for security purposes, we collect the IP addresses of people visiting the additional payments for teaching website - for example, if we were receiving continuous direct denial of service attacks from an IP address range, we could block it
  • to enable users to use the service and receive updates

We will not share this information with any other parties.

Sharing your data

We sometimes need to make personal data available to other organisations. These might include contracted partners (who we have employed to process your personal data on our behalf) or other organisations (with which we need to share your personal data for specific purposes).

 We will check information in your application with:

  • the school you are currently employed to teach at
  • the Teaching Regulation Agency’s database of qualified teachers
  • Teachers’ Pensions

To process your claim we will compare the information you have provided with records kept on Teachers’ Pensions and the Teaching Regulation Agency’s database of qualified teachers. This is so we can validate your claim.

Your information is also shared with HMRC for the purposes of processing claims for student loan repayments and paying Income Tax and National Insurance contributions on your behalf. The information we share is explained to you at each stage in the application process.

Where we need to share your personal data with others, we ensure that this data sharing complies with data protection legislation.

See the section on when we share your personal information for more details.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for the academic year in which your claim was submitted and then securely deleted. DfE or its delivery partners will never keep your personal data longer than we need it - however, for the purpose of delivery of the service, your email address and TRN will be retained for the lifetime of the service.

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

  • Softwire Technology Limited is a data processor for DfE

2. Using your data to support teaching as a career

2.1 Using your data so we can support your teaching career

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under sections 10 and 11 of the Education Act 1996, to promote education.

Data we collect

We’ll use your personal information:

  • full name
  • address
  • email
  • mobile number, if applicable
  • National Insurance number, if applicable
  • TRN, if applicable

What we do with your data

We use your data to process your application for training or vacancies, including visiting teachers’ programmes.

When processing candidate applications, we use it to:

  • send your job applications and references to providers
  • manage communications between you and providers
  • manage communications between providers and people who give references

When processing training opportunities, we use it to:

  • work out any funding you are entitled to
  • send your application or registration details to teacher training providers and the early career framework
  • record a timeline of your activity so you can review trainee progress

For all processing activities, we use it to:

  • get in touch if there’s a security issue concerning your data
  • get in touch with you and providers about your applications or reference
  • analyse application and service usage data
  • get in touch with you to ask if you would like to participate in user research
  • validate TRNs
  • keep a record of teachers with qualified teacher status (QTS), including professional skills test outcomes
  • find a lost TRN

See the Get Into Teaching privacy notice for more details.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal data for as long as you use our teaching vacancy and training services. We will keep it for no longer than 7 years after you stop using these services.

The Teaching Regulation Agency (TRA) keeps teacher records for the lifetime of a teacher. In most cases, we delete records following receipt of a valid date of death from approved sources.

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity

2.2 Using your data when we promote career development to you

DfE has campaigns to promote teaching opportunities, career development or learning opportunities.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is legitimate interest, under article 6(1)(f) of the UK GDPR.

Data we collect

DfE collects and uses the following personal information:

  • full name
  • address
  • email
  • mobile number, if applicable

DfE may purchase mailing lists to support these DfE campaigns.

You have the right to opt out of these messages. If you do not want to receive these messages, click on the ‘unsubscribe’ link in the email. Alternatively, let us know using our contact form and state the title of the email message.

What we do with your data

We use your personal information for inspiration campaigns that promote and encourage uptake of learning.

See the Get Into Teaching privacy notice for more details.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 5 years from the date of the campaign.

Your rights

We are relying on legitimate interest for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to delete your personal information – this is called the ‘right to erasure’
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

You have the right to opt out of these messages. If you do not want to receive these messages, click on the ‘unsubscribe’ link in the email. Alternatively, let us know by using our contact form and state the title of the email message.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

  • DfE uses contractors to process our communications campaigns - for example, creative agencies or PR agencies

2.3 Using your data when we create case studies about you

We write case studies to demonstrate the benefits of learning, like case studies about apprentices or their employers. DfE apprenticeship campaigns are aimed at 14 to 19-year-olds. These could be written, audio or video case studies.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is consent, under article 6(1)(a) of the UK GDPRDfE processes your personal data in relation to filming, photography and/or audio recordings on the basis of your consent. This consent is for a specific purpose and your media will not be used for any other purpose. Should we wish to use it for a different purpose we will contact you direct and ask for your consent for the new purpose.

By signing the filming, photography and audio recordings consent form, you are agreeing that we can record, process and publish your image, words and/or voice in both printed and digital form as applicable, for the creation of internal and external promotional and follow-up communications material. This includes content that will be posted across some or all of our social media channels. See our Social media use policy for more details.

When we use your sensitive or ‘special category’ data. We use it because you have given your explicit consent under article 9(2)(a) of the UK GDPR. Full details about how we process special category data are given in the DfE appropriate policy document.

Data we collect

DfE collect and use the following personal information directly from you:

  • full name
  • address
  • email
  • mobile number

We collect and use the following special category data:

  • ethnicity
  • disability, if applicable
  • gender

Full details about how we process special category data are given in the DfE appropriate policy document.

What we do with your data

We use your personal information to create case studies that are used to promote apprenticeships. For example, they are published in magazines, on websites and on social media. DfE also use case studies for TV and YouTube advertisements.

We provide information, insight and engagement to influence a range of stakeholders through members’ individual experience and story of an apprenticeship.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 5 years from when you sign off the case study.

The DfE social media channels are captured by the National Archives’ Government Web Archive as a permanent record of DfE’s social media channels.

Your rights

We are relying on consent for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
  • the right to ask us for copies of your personal information we have about you – this is called ’right of access’. This is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
  • the right to ask us to delete your personal information – this is called ‘right to erasure’
  • the right to ask us to stop using your information – this is called ‘right to restriction of processing’
  • rights in relation to automated decision making and profiling
  • the right to withdraw consent at any time (where relevant), by using our contact form
  • the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

You can ask DfE to cease publication of your image, words and/or voice on its social media channels. If you do so, DfE will not publish further social media posts featuring this content, but it is not obligated to remove or delete existing posts. The DfE social media channels are captured by the National Archives’ Government Web Archive as a permanent record of DfE’s social media communication.

If you change your mind, or you are unhappy with our use of your personal data, contact DfE and state the project or initiative name.

Further information on your rights and the ways in which your data may be used are contained in the filming, photography and audio recordings consent form.

For more information, see the ICO’s guide to individual rights.

See Requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activities:

  • DfE may use contractors (such as PR companies) to collect data for our case studies

3. Using your data to support learning, including apprenticeships

3.1 Using your data to create your unique learner number (ULN) and your personal learning record (PLR)

Your unique learner number (ULN) is a unique 10-digit number. Most learners aged over 14 have one and it is designed to work with your PLR as proof of your learning and achievements.

Your personal learning record (PLR) is a permanent online record of your qualifications and achievements.

The PLR includes learning that is funded by DfE. It also includes learning that is not funded by DfE, such as learning that is funded by the learner or training provider. Your training provider can send us details of this non-funded learning.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. The Education (Information About Individual Pupils) (England) Regulations 2013, Schedule 1, Part 1 and Education Act 1996 Section 537A, allows us to do this.

When we collect data on behalf of the Ministry of Justice, Section 107 of the Apprenticeships, Skills, Children and Learning Act 2009 allows us to do this.

However, to carry out these functions, the core set of mandatory pieces of information do not always enable us to confidently match learners to their records, so DfE collects the following additional information.

Data we collect

To create your PLR and ULR, we collect the following information under public task. We collect the information from schools, academies, colleges and training providers:

  • first name, or if more than one, each first name
  • surname, and former surname, if known
  • preferred surname
  • gender
  • date of birth
  • current unique pupil number, and previous unique pupil number, if applicable
  • unique learner number

We collect these pieces of information to distinguish between learners and verify accuracy:

  • email address
  • date of address capture
  • last known address line 1
  • last known address Line 2
  • last known address county or city
  • school at age 16
  • family name at 16
  • unique candidate number (UCI)
  • place of birth
  • Scottish candidate number, if applicable

We collect this information for awarding organisations (the organisation that awards your qualification), to verify your data:

  • learner date of birth
  • learner gender
  • learner post code

What we do with your data

We use your information to create a ULN and PLR. These enable us to record your learning achievements and to enable learning/training providers to claim public funds for your learning, to provide advice and guidance for career progression, employment opportunities or next steps in learning.

More information on how to access your personal learning record is available.

We store your ULN and PLR information in the Learning Records Service (LRS).

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

The PLR is a lifetime record of achievement for all learners. As learners are unlikely to return to learning after the age of 80, all data in the LRS will be retained for a minimum of 5 years from their latest learning event, or until the individual’s 80th birthday, whichever is longer.

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a training provider that process data about learners on behalf of DfE.

For most of the personal data schools or the multi-academy trusts collect, store and use, they are the data controller. However, where a school is required to supply a copy of some personal data to DfEDfE also becomes an independent data controller of the copy it receives.

3.2 Using your data when we create case studies about you

We write case studies to demonstrate the benefits of learning, such as case studies about teaching.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is consent, under article 6(1)(a) of the UK GDPRDfE processes your personal data in relation to filming, photography or audio recordings on the basis of your consent. This consent is for a specific purpose and your media will not be used for any other purpose. Should we wish to use it for a different purpose, we will contact you direct and ask for your consent for the new purpose.

By signing the filming, photography and audio recordings consent form, you are agreeing that we can record, process and publish your image, words or voice in both printed and digital form as applicable, for the creation of internal and external promotional and follow-up communications material. This includes content that will be posted across some or all of our social media channels. See our social media use policy for more details.

When we use your sensitive or ‘special category’ data, the reason we use it is because you have given your explicit consent under article 9(2)(a) of the UK GDPR. Full details about how we process special category data are given in DfE’s appropriate policy document.

Data we collect

DfE collects and uses the following personal information:

  • full name
  • address
  • email
  • mobile number
  • date of birth

We collect and use the following special category data:

  • ethnicity
  • disability, if applicable
  • gender

Full details about how we process special category data are given in DfE’s appropriate policy document.

We also collect and use information about your employment and your education and learning.

What we do with your data

We use your personal information to create case studies that are used to promote teaching and that are published in magazines, on our website and on social media. DfE also uses case studies in TV and YouTube advertisements.

We use these to provide information, insight and engagement to influence a range of stakeholders through members’ individual experience and story of teaching.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 5 years from when you sign off the case study.

Your rights

We are relying on consent for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to delete your personal information – this is called the ‘right to erasure’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • rights in relation to automated decision making and profiling
  • the right to withdraw consent at any time (where relevant), by using our contact form
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

As we are processing your personal data with your consent, you have the right to withdraw that consent. You can withdraw your consent up until the case study is published. You can ask DfE to cease publication of your image, words or voice on its social media channels. If you do so, DfE will not publish further social media posts featuring this content, but it is not obligated to remove or delete existing posts.

If you change your mind, or you are unhappy with our use of your personal data, let us know by using our contact form and state the project or initiative name.

Further information on rights and the ways in which your data may be used are contained in the case study filming, photography and audio recordings consent form.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

  • DfE may use contractors such as PR companies to collect data for our case studies

4. Using your data to get your views

4.1 Using your data to contact you for feedback

DfE measures the impact and effectiveness of each of our services, our programmes or our events to make improvements to the service we offer to you. We do this through surveys, public consultations and feedback about our help desks.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Sections 10 and 11 of the Education Act 1996 allows us to do this.

Data we collect

We collect and use the following personal information directly from you. We use the information you provide to us when you contact DfE or attend one of your programmes or events:

  • your full name
  • email address
  • phone number
  • date of birth
  • your address

See also Using your data to contact you for research for more information.

What we do with your data

We use your data to make improvements to the services we offer to you.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 5 years. This is in line with the DfE retention policy for business operational data.

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

  • we use Arvato to provide our service desk

5. Using your data to carry out research

5.1 Using your data when we contact you for research 

DfE undertakes research to learn how you interact with our services and to support our operational development and delivery. We do this research to make improvements to the services we offer to you. We will always seek your permission to take part in any research.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Section 10 of the Education Act 1996 allows us to do this.

When we use your sensitive information, this is ‘special category’ data. The reason we use it is because we have a substantial public interest under article 9(2)(g) of the UK GDPR.

Data we collect

We collect and use the following personal information. We use the information you provide to us when you contact DfE, attend one of your programmes or events, or use our digital services:

  • your full name
  • email address
  • phone number

We may collect and use the following special category data:

  • demographic data, such as health or disability data or ethnic data, to identify people for the research

We may also use details of what service you’ve used or what school or organisation you work in to identify people for the research.

What we do with your data

We use your data to make improvements to the services we offer to you, and to develop policy and new services. We use your data to contact you to invite you to participate in research that is relevant to you. You are under no obligation to participate in any research we invite you to. We will not contact you about research using your data if you tell us not to. See Using your data to gather evidence for policy development and delivery for more information on how we process your personal information during the research.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We will delete your personal information after we have used it to contact you for research, for example:

  • if it is a one-off processing task, such as contacting DfE service users’ data for research, we would delete the data after we have contacted you
  • if we have invited you to take part in an ongoing research panel, we will process your data for as long as we are contacting you for that research panel, specifying in the invite how long we will keep the data, how we will keep it accurate, and how you can request your data is deleted from that specific research panel

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information
  • rights in relation to automated decision making and profiling
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity

5.2 Using your data to gather evidence for policy development and delivery

DfE undertakes research to gather evidence to support our policy development and delivery. Having this evidence is important when improving outcomes for children, young people, families and adults. See Research at DfE for more details.

DfE may also seek your professional opinion on materials in development for national curriculum assessments.

Purpose and lawful basis for processing

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Section 10 of the Education Act 1996 allows us to do this.

When we use your sensitive information, this is ‘special category’ data. The reason we use it because we have a substantial public interest under article 9(2)(g) of the UK GDPR and the Education Act 2002 allows this.

If you have agreed that we can link your survey responses to other government-held data, we are undertaking this processing with your consent under article 6(1)(a) of the UK GDPR.

Data we collect

We collect and use the following personal information directly from you:

  • your full name
  • email address
  • phone number
  • your date of birth
  • your address
  • occupation
  • workplace location
  • professional qualifications and experience

When we use your sensitive or ‘special category’ data, we use it because we have a substantial public interest and you have given your ethical consent to participate in the research. As part of our research, we may need to collect information about your:

  • heath or disability
  • racial or ethnic origin
  • gender

We use information on gender, ethnicity and geographical location to ensure that the panels are representative of our diverse society, as far as is possible within a small group.

Full details about how we process special category data are given in DfE’s appropriate policy document.

What we do with your data

We’ll use your personal information for research that DfE undertakes to provide high-quality evidence to inform policy development and delivery.

We use information about your professional expertise and experience, where relevant to our work (for example, teaching qualifications and subjects taught), to ensure that appropriately qualified professionals take part in the review of national curriculum assessments.

Sometimes we link your survey responses to other government-held data. The lawful basis for this processing is ethical consent. At any time, you can tell us you no longer want us to link your data to other data. You can do this by using our contact form.

We may publish a summary of the research and the full research report. Your responses may be attributed to an organisation where this information has been provided, but our publications will not contain any personal data. DfE will anonymise or desensitise the data where possible.

Research reports published since May 2010 are available on GOV.UK.

Research reports published before May 2010 are available on the National Archives.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information until 12 months after the end of the survey or research. The national curriculum assessment review panel will keep your personal data as part of the assessment development expert review process for 5 years, after which it will be securely destroyed.

See Research at DfE and Parent, pupil and learner panel omnibus surveys for more information.

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

If you have agreed that we can link your survey responses to other government-held data, we are undertaking this processing with your consent. You have the right to withdraw that consent up until the data is analysed for the publication. If you change your mind, or you are unhappy with our use of your personal data, contact DfE and state the project or initiative name.

Further information on rights and the ways in which your data may be used are contained in the ethical consent form you will be given when you start your research.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

  • DfE uses contractors to work on its behalf  to undertake the research - they will receive your personal data directly from you during the survey
  • the Programme for International Student Assessment (PISA) is an international comparison of reading, maths and science performance of 15-year-old pupils - Pearson will process your personal data to deliver the PISA 2025 study on behalf of DfE (see About PISA25 for more information)

5.3 Using your data to take part in our stakeholder or user groups

DfE has various user or stakeholder groups that enable us to receive feedback and evidence to support our policy development and delivery, as well as data developments, analysis and research findings.

Purpose and lawful basis for processing

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under section 11 of the Education Act 1996, to promote learning and education.

Data we collect

We collect and use the following personal information:

  • your full name
  • your job role
  • your address
  • email address
  • phone number

What we do with your data

We’ll use your personal information to manage the stakeholder and user groups, including circulating meeting invites, agendas, meeting documents and meeting minutes.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal data for 10 years, as it supports our policy making.

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

  • DfE uses contractors to work on behalf of DfE to undertake the research. Our contractors will receive your personal data directly from you during the survey

5.4 Using your data to take part in our consultations

DfE holds public consultations to develop our policies, programmes and guidance.

Purpose and lawful basis for processing

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under section 11 of the Education Act 1996, to promote learning and education.

Data we collect

We collect and use the following personal information:

  • your full name
  • your job role
  • your address
  • email address
  • phone number
  • IP address

What we do with your data

We’ll use your personal information when gathering feedback from our public consultations.

Information provided in response to consultations, including personal information, may be subject to publication or disclosure under the Freedom of Information Act 2000, the Data Protection Act 2018 or the Environmental Information Regulations 2004.

If you want all or any part of a response to be treated as confidential, explain why in the relevant section of the consultation response.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal data for 10 years, as it supports our policy making.

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

  • DfE uses Delib to manage our public consultations - Delib’s website enables you to provide feedback on the documents

6. Using your data to protect learners

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Section 11 of the Children Act 2004, section 175 of the Education Act 2002 and the Education and Inspections Act 2006 allows us to do this.

Special categories of personal data need to also be processed for reasons of substantial public interest under section 10 (3) of the DPA 2018 (Special categories of personal data) and 18 (Safeguarding of children and individuals at risk). The Education Act 2002 allows this. Full details about how we process special category data are given in DfE’s appropriate policy document.

Data we collect

DfE collects information from educational settings, local authorities, your employer and other government departments to safeguard children and adults. We collect and use the following personal information:

  • name, date of birth and address of the child, young person or adult
  • name and contact details of the person reporting or involved in the safeguarding case

We collect and use the following special category data:

  • characteristics (such as gender, ethnicity and disability)

We collect and use the following sensitive information:

  • episodes of being a child in need, if applicable
  • notes about the concern

Full details about how we process special category data are given in DfE’s appropriate policy document.

For further details about safeguarding children with special educational needs and disability in schools, colleges and children’s services, see children with special educational needs and disability (SEND) and special educational needs and disability (SEND) and high needs.

What we do with your data

We use your personal information to support these children, young people and adults, and to monitor their progress.

We’ll use your personal information to:

  • keep you or another pupil or learner safe from potential harm
  • identifying issues and providing support for mental and physical health issues
  • prevent extremism in the education system - DfE works to ensure children and young people are not exposed to extremists and extremist messages

The Teaching Regulation Agency (TRA) is an executive agency of DfETRA regulates the teaching profession in England and investigate cases of serious misconduct. If you are a witness or potential witness within a teacher misconduct investigation, TRA processes your information to investigate allegations of serious misconduct.

Sharing your data

We may share your personal data with other organisations where DfE and its executive agencies are notified of an issue regarding safeguarding of children and young people.

Other people and organisations may also share personal data with DfE and its executive agencies, for example, when they make a complaint or raise a concern with us. This can include information shared in accordance with the statutory guidance keeping children safe in education and working together to safeguard children. This information will be used to investigate complaints and to ensure trusts and academies comply with the regulations (including Independent schools (Education (Independent School Standards) Regulations 2014).

See the section on when we share your personal information for more details.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

For safeguarding cases, we keep your personal information until you are aged 25, or 10 years after the date of the allegation, whichever is longer, and then it is reviewed.

TRA will only keep your personal data for as long as it needs to for the purpose of regulating the teaching profession - specifically up to 50 years after the closure of a case. After 50 years, it will be securely destroyed.

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

7. Using your data for learner assessments

7.1  Using your data to maintain lists of markers and coders

The Standards and Testing Agency (STA) is an executive agency of DfE, responsible for the development and delivery of assessments for children in education between reception and the end of key stage 2.

DfE will collect, process and store for individuals who may be interested in providing primary assessment marking or trialling and sampling coding services.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is legitimate interest, under article 6(1)(f) of the UK GDPR.

When we use your sensitive information, this is ‘special category’ data. The reason we use it is because we have a substantial public interest under article 9(2)(g) of the UK GDPR. This data is collected for equal opportunity monitoring and the Equal Opportunity Act 2010 allows this. This data is processed by Capita and the data is not shared with DfE.

Data we collect

DfE collects and uses the following personal information:

  • name and address
  • your job role
  • email address
  • date of birth
  • phone number
  • TRN
  • National Insurance number
  • bank account data

We also collect data on your recent teaching employment history, any connections you have to schools, and your qualifications and experience, where they are relevant to our work (for example, teaching qualifications and subjects taught).

Special category data processed:

  • gender
  • ethnicity
  • disability

Full details about how we process special category data are given in DfE’s appropriate policy document.

For markers recruited by Capita to mark key stage 2 tests, special category data, National Insurance numbers and pay and bank details are not shared with STA.

Bank account data will only be processed by STA for services provided directly to us.

What we do with your data

We use your personal information so we can undertake marking for live primary assessments and coding for trialling and sampling. We maintain a register of individuals that have previously undertaken marking and coding services with us or our contracted partners.

We will process your data to contact you and invite you to mark, review or code our materials.

Sharing your data

We share this data with our contracted partners that are responsible under contract to deliver marking, trialling, live national curriculum assessment services and coding services on our behalf or other organisations with which we need to share your personal data for specific purposes.

Our contracted partners will liaise with you regarding the marking and coding opportunities available.

If you enter into any agreements (for example, a temporary employment contract) with our contracted partners, the contracted partner will be the data controller for any personal data they process in connection with the services you provide to them.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

If you have not provided any services to us or our contracted partners within the previous 3 years, your personal data contained within our register will be securely destroyed. If you provide services to us or our contracted partners within a 3-year rolling period, your personal data will remain on our register.

Where you enter into an agreement to provide services to us or our contracted partners, commercial and financial information relative to those services will be retained for 7 years, after which point it will be securely destroyed.

Your rights

We are relying on legitimate interest for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to delete your personal information – this is called the ‘right to erasure’.
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. For this activity, DfE and Capita are joint data controllers.

7.2 Using your data to undertake learner and teacher assessments

The Standards and Testing Agency (STA) is an executive agency of DfE, responsible for the development and delivery of assessments for children in education between reception and the end of key stage 2.

The learner assessments include key stage 1 and key stage 2 assessments and the multiplication tables check (MTC) which are supported by the Primary Assessment Gateway and the MTC service (accessed via DfE sign-in).

The Primary Assessment Gateway system has a number of users including headteachers, school staff, local authorities, multi academy trusts and key stage 2 markers, each of whom have different reasons for logging into the system.

School representatives (headteachers and staff) will use the system to provide information to STA on pupils participating in key stage 1 and key stage 2 assessments (such as test orders, where required, pupil registration and access arrangements), as well as accessing the system to view secure materials and pupil assessment results.

Key stage 2 markers can access the system to manage their user accounts and view evaluation scores for their marking work.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. Section 87 of the Education Act 2002 allows us to do this.

See also the section Using your data to maintain a list of markers and coders.

Data we collect

For learner assessments, DfE collects and uses the following personal information:

  • your name
  • your email address
  • your phone number

For consultants contracted to undertake projects for teacher assessment (this includes individuals contracted directly and via the agency’s commercial partners) we use your data to keep you informed about developments within teacher assessment and moderation, and to recruit for future projects and events run by STA or contracted suppliers.

We will also use your data to contact you regarding any external moderation visits we may undertake at your local authority.

The data we collect is:

  • name
  • email address
  • phone number
  • bank account details (where expenses need to be claimed for attendance to events or payment of contracted fees)

What we do with your data

For the Primary Assessment Gateway and the MTC service, we use your personal information to

  • set up a user account
  • send assessment update emails to schools

We may sometimes need to make personal data available to the modified test agency we have employed to validate modified test orders on our behalf. We ensure that this sharing complies with data protection legislation and is done securely.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 7 years.

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

  • Capita processes your data for the Primary Assessment Gateway

7.3 Using your data to carry out item validation trials

STA engages with its delivery partners (trialling agencies) to carry out key stage 1 and key stage 2 item validation trials (IVT) and technical pre-tests (TPT). Both the IVT and the TPT are known as trials.

Purpose and lawful basis for processing

The legal basis for processing the personal data used and collected during the trials is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary for the exercise of a function of a government department, specifically, the requirement of the DfE to provide an effective and robust testing, assessment and moderation system to measure and monitor pupils’ progress and attainment through primary school from reception to the end of key stage 2. Section 87 of the Education Act 2002 allows us to do national curriculum assessments.

Participation in trialling for the national curriculum tests is statutory, regardless of whether the test being trialled is statutory or not. All schools drawn in the random samples are required to take part.

Data we collect

Trialling agencies will collect the following data for pupils who participate in the trials:

  • school names, and pupils’ names and dates of birth, which are used to cross check against pupil IDs and test data
  • item responses for the pupils selected to take part in the trials, to feed into analysis on test items in development and their suitability for inclusion in future national curriculum assessments

We collect special category data, this includes details about:

  • any access arrangements pupils may need for them to take part in the trials - this information is collected directly from the school through their secure school portal - only data that is needed to administer the tests will be collected

Trialling agencies will collect the following data for pupils who do not participate in the trials:

  • school names, and pupils’ names and dates of birth - this could be because a pupil is working below the overall standard of the tests, is unable to access the tests (even with the use of access arrangements) or is absent on test day

Full details about how we process special category data are given in the DfE appropriate policy document.

Data we share

STA has a data sharing agreement in place to provide its trialling agencies with the selected pupils’ names, gender and date of birth and school name. The sample is selected from information already stored by DfE and which was originally provided by schools as part of the autumn census.

The trials are completed by the selected pupils, and their completed scripts are returned to suppliers for coding.

For on-screen coding, completed questions are distributed anonymously to coders, so that no coder has access to pupil data.

For paper-based coding, the test script will include only the pupil name.

When coding is complete, item responses for each pupil are collated by trialling agencies and submitted to STA for further analysis.

What we do with your data

STA will use the information from the trials to determine which questions are suitable, taking pupils’ background characteristics into account, for the purposes of developing appropriate tests for use nationally by other pupils in the future.

The results of the trials will not be published, and no individual school or pupil will be identified in any reports produced by STA or its trialling agencies.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

Trialling agencies (the data processor) will securely dispose of the data after 6 months, in accordance with their agreement with STA.

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called ’right to be informed’
  • the right to ask us for copies of your personal information we have about you – this is called ’right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
  • the right to ask us to stop using your information – this is called ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf.

  • DfE’s trialling agencies, as data processors, are responsible for securely storing and handling any personal data required to administer the trials

8. Using your data for education sector governance

8.1 Using your data to maintain lists of education sector contact details

DfE maintains lists of:

  • contact details for schools, academies, colleges, training providers, apprenticeship employers and children’s homes
  • education sector contacts in local authorities
  • contacts for DfE programmes and services - for example, the staff wellbeing charter
  • safeguarding partner contacts
  • stakeholders, including unions, advisory boards and external bodies, such as Ofqual and Ofsted
  • qualified teachers
  • school governors and trustees
  • honours nominations, see Privacy information relating to honours nominations for more details about the honours process

DfE publishes contact details for schools, Get Information about Schools, and a searchable list of governors and trustees.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. The Education Acts 2002 and 2011 allow this.

Data we collect

DfE collects and uses the following personal information:

  • name and address
  • your job role
  • email address
  • your phone number

What we do with your data

We use your personal information to ensure we have up-to-date contacts for the whole education sector in England. We use these contacts for our data collections and education sector governance.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

How long we keep your personal information for:

  • policy making: 10 years
  • teachers: TRA will only keep your personal data for as long as it needs to for the purpose of regulating the teaching profession - specifically up to 50 years after the closure of a case - and after 50 years, it will be securely destroyed. If we receive a valid date of death from Teachers’ Pensions, we will delete your record once 5 years have elapsed.

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

8.2 Using your data when we gather the fire safety survey results

DfE has a responsibility to collate data about fire safety.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is legal obligation, under article 6(1)(c) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under Regulatory Reform (Fire Safety) Order 2005 (FSO) and Fire Safety Act 2021.

Data we collect

DfE collects and uses the following personal information:

  • name
  • address
  • email address
  • job title or position

What we do with your data

DfE uses your information to review estates of state-funded providers of education to ensure they meet fire safety standards. DfE ensures there is no aluminium composite cladding on buildings used as residential accommodation for learners or on buildings above the government threshold that are used for discrete education and training. See the Building Safety Programme for more information.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 5 years.

Your rights

We are relying on legal obligation for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling.
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

8.3 Using your data so we can support the regional advisory boards

Advisory boards (ABs) use knowledge, professional expertise and experience to consider proposals brought forward under the regional director’s decision-making framework and offer advice and challenge to the regional director to inform those decisions.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under section 11 of the Education Act 1996, to promote learning.

Data we collect

We’ll use your personal information:

  • full name
  • address
  • email
  • mobile number, if applicable

What we do with your data

We use your personal information to manage the nine regional advisory boards, including circulating meeting invites, agendas, meeting documents and meeting minutes.

Membership of the regional boards is published on the advisory boards page.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal data for 10 years, as it supports our policy making.

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

8.4 Using your data to maintain a list of teachers

The Teaching Regulation Agency (TRA) is an executive agency of DfE that maintains the central list of teachers in England and provides access to it to teachers and relevant organisations.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. The Education Acts 2002 and 2011 allow this.

Data we collect

We receive your personal data from you and third parties, including:

  • accredited providers of initial teacher training (ITT), either directly or through Jisc (with which the Higher Education Statistics Agency (HESA) has merged)
  • appropriate bodies that quality assure the early career teacher (ECT) induction process
  • approved providers of mandatory qualifications for specialist teachers
  • approved providers of national professional qualifications (NPQs)
  • Teachers’ Pensions
  • Disclosure and Barring Service (DBS)
  • other teaching regulators, including the General Teaching Council for Scotland (GTCS), General Teaching Council for Northern Ireland (GTCNI), the Teaching Council Ireland and Education Workforce Council (EWC)

We hold and process personal data to support the delivery of our functions, which support education services and help to maintain public confidence in the teaching profession.

DfE collects and uses the following personal information:

  • personal identifiers (name, date of birth, National Insurance number, TRN)
  • contact information (email address, telephone number)
  • teacher status (QTS or early years teacher status (EYTS), induction status, ITT result)
  • qualifications (previous degrees)
  • supplementary teaching qualifications (mandatory qualifications, NPQs) – see the section on NPQs
  • decisions in relation to teaching in England (decisions, prohibitions, restrictions or sanctions)
  • employment details (current employer)

If you undertook a course of ITT or a period of statutory induction prior to 2013, we may retain an electronic copy of paper records of any decisions in relation to these activities for historical enquiries. If you undertook professional skills tests between 2001 and 2020 and went on to become a teacher, never became a teacher, or have subsequently left teaching, we retain electronic evidence recording the outcome of that test for historical enquiries.

What we do with your data

We use your personal information to ensure we have up-to-date contacts for the whole education sector in England.

We use your personal data to build and maintain a permanent central record of teachers in England. This allows us to award you QTS or EYTS and confirm you have passed induction.

The Access your teaching qualifications service provides teachers and other relevant persons with access to their qualification data held on our system. The DfE Identity account service allows teachers and other relevant persons to update their personal details within their personal records. The Teacher self-service portal allows teachers and other relevant persons access to their data on the central record of teachers, if they are not yet able to use the DfE Identity account and Access your teaching qualifications services.

We also use this data for workforce analysis and administration - for example, to assist the management of funding initiatives and to support the delivery of training and development programmes.

We may also use your data when analysing activity within our services. Your contact details are used by us, or organisations acting on our behalf, to support our work, including, but not limited to, communication exercises in relation to your ITT and ECT induction period, and the administration of the Teachers’ Pensions scheme.

We may also use your personal data to contact you for research purposes. Your participation in research or survey activity is entirely voluntary, and your personal data will remain secure and confidential.

Sharing your data

We sometimes need to make personal data available to other organisations, where the law allows it or where there is a legal requirement. We share this data through secure services and via department helpdesks, who may discuss your information either directly with you or with other approved third parties by email. We ensure this sharing complies with data protection legislation. Not all your personal data is shared with every third party.

Employers within the education sector and organisations involved with the delivery of education services - we share personal data with these organisations (including schools, colleges, nurseries, local authorities, teacher supply agencies and Ofsted). This allows these organisations to check an individual is suitably qualified and has no restrictions against them in relation to teaching in England. This is compliant with Education Acts 2002 and 2011.

Approved providers and appropriate bodies - we share personal information with:

  • ITT providers (school-centred ITT providers and higher education institutions that provide courses that lead to the award of QTS and EYTS) to document your ITT outcome
  • appropriate bodies who quality assure the ECT induction process (and any third parties they use to manage statutory induction data on their behalf)
  • mandatory qualifications for specialist teachers’ providers
  • NPQ providers

This is compliant with Education Acts 2002 and 2011.

Teachers’ Pensions - we share personal data with Teachers’ Pensions to support the accurate administration of the teaching workforce pension scheme.

Disclosure and Barring Service (DBS) - we may need to share personal data with DBS to safeguard children, young people and adults. This is compliant with Section 45 and 46 of the Safeguarding and Vulnerable Groups Act 2006.

Other teaching regulators - we may share personal data with other teaching regulators so they can regulate the whole education sector. This includes, but is not limited to the:

  • Education Workforce Council (EWC)
  • General Teaching Council for Northern Ireland (GTCNI)
  • General Teaching Council for Scotland (GTCS)
  • Teaching Council Ireland

This is compliant with Schedule 2 Paragraph 6 of the Data Protection Act.

Professional regulators in countries other than England, Wales, Scotland and Northern Ireland - we share personal data with professional regulators in other countries so they can confirm an individual’s eligibility to teach when they apply to have their professional standing in England recognised in that country and identify if they are subject to a decision in relation to teaching in England. This is compliant with Education Acts 2002 and 2011.

Relevant law enforcement bodies - we share personal data with the National Crime Agency and the police to promote employer safeguarding of children within the education system. This is compliant with section 31 of the Data Protection Act 2018.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We maintain the electronic archives of:

  • QTS and induction outcomes for 45 years
  • professional skills tests outcomes for 80 years

If you applied for professional recognition prior to 31 January 2023, we may also retain your application alongside your teacher record. If you unsuccessfully applied for professional recognition, we will maintain your application in full for one year, from the point of decline. After one year, we remove your contact data and full name to anonymise your application.

Where, in the course of maintaining the list of teachers, we share your data with you, or other parties, through email, it is retained within a third-party correspondence management system and Microsoft Outlook for a period of 6 months. We reserve the ability to retain specific correspondence for longer where there is a business need to (for example, contentious cases).

From 26 May 2023, we closed our telephone helpdesk. If you contacted us prior to this date, your call would have been recorded and securely saved for training and monitoring purposes. These recordings are permanently deleted after 12 months. We reserve the ability to retain specific telephone enquiries for longer where there is a business need to (for example, contentious cases).

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

8.5 Using your data to maintain lists of prohibited or sanctioned teachers

DfE maintains list of prohibited and sanctioned teachers.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. The Education Acts 2002 and 2011 allow this.

When we use your sensitive information, this is ‘special category’ data. The reason we use it is because we have a substantial public interest under article 9(2)(g) of the UK GDPR, and the Education Acts 2002 and 2011 allow this. Full details about how we process special category data are given in DfE’s appropriate policy document.

Data we collect

DfE collects and uses the following personal information:

  • your full name
  • address
  • your job role
  • email address
  • telephone number
  • TRN
  • date of birth
  • National Insurance number

We collect and use the following special category data:

  • characteristics (such as gender, ethnicity and disability)
  • notes about the concern - this may include health information or information about criminal activities

Full details about how we process special category data are given in DfE’s appropriate policy document.

What we do with your data

We use your personal information to ensure we have up-to-date contacts for the whole education sector in England. The Secretary of State for Education must keep a list of all persons who are prohibited from teaching.

Sharing your data

We sometimes need to make personal data available to other organisations where the law allows it, or where there is a legal requirement. We share this data through secure services and via department helpdesks, who may discuss your information either directly with you or with other approved third parties by email. We ensure this sharing complies with data protection legislation. Not all your personal data is shared with every third party.

Employers within the education sector and organisations involved with the delivery of education services - we share personal data with these organisations (including schools, colleges, nurseries, local authorities, teacher supply agencies and Ofsted). This allows these organisations to check an individual is suitably qualified and has no restrictions against them in relation to teaching in England. This is compliant with Education Acts 2002 and 2011.

Disclosure and Barring Service (DBS) - we may need to share personal data with DBS to safeguard children, young people and adults. This is compliant with Section 45 and 46 of the Safeguarding and Vulnerable Groups Act 2006.

Relevant law enforcement bodies - we share personal data with the National Crime Agency and the police to promote employer safeguarding of children, young people and adults. within the education system. This is compliant with section 31 of the Data Protection Act 2018.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We hold information on the teaching workforce, and those with restrictions placed upon them, to support education services and to maintain public confidence in the teaching profession. Your personal data are therefore held for the active lifetime of a teacher.

How long we keep your personal information for:

  • policy making: 10 years
  • teachers: TRA will only keep your personal data for as long as it needs to for the purpose of regulating the teaching profession - specifically up to 50 years after the closure of a case - and after 50 years, it will be securely destroyed. We will delete your record once 5 years has elapsed after a valid date of death is received from Teachers’ Pensions

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

8.6 Using your data to investigate teacher misconduct

The Teaching Regulation Agency (TRA) is an executive agency of DfE investigates cases of serious misconduct and decides whether to refer a case to a professional conduct.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. The Education Acts of 2002 and 2011 allows this.

When we use your sensitive information, this is ‘special category’ data. The reason we use it is because we have a substantial public interest under article 9(2)(g) of the UK GDPR, and the Education Acts 2002 and 2011 allow this.

Data we collect

We receive your personal data from you, including referrals on our:

  • digital services, including Report serious misconduct by a teacher, and
  • third parties, including employers or supply agencies, police forces, the Disclosure and Barring Service (DBS) and members of the public

We process this information to regulate the teaching profession by investigating allegations of serious misconduct.

DfE collects and uses the following personal information:

  • personal identifiers (name, date of birth, email address, home address, telephone number, National Insurance number, TRN)
  • contact information (home address, email address, telephone number)
  • teacher status (QTS or EYTS, induction status, ITT result)
  • qualifications (previous degrees)
  • supplementary teaching qualifications (mandatory qualifications, national professional qualifications)
  • employment details (current or previous employer)
  • financial details (for expense purposes, if applicable)

We collect and use the following special category data:

  • your racial or ethnic origin
  • your political opinions
  • your religious beliefs or other beliefs of a similar nature
  • whether you are a member of a trade union
  • your physical or mental health
  • your sexual orientation
  • the commission or alleged commission of any offence by you, i.e. details of the allegation
  • any proceedings for any offence committed, or alleged to have been committed, by you, the disposal of such proceedings or the sentence of any court in such proceeding

Full details about how we process special category data are given in DfE’s appropriate policy document.

What we do with your data

As a teacher, witness or potential witness within a teacher misconduct investigation, or a person making an allegation, we receive your personal data from you and third parties including employers or supply agencies, police forces, the Disclosure and Barring Service (DBS) and members of the public. We process this information to regulate the teaching profession by investigating allegations of serious misconduct.

Sharing your data

We sometimes need to make personal data available to other organisations. This also includes contracted partners.

Where we need to share your personal data with others, we comply with data protection legislation.

Accused teacher and their employer - if there is an investigation, we tell them the name of the person who made the referral and details of their allegation. If there is no investigation, we do not share any information. If the teacher makes a subject access request, we give details of the allegation but not the name of the referrer, unless the referral came from an organisation, when we give the name of the referring organisation. This is compliant with Education Acts 2002 and 2011.

Legal firms - we hold contracts with legal firms to process your personal data on our behalf. They process the data we provide to gather information to support misconduct investigations and hearings. Some legal firms will also review this data to provide impartial legal advice during misconduct hearings. This is compliant with Education Acts 2002 and 2011.

Professional conduct panels - we appoint independent panel members who sit on professional conduct panels to consider cases of serious misconduct and they may make recommendations on prohibition to the Secretary of State. They need this information to fulfil this role. This is compliant with Education Acts 2002 and 2011.

Published decisions - we will publish your personal data within a decision document on GOV.UK if a finding of serious misconduct is made. This is accessible by members of the public. This is compliant with section 15 of the Teachers’ Disciplinary (England) Regulations 2012 and section 141c of the Education Act 2002 (updated).

DBS and other organisations - we may need to share your personal data with DBS and other organisations (including, but not limited to, local authority organisations and employers) to safeguard children, young people and adults. This is compliant with Section 45 of the Safeguarding and Vulnerable Groups Act 2006.

Police - we may need to share your personal data with the police and the police share information with DfE so we can fulfil our statutory roles. This is compliant with section 31 of the Data Protection Act 2018.

Other teaching regulators - we may need to share your personal data with other teaching regulators so they can regulate the whole education sector. This includes, but is not limited to the:

  • General Teaching Council Scotland (GTCS)
  • General Teaching Council Northern Ireland (GTCNI)
  • Teaching Council Ireland (TCI)
  • Education Workforce Council (EWC)

This is compliant with Schedule 2 Paragraph 6 of the Data Protection Act.

Our finance team - if applicable, we may need to share your financial details with our finance team to pay any expense claims you make.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We hold information on the teaching workforce, and those with restrictions placed upon them, to support education services and to maintain public confidence in the teaching profession. Your personal data is therefore held for the active lifetime of a teacher.

We keep your personal information for as long as we need to for the purpose of regulating the teaching profession, specifically up to 50 years after the closure of a case. After 50 years it will be securely destroyed.

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity

8.7 Using your data when you register for a NPQ

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under section 132 of the Education Act 2002, together with regulation 5 of the Education (School Teachers’ Qualifications) (England) Regulations 2003.

Data we collect

DfE collects and uses the following personal information:

  • your contact information – name, phone number, email address, date of birth
  • your TRN
  • your National Insurance number
  • where you work and what your role is
  • the institution that awarded your QTS

What we do with your data

When processing NPQ registrations, we:

  • send your registration details to NPQ providers
  • validate your TRN
  • work out any funding you’re eligible for
  • get in touch with you and NPQ providers about your NPQ registration
  • determine the NPQ outcomes
  • compare your data to other data we hold
  • get in touch if there’s a security issue concerning your data

We use your data to run and improve our services. We may contact you about taking part in user research and look at any feedback you share - for example, through website surveys.

Sharing your data

We have a data sharing agreement with NPQ providers so they can only use your data to:

  • process NPQ registrations and applications, which may include contacting you
  • get statistics for internal use
  • get in touch with you if there’s a security issue concerning your data

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for up to 6 months after completion of the processing of the data.

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

When you register for an NPQ you’re asked to choose an NPQ provider. We share your data with your chosen provider.

9. Using your data when you contact us

9.1 Using your data to make an enquiry or complaint

We collect, process and store your personal data when you contact the department, by the DfE contact us form, telephone, email, message or live chat. In addition, telephone calls to our helplines may be recorded for training and monitoring purposes. If provided, we will also use your email address to send a customer satisfaction survey.

We use this information to resolve your enquiry, to progress a follow up enquiry or to action a request, as appropriate. It is also used to ensure our call agents are appropriately trained and to enable us to continually improve the quality of the service provided.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department.

Data we collect

DfE collects and uses the following personal information directly from you:

  • your full name
  • email address
  • details about your enquiry or compliant
  • IP address

The following information may also be collected and processed:

  • job title
  • school name, local authority name, academy trust name or organisation name
  • school DfE number, local authority number or academy trust number

If your enquiry is about a pupil, the following data may also be collected and processed:

  • unique pupil number
  • date of birth
  • initials

What we do with your data

We need information from you to investigate your complaint or enquiry properly.

We use the IP address to detect and block malicious visitors to our websites.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 7 years from the date of the enquiry or complaint.

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

9.2 Using your data to use our websites

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department.

Data we collect

We use Google Analytics to collect information from you about how you use this website. We do not collect or store your personal information through Google Analytics, so it cannot be used to identify who you are.

Google Analytics uses 3 types of cookies. See the section on cookies for more details.

What we do with your data

We use your personal information to:

  • ensure we present our website content in the best way for you
  • allow you to take part in the interactive features of our service, when you choose to do so

See Using your data when you sign up to our notifications for more information on when we use your data to:

  • notify you about changes to our website or services
  • provide you with information or services that you request from us or which may interest you

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

Your personal information is retained for up to 2 years. See Details about cookies on GOV.UK for more information.

If you create an account on our websites or sign up for an alert your personal information is kept as long as you have an account. If you delete your account or cancel your alert, your data will also be deleted. See Using your data when you sign up to our notifications for more information.

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

  • we use Google Analytics cookies and a real user monitoring (RUM) cookie from SpeedCurve to collect information about how you use GOV.UK

9.3 Using your data to use our social media channels

We use social media to share news and views with people working in:

  • schools
  • colleges
  • local authorities
  • children’s services

We also use social media to communicate with parents, children and young people.

See our Social media use policy for more details.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is consent under article 6(1)(a) of the UK GDPR – this is when we ask your consent to use your information.

Data we collect

When you interact with our social media channels we collect and use:

  • your name

What we do with your data

When you use our websites and social media channels, we use your personal information to:

  • allow you to take part in interactive features of our service, when you choose to do so
  • ensure we present our website content in the best way for you
  • provide you with information or services that you request from us or which may interest you - we always get your consent when you request these DfE services
  • notify you about changes to our website or services

See the section on cookies for more details.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

DfE social media channels are captured by the National Archives as a permanent record of DfE’s social media communication.

Your personal information is retained for up to 2 years, see the Details about cookies on GOV.UK page for more information.

Your rights

We are relying on consent for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to delete your personal information – this is called the ‘right to erasure’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

As we are processing your personal data with your consent, you have the right to:

  • withdraw consent at any time, by using our contact form
  • ask DfE to cease publication of your image, words or voice on its social media channels

If you do so, DfE will not publish further social media posts featuring this content, but it is not obligated to remove or delete existing posts. DfE social media channels are captured by the National Archives as a permanent record of DfE’s social media communication

If you change your mind, or you are unhappy with our use of your personal data, contact DfE and state the project or initiative name.

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

  • we use Google Analytics cookies and a real user monitoring (RUM) cookie from SpeedCurve to collect information about how you use GOV.UK

9.4 Using your data when you sign up to our notifications

You can sign up for notifications, such as about teaching as a career, our events or our services and work.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is consent under article 6(1)(a) of the UK GDPR – this is when we ask your consent to use your information. At any time, you can tell us you no longer want us to use it. You can do this by using our online contact form

Data we collect

DfE collects and uses the following personal information:

  • first name and surname
  • your job role
  • establishment name
  • email address (where you want to receive the communication)

What we do with your data

We’ll use your personal information to enable you to sign up to specific messages, such as when promoting apprenticeships or our careers service, or to invite you to events, etc.

Your rights

We are relying on consent for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to delete your personal information – this is called the ‘right to erasure’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to withdraw consent at any time, by using our contact form
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

As we are processing your personal data with your consent, you have the right to withdraw that consent. If you change your mind, or you are unhappy with our use of your personal data, contact us and state the project or initiative name.

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

9.5  Using your data when you attend our events or webinars

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is consent under article 6(1)(a) of the UK GDPR – this is when we ask your consent to use your information. At any time, you can tell us you no longer want us to use it. You can do this by using our online contact form

Data we collect

DfE collects and uses the following personal information:

  • first name and surname
  • your job role
  • establishment name
  • email address or telephone number (where you want to receive communication about the event or webinar)
  • IP address (if applicable)

What we do with your data

We use your email address to provide you with the event details. This will include information about any recording taking place. For recorded events, we will also email you a link to the recording once the event has concluded.

For some events, we may publish the recording on our website or YouTube channels so this is accessible to a wider audience. If an event recording will be published, we will always notify you before the event.

We don’t publish delegate lists for event or webinars, but your name and email address may be visible to others in attendance during the event.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 5 years after the event.

Your rights

We are relying on consent for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to delete your personal information – this is called the ‘right to erasure’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to withdraw consent at any time, by using our contact form
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

As we are processing your personal data with your consent, you have the right to withdraw that consent. You can withdraw your consent up until the webinar recording is published. If you change your mind, or you are unhappy with our use of your personal data, contact us and state the name of the event or webinar.

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

  • we use data processors to help organise our events - the details of the organiser of the event is provided in the sign-up email

10. Using your data when we contact you

10.1  Using your data when you sign up to our notifications

You can sign up for notifications, such as about teaching as a career, our events or our services and work.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is consent under article 6(1)(a) of the UK GDPR – this is when we ask your consent to use your information. At any time, you can tell us you no longer want us to use it. You can do this by using our online contact form

Data we collect

DfE collects and uses the following personal information:

  • first name and surname
  • your job role
  • establishment name
  • email address (where you want to receive the communication)

What we do with your data

We’ll use your personal information to enable you to sign up to specific messages, such as when promoting apprenticeships or our careers service, or to invite you to events, etc.

See also the Get Into Teaching privacy notice for more details.

Your rights

We are relying on consent for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to delete your personal information – this is called the ‘right to erasure’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to withdraw consent at any time, by using our contact form
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

As we are processing your personal data with your consent, you have the right to withdraw that consent. If you change your mind, or you are unhappy with our use of your personal data, contact us and state the project or initiative name.

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

10.2 Using your data when we send you messages about administering learning, including qualifications or exams

DfE will send out messages relating to the administration of examinations, or qualifications, or funding requirements. These are public service messages - see the ICO website for more details.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under section 10 and 11 of the Education Act 1996, promoting education and providing funding for primary, secondary or further education.

Data we collect

DfE collects and uses the following personal information:

  • first name and surname
  • your job role
  • establishment name and address
  • email address (where you want to receive the communication)

What we do with your data

We’ll use your personal information to send you specific public messages, such as when promoting teaching as a career, or reminders to submit data to DfE, etc.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for as long as you are the contact for the educational setting.

Your rights

We are relying on public task for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

  • DfE uses contractors to work on behalf of DfE - for example, Netbuilder (Marketo), Parkhouse Agency (for mailing list purchases), and creative agencies and PR agencies

10.3 Using your data when we send you messages about education issues

DfE will send you messages by email on key education issues or if there is a problem. Messages include ‘for action’ or ‘service notifications’ messages, news and developments, ‘for information’ messages, and details of events. Updates are for people working in early years, children’s social care, schools or further education.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is consent under article 6(1)(a) of the UK GDPR – this is when we ask your consent to use your information.

At any time, you can tell us you no longer want us to use it. You can do this by using our online contact form

Data we collect

DfE collects and uses the following personal information:

  • first name and surname
  • your job role
  • establishment name
  • email address (where you want to receive the communication)

What we do with your data

We’ll use your personal information to enable you to sign up to receive specific messages, such as when promoting apprenticeships or our careers service, or to invite you to events, etc.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for as long as you are signed up to our notifications and alerts.

If you create an account on our websites or sign up for an alert, your personal information is kept as long as you have an account. If you delete your account or cancel your alert, your data will also be deleted.

You can unsubscribe from our emails at any time on the manage your GOV.UK email subscriptions page. You can also use the ‘unsubscribe’ or ‘change your email preferences’ links in the emails you get from GOV.UK.

Your rights

We are relying on consent for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to delete your personal information – this is called the ‘right to erasure’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to withdraw consent at any time, by using our contact form
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

As we are processing your personal data with your consent, you have the right to withdraw that consent. If you change your mind, or you are unhappy with our use of your personal data, contact us and state the project or initiative name.

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

11. Using your data when you use DfE Sign-In

DfE Sign-in is how schools and other education organisations access DfE online services. See the DfE Sign-In page for details of the DfE services that use DfE Sign-In.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. The legislation to support this is Section 8 of the Data Protection Act 2018 – exercising official authority as part of public body tasks and DfE functions.

Data we collect

DfE collect and use the following personal information directly from you:

  • your first name and last name
  • the email address you provide
  • the organisation details the account is linked to

What we do with your data

We use the data to allow you access to DfE online services.

Occasionally, DfE will contact users on the email address provided with essential information about DfE Sign-in.

Sharing your data

We may share your information where the law allows, or where we have a legal obligation to do so.

For Ofsted users, we regularly share your details with Ofsted for monitoring purposes.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 6 years from the date on which an individual deactivates or deletes their account.

Your rights

We are relying on public task for this processing, this means you have:

  • the right to be informed about the collection and use of your personal data – this is called ’right to be informed’
  • the right to ask us for copies of your personal information we have about you – this is called ’right of access’. This is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
  • the right to ask us to stop using your information – this is called ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See Requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

12. Using your data to check our IT systems

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is legitimate interest, under article 6(1)(f) of the UK GDPR.

When we use your sensitive information, this is ‘special category’ data. The reason we use it is because we have a substantial public interest under article 9(2)(g) of the UK GDPR, and the Education Acts 1996, 2002, 2005 and 2011 allow this.

Data we collect

DfE collects information from educational settings, local authorities, your employer and other government departments. We will process the following information about you:

  • personal contact details
  • date of birth
  • ethnicity
  • data and information about your learning, including your courses and assessments

If the IT system or database contains special category data, we would be processing details about:

  • your equality, diversity and inclusion information
  • your health

If the IT system or database contains sensitive information about you, we would be processing details about:

  • children that are looked after or are in care

What we do with your data

When we are designing a new system or database, it is sometimes necessary to use ‘live’ personal data to test the design in a secure environment. This is because ‘dummy data’ is not capable of replicating the complexity of the data that is actually collected.

Similarly, it is necessary to extract copies and run quality checks for the purposes of identifying unnecessary duplication or even conflicting data about the same data subject. In order to maintain the accuracy of our data, if duplicate records are identified, we would either merge the duplicate records under one Unique Learner Number or maintain existing records but include cross referencing so all the records are linked and are retrieved when searching for the one data subject.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

This processing activity is for the length of time it takes to test or check the data, any copies of the data created would be deleted as soon as the text or check is complete.

Your rights

We are relying on legitimate interest for this processing. This means you have:

  • the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
  • the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
  • the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
  • the right to ask us to delete your personal information – this is called the ‘right to erasure’
  • the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
  • the ‘right to object to processing’ of your information, in certain circumstances
  • rights in relation to automated decision making and profiling
  • the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See the Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activities:

  • we use contractors to do our IT health checks (ITHC) - an ITHC is a series of controlled tests and actions that check the security of our IT systems

13. Using your data when we share your personal information

We will only share your personal data with others where it is lawful, secure and ethical to do so. Where these conditions are met, we can share your personal information with:

  • schools and other education providers
  • local authorities
  • researchers (like universities, think tanks, research organisations)
  • organisations connected with promoting the education or wellbeing of children in England
  • organisations fighting or identifying crime (like police, courts, the Home Office, etc)
  • other specified crown and public bodies (like Ofqual, Ofsted, UCAS, Office for Students, etc)
  • organisations working for DfE under contract (like DfE commissioned research or training providers)
  • organisations that provide careers and other guidance
  • organisations that provide statistics and research about education, training, employment and wellbeing, including Jisc (with which the Higher Education Statistics Agency (HESA) has merged) as detailed in Jisc’s collection notices - your data is also submitted to Jisc so you can take part in the graduate outcomes survey

DfE shares personal data where this is a benefit to education, the children’s services sector or it is in the interests of the wider public or society, such as sharing data to fight crime or for policy development is in the interests of society.

How DfE shares personal data gives details of the protections DfE has in place when sharing your data and the relevant legislation.

The DfE Data Sharing Approval Panel (DSAP) must approve all data share requests. The panel of experts assesses each application for public benefit, proportionality, legal underpinning and strict information security standards. The DSAP panel has external members who analyse decisions to increase public trust in the data share process.

DfE will only share data with a third party where we have a lawful basis for the data share under article 6(1) of the UK GDPR. In most cases, DfE relies on article 6(1)(e) ‘public task’ as the lawful basis where the task or function has a clear basis in law or 6(1)(f) ‘legitimate interest’ where the sharing of your data does not override your rights or when you expect us to share your data. But DfE will review each data share request on a case-by-case basis to ensure the right lawful basis is used. See the ICO guide to Lawful basis for processing for more details.

For example, we share data under public task with:

  • awarding organisations - to allow exam outcomes to be accurately predicted
  • the Children’s Commissioner’s Office (CCO) - to protect and promote the rights and interests of children in England, especially the most vulnerable
  • fraud prevention and law enforcement agencies such as the police and the National Crime Agency - to prevent and detect fraud in the funding of education and learning.
  • the Home Office (HO) - to prevent abuse of immigration control
  • police and criminal investigation authorities, through court orders - to safeguard and promote the welfare of children in the UK

For example, we share data under legitimate interest with the:

  • Education Policy Institute (EPI) - to identify if government policies are delivering a high-quality education system
  • National Foundation for Educational Research (NFER) and Scottish Qualifications Authority (SQA) - to investigate developments to the national curriculum

Full details of who we share data with are available: DfE external data shares.

14.  How to contact us and how to make a complaint

14.1 How to contact us

Contact the Data Protection Team if you have any questions about this document or how we use your information.

14.2 How to make a complaint

If you have concerns about how we use your personal information, you can make a complaint in writing to the Data Protection Officer and Information Commissioner’s Office.

14.3 How to access your personal information

request to access your personal information can be made verbally or in writing.