Personal information charter
Source: gov.uk (2025-08-07)

Privacy notices and how we collect, hold or use your personal information at the Department for Education (DfE).

DfE as data controller

Under the Data Protection Act (DPA) (https://www.gov.uk/data-protection) and the UK General Data Protection Regulation (UK GDPR) (https://www.legislation.gov.uk/eur/2016/679/contents), a data controller decides how and why personal data is processed.

The Department for Education (DfE) is data controller for the personal data DfE and our executive agencies process. Our executive agencies are:
- Skills England (SE)
- Standards and Testing Agency (STA)
- Teaching Regulation Agency (TRA)
DfE has privacy notices (#how-we-use-your-information) for each of our areas of work. These show how we use your personal information in each area.

DfE arm’s length bodies (ALBs) are data controllers in their own right, and have their own privacy notices (#ALBs).

We may sometimes change this document, and we encourage you to check it from time to time.

DfE’s personal information charter

This charter sets out what you can expect from us when we hold your personal information. We will follow all applicable UK data protection laws, including the data protection principles.

The personal information we hold about you will be:
- used lawfully, fairly and in a transparent way
- collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes
- relevant to the purposes we have told you about and limited only to those purposes
- accurate and, where necessary, kept up to date
- kept only as long as necessary for the purposes we have told you about
- kept securely
The DfE appropriate policy document (https://www.gov.uk/government/publications/dfe-appropriate-policy-document) has information on how we process your special category data.

DfE privacy notices (#how-we-use-your-information) show how we use your personal information in each of our areas of work.

DfE follows the Cabinet Office guidelines on data classification (https://www.gov.uk/government/publications/government-security-classifications) and protecting information (https://www.gov.uk/government/publications/security-policy-framework).

How we collect your personal information

We receive your personal information indirectly from other organisations. For example, we collect information about:
- you, your learning and your achievements – we collect this information from educational settings like early years providers, schools, academies, independent schools, colleges and training providers and from your employer, if applicable
- children in need, children looked after and alternative provision – we collect this information from local authorities
- you to support research and to safeguard children – we collect this information from other government departments, early years providers, schools, academies, independent schools, colleges and training providers
- your exam results – we receive this from awarding organisations and exam boards
- teachers and employees in educational settings or local authorities – we collect this information from the educational setting or local authorities
Find out more about how we collect this information through our school and college (https://www.gov.uk/topic/schools-colleges-childrens-services/data-collection-statistical-returns) and further education (https://www.gov.uk/education/further-education-financial-management-and-data-collection) data collections, such as the school census.

We may also collect information directly from you:
- over the telephone when you contact our helpdesks
- in correspondence that you send to us, like emails, letters and social media posts
- details of your visits to our website, including the resources that you access
- when you subscribe to our mailing lists
Storing your personal information outside the UK

When DfE stores personal information outside the UK, we will make sure we keep it safe.

Most personal information we collect and use is stored on systems in the UK and European Union (EU).

On occasion, your information may leave the UK or EU:
- to get to another organisation
- if it is stored in a system outside the EU
Details of these transfers can be found in the data-subject privacy notices.

When this happens, we make sure the country it is sent to has the required level of data protection. We also take additional steps to protect your information including:
- making sure it is transferred securely
- there is a contract in place which ensures the recipient will protect your information
Where we have to send personal information to a country without an adequacy decision, we carry out due diligence to ensure that the transfer is made in accordance with UK data protection legislation.

Automated decision making and profiling

DfE sometimes uses automated processing in some decision making to help us deliver efficient services. We will not make any decision based solely on automated processing which has a significant effect on you unless the law specifically allows this.

Profiling involves the use of personal data to evaluate certain personal aspects such as a person’s:
- performance at work
- economic situation
- health
- personal preferences
- interests
- reliability
- behaviour
- location or movements
We will sometimes use profiling where there is a clear benefit for doing so. DfE examples of profiling may include to:
- avoid asking for information or evidence that we do not need, and make sure we ask for it when necessary
- improve our services and support the achievement of our objectives
- detect and prevent fraud and error
Application programming interface (API)

An application programming interface (API) is a piece of software that allows IT systems or software applications to communicate with each other.

DfE uses APIs for various purposes, such as:
- automating finance submissions – this helps streamline the process of submitting financial information to the department, reducing manual effort and improving accuracy
- recording learning assessments – APIs enable the efficient recording and tracking of student assessments, ensuring that data is up to date and easily accessible
- Providing access to published data – by using APIs, DfE can make its published data available on websites, allowing users to retrieve and use this information effectively
This is not an exhaustive list.

Refer to the privacy policy for Find and use an API (https://find-and-use-an-api.education.gov.uk/privacy-policy) and the DfE API catalogue (https://www.api.gov.uk/dfe/#department-for-education) for more details.

Artificial intelligence

Artificial intelligence (AI) is the theory and development of digital technology to be able to perform tasks normally requiring human intelligence. This includes the creation or use of large language models and machine learning.

DfE may make use of AI when processing personal data to achieve efficiencies or other benefits. Where we do so, we will inform you via the specific privacy notice for that activity.

Your rights under UK GDPR

The UK GDPR gives you certain rights about how your information is collected and used.

This includes the right to:
- be informed about the collection and use of your personal data – this is called ‘right to be informed’
- ask us for copies of your personal information we have about you – this is called ‘right of access’, this is also known as a subject access request, data subject access request or right of access request
- ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
- ask us to delete your personal information – this is called ‘right to erasure’
- ask us to stop using your information – this is called ‘right to restriction of processing’
- ‘object to the processing’ of your information, in certain circumstances
- be informed about automated decision making and profiling
- withdraw consent at any time (where relevant)
- complain to the Information Commissioner (https://www.gov.uk/government/publications/requesting-your-personal-information/requesting-your-personal-information#your-rights) if you feel we have not used your information in the right way
There are legitimate reasons why we may refuse your information rights request, which depends on why we are processing it. For example, some rights will not apply. The right to:
- erasure does not apply when the lawful basis for processing is legal obligation or public task
- portability does not apply when the lawful basis for processing is legal obligation, vital interests, public task or legitimate interests
- object does not apply when the lawful basis for processing is contract, legal obligation or vital interests - if the lawful basis is consent, you don’t haven’t the right to object, but you have the right to withdraw consent
DfE privacy notices (#how-we-use-your-information) provide details of your rights and the lawful basis for each processing activity.

The ICO’s guide to individual rights (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/) has more information.

Requesting your personal information from DfE (https://www.gov.uk/government/publications/requesting-your-personal-information/requesting-your-personal-information#your-rights) has information about what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

How we use your information

DfE and our executive agencies, Skills England, Standards and Testing Agency (STA) and the Teaching Regulation Agency (TRA), publish privacy notices for and process personal data about:
- children and young people who are aged under 18 and not in mainstream education, and care leavers aged up to 25 (https://www.gov.uk/government/publications/privacy-information-children-and-young-people-under-18)
- learners: early years foundation stage to key stage 3 (https://www.gov.uk/government/publications/privacy-information-early-years-foundation-stage-to-key-stage-3)
- learners: key stage 4 and 5 and adult education (https://www.gov.uk/government/publications/privacy-information-key-stage-4-and-5-and-adult-education)
- parents, carers and legal guardians (https://www.gov.uk/government/publications/privacy-information-parents-and-legal-guardians)
- members of the public (https://www.gov.uk/government/publications/privacy-information-members-of-the-public)
- education provider’s workforce, including teachers (https://www.gov.uk/government/publications/privacy-information-education-providers-workforce-including-teachers)
- local authority employees (https://www.gov.uk/government/publications/privacy-information-local-authority-employees)
- stakeholders (https://www.gov.uk/government/publications/privacy-information-business-contacts-and-stakeholders)
- Department for Education workforce (https://www.gov.uk/government/publications/privacy-information-department-for-education-workforce)
Model data protection privacy notices that schools and academies can use (https://www.gov.uk/government/publications/data-protection-and-privacy-privacy-notices) are available on GOV.UK.

DfE’s agencies and arm’s length bodies (ALBs)

These DfE ALBs are data controllers in their own right. Their individual privacy notices have more information on what personal information they process:
- Construction Industry Training Board (https://www.citb.co.uk/utility-links/privacy-policy-cookies/)
- Engineering Construction Industry Training Board (https://www.ecitb.org.uk/privacy-statement/)
- LocatED (https://www.located.co.uk/terms-and-conditions/)
- Office for Students (https://www.officeforstudents.org.uk/ofs-privacy/)
- Office of the Children’s Commissioner (https://www.childrenscommissioner.gov.uk/privacy/)
- Ofsted (https://www.gov.uk/government/organisations/ofsted/about/personal-information-charter)
- Ofqual (https://www.gov.uk/government/organisations/ofqual/about/personal-information-charter)
- Social Work England (https://www.socialworkengland.org.uk/privacy/)
- Student Loans Company (https://www.gov.uk/government/organisations/student-loans-company/about/personal-information-charter)
DfE is data controller for these DfE ALBs. Their individual privacy notices have more information on what personal information they process:
- Independent Review Mechanism (https://www.gov.uk/government/organisations/independent-review-mechanism/about/personal-information-charter)
- Office of the Schools Adjudicator (https://www.gov.uk/government/organisations/office-of-the-schools-adjudicator/about/personal-information-charter)
Cookies

Cookies are small text files that are placed on your computer by websites that you visit. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site.

DfE uses necessary cookies to make our websites work. Necessary cookies enable core functionality such as security, network management and accessibility. Each website with cookies on it will have a cookie banner with details.

Cookies are used to:
- measure how you use this service so it can be updated and improved based on your needs
- remember who you are if you return to your saved results so we can show you your information and information relevant to you
Cookies aren’t used to identify you personally. We record tracking information anonymously, so cookies do not track your personal data, only your activity on the site.

Each DfE website will have details about the specific cookies that are used on that site or social media channel.

Cookies on GOV.UK (https://www.gov.uk/help/cookie-details) has more information.

Sharing your personal information

We will only share your personal data with others where it is lawful, secure and ethical to do so. Where these conditions are met, we can share your personal information with:
- schools and other education providers
- local authorities
- researchers, such as universities, think tanks and research organisations
- organisations connected with promoting the education or wellbeing of children in England
- organisations fighting or identifying crime, such as the police, the courts and the Home Office
- other specified crown and public bodies, such as Ofqual, Ofsted, UCAS and the Office for Students
- organisations working for DfE under contract, such as DfE-commissioned research or training providers
- organisations that provide careers and other guidance
- organisations that provide statistics and research about education, training, employment and wellbeing, including Jisc (formerly the Higher Education Statistics Agency or ‘HESA’) as detailed in Jisc’s collection notices (https://www.hesa.ac.uk/about/regulation/data-protection/notices#student) – your data is also submitted to Jisc so you can take part in the graduate outcomes (https://www.graduateoutcomes.ac.uk/privacy-info) survey
- other official bodies appointed in the public interest for a specific investigatory or advisory purpose, such as a public inquiry
DfE shares personal data where this is a benefit to education, the children’s services sector or it is in the interests of the wider public or society, such as sharing data to fight crime or for policy development.

How DfE shares personal data (https://www.gov.uk/guidance/data-protection-how-we-collect-and-share-research-data) gives details of the protections DfE has in place when sharing your data and the relevant legislation.

Our Data Sharing Approval Panel must approve all data share requests. The panel of experts assesses each application for public benefit, proportionality, legal underpinning and strict information security standards. The panel has external members who analyse decisions to increase public trust in the data share process.

DfE will only share data with a third party where we have a lawful basis for the data share under article 6(1) of the UK GDPR. In most cases, we rely on article 6(1)(e) ‘public task’ as the lawful basis where the task or function has a clear basis in law or 6(1)(f) ‘legitimate interest’ where the sharing of your data does not override your rights or when you expect us to share your data.

When we share special category data, we have a lawful basis to data share under article 9(2) of the UK GDPR. Full details about how we process special category data are given in the DfE appropriate policy document (https://www.gov.uk/government/publications/dfe-appropriate-policy-document) and How DfE shares personal data (https://www.gov.uk/guidance/data-protection-how-we-collect-and-share-research-data).

We will review each data share request on a case-by-case basis to ensure the right lawful basis is used. The ICO guide to lawful basis for processing (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/) has more details.

For example, we share data under public task with:
- awarding organisations – to allow exam or test outcomes to be accurately predicted
- the Children’s Commissioner’s Office – to protect and promote the rights and interests of children in England, especially the most vulnerable
- fraud prevention and law enforcement agencies, such as the police and the National Crime Agency – to prevent and detect fraud in the funding of education and learning
- the Home Office – to prevent abuse of immigration control
- the police and criminal investigation authorities through court orders – to safeguard and promote the welfare of children in the UK
We share data under legitimate interest with the:

Education Policy Institute – to identify if government policies are delivering a high-quality education system

National Foundation for Educational Research and Scottish Qualifications Authority – to investigate developments to the national curriculum

We share data under legal obligation with:
- other official bodies appointed in the public interest for a specific investigatory or advisory purpose, such as a public inquiry
Full details of who we share data with (https://www.gov.uk/government/publications/dfe-external-data-shares) are available.

How to contact us and how to make a complaint

Requesting your personal information from the Department for Education (https://www.gov.uk/government/publications/requesting-your-personal-information-from-dfe/requesting-your-personal-information-from-the-department-for-education#how-to-contact-us-and-how-to-make-a-complaint) has information about how you can:
- ask questions about how we use your information
- make a complaint to the Data Protection Officer and the Information Commissioner’s Office if you have concerns about how we use your personal information
How to access your personal information

You can make a request to access your personal information (https://www.gov.uk/government/publications/requesting-your-personal-information/requesting-your-personal-information) verbally or in writing.