Privacy information: education providers’ workforce, including teachers

Question 1

1. Using your data to provide funding

Accepted Answer

1.1 Using your data to fund learning, including apprenticeships

This includes funding learning in the following educational settings:

schools
academies
colleges
adult education training providers
teacher training
apprenticeships

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under section 11 of the Education Act 1996, providing funding for education.

When we use your sensitive information, this is special category data. The reason we use it is because we have a substantial public interest under article 9(2)(g) of UK GDPR, and the Education Acts 1996 and 2005 allow this. Full details about how we process special category data are given in DfE’s appropriate policy document.

Data we collect

We need enough information to work out how much funding is required. Funding is calculated based upon the numbers of learners in each educational setting and if they have needs which need additional funding.

To do this, we require information from educational settings or local authorities about learners – read privacy information: early years foundation stage to key stage 3 and privacy information: key stage 4 and 5 and adult education for details.

We also require the following information about the workforce in schools, academies, colleges or training providers:

personal contact details of employees and staff members – name, address, email address and phone numbers
IP address
Teacher Pension (TPS) number (for Music Hub organisations only)

When we use your sensitive or special category data, the reason we use it is because we have a substantial public interest under article 9(2)(g) of UK GDPR. We collect information about your:

ethnicity and gender
disability, if applicable

What we do with your data

We use the data to work out how much funding is required and to publish statistics on funding.

We use your personal information to determine whether a provider is entitled to claim funding from DfE. For example, some learning will not be eligible for state funding because the programme of learning, or perhaps an element of it, has already been achieved by the learner.

DfE uses your data:

for security purposes, we collect the IP addresses of people visiting the DfE data collection forms on our websites - for example, if we were receiving continuous direct denial of service attacks from an IP address range, we could block it
to enable users to use the service and receive updates

We will not share this information with any other parties.

We sometimes need to make personal data available to other organisations. These might include contracted partners or other organisations with which we need to share your personal data for specific purposes.

Where we need to share your personal data with others, we ensure that this data sharing complies with data protection legislation. For example, in order to assess funding applications, we may need to share your personal data with:

the National Schools Commissioner (NSC)
Regional Schools Commissioners (RSC)
DfE-funded educational experts and their teams
DfE-contracted external assessors, if appropriate

Read Using your data when we share your personal information for more details.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information:

for 7 years for funding or financial purposes
until 31 December 2034, if the learning is funded by the European Social Fund

If your personal information is included in any legal agreement classified as a Deed, we will retain it for 12 years from the point of the Deed’s expiry.

Your rights

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information from DfE for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activities:

training providers are data processors for the adult education and apprenticeship data that they send to DfE
for the National Education Nature Park and Climate Action Awards programme – their privacy notice has details

For most of the personal data that schools or multi-academy trusts collect, store and use, they are the data controller. However, where a school is required to supply a copy of some personal data to DfE, DfE also becomes an independent data controller of the copy it receives.

1.2 Using your data to fund school, academy or college buildings

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under section 11 of the Education Act 1996, providing funding for primary, secondary or further education.

Data we collect

We need enough information to work out how much funding is required for school, academy or college buildings.

We require the following information about the workforce in schools, academies or colleges:

personal contact details for the staff member

What we do with your data

We use the data to fund school, academy or college buildings and to publish statistics on funding.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for:

7 years for funding or financial purposes

If your personal information is included in any legal agreement classified as a Deed, we will retain it for 12 years from the point of the Deed’s expiry.

Your rights

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a SAR, data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read the Request your personal information from DfE for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

1.3 Using your data to ensure the protection of public funds by preventing and detecting fraud

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under section 11 of the Education Act 1996, providing funding for primary, secondary or further education.

Data we collect

We use your personal data to ensure schools, academies, colleges, sixth forms, adult education training providers and apprenticeships have received the correct funding. To do this we require information from educational settings or the local authority about learners – read privacy information: early years foundation stage to key stage 3 and privacy information: key stage 4 and 5 and adult education for details.

We also require the following information about the workforce in schools, academies, colleges or training providers:

personal contact details of employees and staff members

What we do with your data

We use your data to validate funding applications and investigate suspected fraud or financial irregularity. Read more in how ESFA handles allegations of suspected fraud or financial irregularity.

We sometimes need to make personal data available to other organisations. These might include contracted partners or other organisations with which we need to share your personal data for specific purposes.

Where we need to share your personal data with others, we ensure that this data sharing complies with data protection legislation. For example, in order to assess funding applications, we may need to share your personal data with:

the National Schools Commissioner (NSC)
Regional Schools Commissioners (RSC)
DfE-funded educational experts and their teams
DfE-contracted external assessors, if appropriate

Read Using your data when we share your personal information for more details.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information:

for 7 years for funding or financial purposes
until 31 December 2034, if the learning is funded by the European Social Fund

Your rights

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information from DfE for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

training providers are data processors for the adult education and apprenticeship data that they send to DfE

For most of the personal data schools or the multi-academy trusts collect, store and use, they are the data controller. However, where a school is required to supply a copy of some personal data to DfE, DfE also becomes an independent data controller of the copy it receives.

1.4 Using your data to process expense claims

If you submit an expense to DfE for expenses incurred while attending a DfE stakeholder or user group, advisory board, DfE research session or DfE programme, etc.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is legal obligation, under article 6(1)(c) of the UK GDPR.

Data we collect

We need enough information to process the expense claim:

your name
your bank account details
your telephone number or email address (in case of queries)

What we do with your data

We use the data to:

check, verify and validate the expense claim details.
process payments to the nominated bank account

We are also required to share this information with the National Audit Office for auditing purposes.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information:

for 7 years for funding and financial purposes
until 31 December 2034, if the expense is funded by the European Social Fund

Your rights

We are relying on legal obligation for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information from DfE for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

1.5 Using your data when you claim additional payments for teaching

These payments aim to increase the recruitment and retention of teachers. Read additional payments for teaching: eligibility and payment details.

The Teacher Payment Service Delivery System (Claim) encompasses three legacy schemes and 3 new schemes:

Teachers: claim back your student loan repayments (TSLR)
Early Career Payments (ECP)
Levelling Up Premium payments (LUP)
Teaching Retention Incentive Further Education
Early years recruitment incentives
International Relocation Payments

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under section 11 of the Education Act 1996, providing funding for primary, secondary or further education.

Data we collect

We receive your personal data directly from you when you submit it:

to claim a payment
when contacting us for support using the service
to leave feedback or for any other matters
in response to our evaluations of the effectiveness of the service

If you make a claim, we will collect your personal information including:

your name, postal address, email and your phone number when you contact us
your email address if you include it with feedback to us on the service or agree to be contacted for user research purposes
your teacher reference number (TRN) to verify your claim
we collect the IP addresses of people visiting the additional payments for teaching website for security reasons

DfE will also need additional information to process payments in accordance with the Pay As You Earn (PAYE) tax rules:

National Insurance number
bank account details
name
address
date of birth
payroll gender
passport number (international relocation payments only)

What we do with your data

DfE will use your name and personal information for the purposes of:

providing support with your claim
informing you of future opportunities to claim
evaluating the effectiveness of the service and the policy
verifying your eligibility to claim

For the purposes of paying you, this will involve sharing personal data with HMRC.

How DfE uses your data:

for security purposes, we collect the IP addresses of people visiting the additional payments for teaching website - for example, if we were receiving continuous direct denial of service attacks from an IP address range, we could block it
to enable users to use the service and receive updates

We will not share this information with any other parties.

We sometimes need to make personal data available to other organisations. These might include contracted partners (who we have employed to process your personal data on our behalf) or other organisations (with which we need to share your personal data for specific purposes).

We will check information in your application with:

the school you are currently employed to teach at
the Teaching Regulation Agency’s database of qualified teachers
Teachers’ Pensions

To process your claim we will compare the information you have provided with records kept on Teachers’ Pensions, DfE teaching records and the Teaching Regulation Agency’s database of qualified teachers. This is so we can validate your claim.

Your information is also shared with HMRC for the purposes of processing claims for student loan repayments and paying Income Tax and National Insurance contributions on your behalf. The information we share is explained to you at each stage in the application process.

Where we need to share your personal data with others, we ensure that this data sharing complies with data protection legislation.

Read when we share your personal information for more details.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for the academic year in which your claim was submitted and then securely deleted. DfE or its delivery partners will never keep your personal data longer than we need it - however, for the purpose of delivery of the service, your email address and TRN will be retained for the lifetime of the service.

Your rights

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information from DfE section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE does not use a data processor for this activity.

Question 2

2. Using your data to support teaching as a career

Accepted Answer

DfE has several services to support teaching as a career. Becoming a teacher has several services that create, share and consume data:

Publish teacher training courses (Publish)
Find postgraduate teacher training (Find)
Apply for teacher training (Apply)
Manage teacher training applications (Manage)
Register trainee teachers (Register)
Claim funding for mentor training (Claims)
Manage school placements (Placements)

DfE uses or receives data from third parties, for these services:

Database of Qualified Teachers (DQT)
Get information about schools (GIAS)

2.1 Using your data so we can support your teaching career

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under sections 10 and 11 of the Education Act 1996, to promote education.

When we use your special category data it is because we have a substantial public interest under article 9(2)(g) of UK GDPR. Full details about how we process special category data are given in the DfE appropriate policy document.

Data we collect

DfE collects and uses the following personal information:

full name
address
email
date of birth
mobile number, if applicable
National Insurance number, if applicable
TRN, if applicable

We collect and use the following special category data:

gender
nationality
equality and diversity information

What we do with your data

We use your data to process your application for training or vacancies, including visiting teachers’ programmes.

When processing candidate applications, we use it to:

send your job applications and references to providers, schools or hiring staff
manage communications between you and providers, schools or hiring staff
manage communications between providers and people who give references

When processing training opportunities, we use it to:

work out any funding you are entitled to
send your application or registration details to teacher training providers and the early career framework
record a timeline of your activity so you can review trainee progress

For all processing activities, we use it to:

get in touch if there’s a security issue concerning your data
get in touch with you and providers, schools or hiring staff about your applications or reference
analyse application and service usage data
get in touch with you to ask if you would like to participate in user research
validate TRNs
keep a record of teachers with qualified teacher status (QTS), including professional skills test outcomes
find a lost TRN
tell you about resources to help you get a teaching job

Read the Get Into Teaching privacy notice for more details.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal data for as long as you use our teaching vacancy and training services. We will keep it for no longer than 7 years after you stop using these services.

The Teaching Regulation Agency (TRA) keeps teacher records for the lifetime of a teacher. In most cases, we delete records following receipt of a valid date of death from approved sources.

Your rights

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information from DfE for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity

2.2 Using your data when undertaking early career framework (ECF) induction training

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR (General Data Protection Regulation). This allows us to process personal data when this is necessary to do our work as a government department. This is done under section 132 of the Education Act 2002, together with regulation 5 of the Education (School Teachers’ Qualifications) (England) Regulations 2003.

Data we collect

Your employer is required to organise your ECF induction training and will be required to provide this information to DfE.

DfE collects and uses the following personal information:

your contact information – name and email address
your date of birth
your teacher reference number (TRN)
your National Insurance number

What we do with your data

When processing your information, we:

send your contact details and teacher reference number (TRN) to ECF training providers
validate your teacher reference number (TRN)
work out any funding you are eligible for
contact your employer and ECF training providers about your training progression
determine the outcome of your induction
compare your data to other data we hold
get in touch if there is a security issue concerning your data

We use your data to run and improve our services. We may contact you about taking part in user research and look at any feedback you share – for example, through website surveys.

We have a data sharing agreement with ECF training providers so they can only use your data to:

process ECF registrations and applications, which may include contacting you
report your training progress and circumstances to receive appropriate contractual payments
get statistics for internal use
contact you if there is a security issue concerning your data

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for up to 6 months after we have completed processing the data.

Your rights

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

For more information, read the ICO’s guide to individual rights.

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

Read Request your personal information from DfE for more on what you are entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

When you are registered for ECF induction training, you are assigned an ECF training provider by your employer. We share your data with the chosen provider. If you change your employment to a different school, you may be required to continue your ECF induction training with a different ECF training provider. We will also share your data with that provider.

2.3 Using your data when we promote career development to you

DfE has campaigns to promote teaching opportunities, career development or learning opportunities.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is legitimate interest, under article 6(1)(f) of the UK GDPR.

Data we collect

DfE collects and uses the following personal information:

full name
address
email
mobile number, if applicable

DfE may purchase mailing lists to support these DfE campaigns.

You have the right to opt out of these messages. If you do not want to receive these messages, click on the ‘unsubscribe’ link in the email. Alternatively, let us know using our contact form and state the title of the email message.

What we do with your data

We use your personal information for inspiration campaigns that promote and encourage uptake of learning.

Read the Get Into Teaching privacy notice for more details.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 5 years from the date of the campaign.

Your rights

We are relying on legitimate interest for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to delete your personal information – this is called the ‘right to erasure’
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

You have the right to opt out of these messages. If you do not want to receive these messages, click on the ‘unsubscribe’ link in the email. Alternatively, let us know by using our contact form and state the title of the email message.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information from DfE for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

DfE uses contractors to process our communications campaigns - for example, creative agencies or PR agencies

2.4 Using your data when we create case studies about you

We write case studies to demonstrate the benefits of learning, like case studies about apprentices or their employers. DfE apprenticeship campaigns are aimed at 14 to 19-year-olds. These could be written, audio or video case studies.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is consent, under article 6(1)(a) of the UK GDPR. DfE processes your personal data in relation to filming, photography and/or audio recordings on the basis of your consent. This consent is for a specific purpose and your media will not be used for any other purpose. Should we wish to use it for a different purpose we will contact you direct and ask for your consent for the new purpose.

By signing the filming, photography and audio recordings consent form, you are agreeing that we can record, process and publish your image, words and/or voice in both printed and digital form as applicable, for the creation of internal and external promotional and follow-up communications material. This includes content that will be posted across some or all of our social media channels. Read our Social media use policy for more details.

When we use your sensitive or special category data. We use it because you have given your explicit consent under article 9(2)(a) of the UK GDPR. Full details about how we process special category data are given in the DfE appropriate policy document.

Data we collect

DfE collect and use the following personal information directly from you:

full name
address
email
mobile number

We collect and use the following special category data:

ethnicity
disability, if applicable
gender

Full details about how we process special category data are given in the DfE appropriate policy document.

What we do with your data

We use your personal information to create case studies that are used to promote apprenticeships. For example, they are published in magazines, on websites and on social media. DfE also use case studies for TV and YouTube advertisements.

We provide information, insight and engagement to influence a range of stakeholders through members’ individual experience and story of an apprenticeship.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 5 years from when you sign off the case study.

The DfE social media channels are captured by the National Archives’ Government Web Archive as a permanent record of DfE’s social media channels.

Your rights

We are relying on consent for this processing. This means you have:

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

You can ask DfE to cease publication of your image, words and/or voice on its social media channels. If you do so, DfE will not publish further social media posts featuring this content, but it is not obligated to remove or delete existing posts. The DfE social media channels are captured by the National Archives’ Government Web Archive as a permanent record of DfE’s social media communication.

If you change your mind, or you are unhappy with our use of your personal data, contact DfE and state the project or initiative name.

Further information on your rights and the ways in which your data may be used are contained in the filming, photography and audio recordings consent form.

For more information, read the ICO’s guide to individual rights.

Read Requesting your personal information from DfE for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activities:

DfE may use contractors (such as PR companies) to collect data for our case studies

2.5 Using your data when you use the Apply for Qualified Teacher Status (QTS) in England service

The Apply for qualified teacher status (QTS) service allows international teachers to check whether they might be eligible to receive qualified teacher status (QTS) in England.

If you’re eligible you can use the service to make an application to receive qualified teacher status (QTS) in England.

Purpose and lawful basis for processing

The lawful basis we rely on for the processing of your personal data is article 6(1)(e) UK General Data Protection Regulation (UK GDPR), to perform a public task carried out in the public interest as part of our function as a department.

When we use your sensitive or special category data, the reason we use it is because we have a substantial public interest (with a basis in law) under article 9(2)(g) of UK GDPR. Part 1 of Schedule 2 of the Education (School Teachers’ Qualifications) Regulations 2003 allows us to do this.

This allows us to process personal data when this is necessary to do our work as a government department.

Data collected

DfE does not collect any personal data about you when you check if you’re eligible to apply.

DfE collect and use the following personal information directly from you when you make an application for QTS in England:

given name
family name
any previous names (if required)
date of birth
email address
your work history as a teacher

We collect the following special category data:

nationality

DfE collect and use the following personal information about your referees to support the TRA obtaining work references:

referee name
referee contact email address
your name
your email address
school name, city and job role

We collect sensitive information on suitability concerns, such as any concerns raised by your referee.

What we do with your data

For the Apply for Qualified Teacher Status (QTS) in England service we use your data to:

Processing applications

Processing applications includes:

reviewing your personal data and references to make a decision about your application for QTS
reviewing any further information that we request from you, your referees or third parties
getting in touch with school leaders you’ve named and third parties to verify information (for example, to confirm details of your work history)
getting in touch if there’s a security issue concerning your data
getting in touch with you to ask if you’d like to participate in user research
analysing application and service usage data

Safeguarding and fraud

To safeguard children and detect fraudulent activity on our services, it may be necessary to share information about you with other services and teams in the Department for Education and Teaching Regulation Agency, who may share information with external organisations (including those overseas).

We may reach out to other third parties to verify or gain further information about concerns raised to us. For example, we may need to share information about you with government departments, local authorities, law enforcement agencies, or competent authorities overseas.

This list is not exhaustive, as it depends on the type of information we receive about you.

We hold suitability information (for example, concerns raised to us about the suitability of applicants to teach), this information is used to assess if you meet our criteria ‘to be eligible and suitable to teach’.

Processing references

Processing references includes:

getting in touch if there’s a security issue concerning your data
getting in touch with you to ask if you’d like to participate in user research
getting in touch with you and third parties about your reference
analysing reference and service usage data

If you’re awarded QTS

If you’re awarded qualified teacher status, you’ll be added to the database of registered teachers in England. Your data is then subject to the privacy policy of that service. This will be a permanent record.

They’ll add the following data to the database of qualified teachers:

first name
last name
date of birth
email address
details of your qualifications and training
your teacher status

Building a better QTS application process

We use some user data to improve our services. For example, we’ll look at any feedback you give us about our services so we can improve them.

We ask if you’d like to participate in research and will only contact you if you have provided us with your email address. Your participation in research will help us improve our services and policies. You do not have to participate, and choosing to participate or not will not affect your application in any way.

Getting insight to make government policy better

We’ll analyse your data to help us inform government policy around teacher recognition, recruitment and retention. When we do, we’ll anonymise your personal information so you cannot be identified.

We need to share personal data for the purpose of awarding QTS.

We share applicant data with people who can confirm their work history as a teacher, to help them identify these applicants.

The personal data we share includes:

the applicant’s name
date of birth
any identifying reference or registration numbers

We share applicant data with organisations that can validate applicant qualifications or professional standing as a teacher.

This could include relevant teaching regulators and academic awarding institutions (including universities and teacher training bodies)

The personal data we share includes:

the applicant’s name
date of birth
any identifying reference or registration numbers

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says.

We keep applicant and referee personal information for as long as we need to support education services and to maintain public confidence in the teaching profession.

All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for:

who has checked their eligibility and what outcome they got - 2 years
application form - 5 years
the database of qualified teachers - the active lifetime of a teacher
if you email us to ask us for help - 6 months
information about suitability concerns - up to 50 years

Your rights

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

We are relying on public task for this processing, this means you have:

the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
the right to ask us for copies of your personal information we have about you – this is called ‘right of access’. This is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR).
the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
the right to ask us to stop using your information – this is called ‘right to restriction of processing’, and
your ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

For more information, read the ICO’s guide to individual rights.

Read Requesting your personal information from DfE for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activities:

we share data with our data processors for the purposes of providing this service. Data protection agreements are in place with each of these processors and they’re required to comply with the UK GDPR and the DPA 2018 as data processors

2.6 Using your data when you access Register trainee teachers (Register)

DfE runs Register trainee teachers (‘Register’) for the purpose of registering trainee teachers.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under sections 10 and 11 of the Education Act 1996, to promote education.

When we use your special category data it is because we have a substantial public interest under article 9(2)(g) of UK GDPR. Full details about how we process special category data are given in the DfE appropriate policy document.

Data collected

DfE collect and use the following personal information:

name
email address
IP address

We collect and use the following special category data:

gender
nationality
equality and diversity information

Full details about how we process special category data are given in the DfE appropriate policy document.

What we do with your data

We collect your name and email address so that we can:

enable you to access the Register service
validate your role in your organisation
send important updates about the service
get in touch with you about any queries you raise
ask if you would like to take part in user research
record a timeline of your activity so that you can review trainee progress
create log files of your activity and any error messages you come across

We collect your IP address to help us make improvements to the service.

We may use your IP address to understand how you used these services If you use other digital services for which the data controller is also DfE - for example:

a member of initial teacher training (ITT) provider staff uses Manage Teacher Training Applications
a trainee uses a Get Into Teaching service while applying to become a teacher

This allows us to ensure that public funds are being spent effectively.

We share your anonymised personal data so we can analyse the ITT process, its operation and any strategic or policy related studies on behalf of DfE.

We anonymise all trainee teacher personal data if we need to share it with third parties. This is so you cannot be identified.

We will only share your anonymised data where data protection laws allow it, or there is a legal requirement to share it.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 7 years.

Your rights

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called ’right to be informed’
the right to ask us for copies of your personal information we have about you – this is called ’right of access’. This is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
the right to ask us to stop using your information – this is called ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

For more information, see the ICO’s guide to individual rights.

Requesting your personal information has more on:

what you’re entitled to ask us, or any of our executive agencies
your rights about how your information is collected and used

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor to run and improve Register trainee teachers:

we share your data with our data processors (ITT providers) for the provision of this service
we use Zendesk to manage and respond to your queries in our customer service management systems

JISC is an independent data controller. Find out more about how Jisc processes your personal data as an Independent Controller.

Question 3

3. Using your data to support learning, including apprenticeships

Accepted Answer

3.1 Using your data to create your unique learner number (ULN) and your personal learning record (PLR)

Your unique learner number (ULN) is a unique 10-digit number. Most learners aged over 14 have one and it is designed to work with your PLR as proof of your learning and achievements.

Your personal learning record (PLR) is a permanent online record of your qualifications and achievements.

The PLR includes learning that is funded by DfE. It also includes learning that is not funded by DfE, such as learning that is funded by the learner or training provider. Your training provider can send us details of this non-funded learning.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. The Education (Information About Individual Pupils) (England) Regulations 2013, Schedule 1, Part 1 and Education Act 1996 Section 537A, allows us to do this.

When we collect data on behalf of the Ministry of Justice, Section 107 of the Apprenticeships, Skills, Children and Learning Act 2009 allows us to do this.

However, to carry out these functions, the core set of mandatory pieces of information do not always enable us to confidently match learners to their records, so DfE collects the following additional information.

Data we collect

To create your PLR and ULR, we collect the following information under public task. We collect the information from schools, academies, colleges and training providers:

first name, or if more than one, each first name
surname, and former surname, if known
preferred surname
gender
date of birth
current unique pupil number, and previous unique pupil number, if applicable
unique learner number

We collect these pieces of information to distinguish between learners and verify accuracy:

email address
date of address capture
last known address
last known address county or city
school at age 16
family name at 16
unique candidate number (UCI)
place of birth
Scottish candidate number, if applicable

We collect this information for awarding organisations (the organisation that awards your qualification), to verify your data:

learner date of birth
learner gender
learner post code

What we do with your data

We use your information to create a ULN and PLR. These enable us to record your learning achievements and to enable learning/training providers to claim public funds for your learning, to provide advice and guidance for career progression, employment opportunities or next steps in learning.

More information on how to access your personal learning record is available.

We store your ULN and PLR information in the Learning Records Service (LRS).

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

The PLR is a lifetime record of achievement for all learners. As learners are unlikely to return to learning after the age of 80, all data in the LRS will be retained for a minimum of 5 years from their latest learning event, or until the individual’s 80th birthday, whichever is longer.

Your rights

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information from DfE for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a training provider that process data about learners on behalf of DfE.

For most of the personal data schools or the multi-academy trusts collect, store and use, they are the data controller. However, where a school is required to supply a copy of some personal data to DfE, DfE also becomes an independent data controller of the copy it receives.

3.2 Using your data when we create case studies about you

We write case studies to demonstrate the benefits of learning, such as case studies about teaching.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is consent, under article 6(1)(a) of the UK GDPR. DfE processes your personal data in relation to filming, photography or audio recordings on the basis of your consent. This consent is for a specific purpose and your media will not be used for any other purpose. Should we wish to use it for a different purpose, we will contact you direct and ask for your consent for the new purpose.

By signing the filming, photography and audio recordings consent form, you are agreeing that we can record, process and publish your image, words or voice in both printed and digital form as applicable, for the creation of internal and external promotional and follow-up communications material. This includes content that will be posted across some or all of our social media channels. Read our social media use policy for more details.

When we use your sensitive or special category data, the reason we use it is because you have given your explicit consent under article 9(2)(a) of the UK GDPR. Full details about how we process special category data are given in DfE’s appropriate policy document.

Data we collect

DfE collects and uses the following personal information:

full name
address
email
mobile number
date of birth

We collect and use the following special category data:

ethnicity
disability, if applicable
gender

Full details about how we process special category data are given in DfE’s appropriate policy document.

We also collect and use information about your employment and your education and learning.

What we do with your data

We use your personal information to create case studies that are used to promote teaching and that are published in magazines, on our website and on social media. DfE also uses case studies in TV and YouTube advertisements.

We use these to provide information, insight and engagement to influence a range of stakeholders through members’ individual experience and story of teaching.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 5 years from when you sign off the case study.

Your rights

We are relying on consent for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to delete your personal information – this is called the ‘right to erasure’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
rights in relation to automated decision making and profiling
the right to withdraw consent at any time (where relevant), by using our contact form
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

As we are processing your personal data with your consent, you have the right to withdraw that consent. You can withdraw your consent up until the case study is published. You can ask DfE to cease publication of your image, words or voice on its social media channels. If you do so, DfE will not publish further social media posts featuring this content, but it is not obligated to remove or delete existing posts.

If you change your mind, or you are unhappy with our use of your personal data, let us know by using our contact form and state the project or initiative name.

Further information on rights and the ways in which your data may be used are contained in the case study filming, photography and audio recordings consent form.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information from DfE for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

DfE may use contractors such as PR companies to collect data for our case studies

3.3 Using your data when you register to deliver T Levels or complete the T Level data collection or submit a Capacity and Delivery Fund (CDF) monitoring return

We will use your personal information to:

allow you to access the form on DfE sign in
send you an email confirmation on submission
enable us to contact you if there are any questions about your data or registration
provide the outcome of the registration
contact you for the purpose of providing T Level planning, industry placement or delivering T Levels support
enable key partners or contractors to contact you for evaluation purposes

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is to perform our public task under article 6(1)(e) of the UK GDPR. This is done under the Skills and Post-16 Education Act 2022.

Data collected

DfE collect and use the following personal information:

your full name (person completing the form)
email address (person completing the form)
your telephone number (person completing the form)
the organisation you work for
the name(s) of your head of organisation and T Levels or CDF lead
email address of your head of organisation and T Levels or CDF lead
telephone number of your head of organisation and T Levels or CDF lead

What we do with your data

The T Level registration data is used to:

assess eligibility to determine whether a provider can deliver T Levels
feed into T Level planning and ministerial reporting
check eligibility for planning support to prepare to deliver T Levels and T Level Foundation Year programmes

T Level data collection form data is used to:

monitor the planned delivery of T Levels and report to ministers
support you by working with employers to generate offers of industry placements in T Level and geographic areas where our providers are operating
consider whether T Level delivery funding or specialist equipment funding is available to support T Level delivery

CDF data collection is used to:

monitor CDF industry placement delivery and make decisions about funding
monitor the use of the funding to ensure it has been used for the purposes intended

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We will keep information submitted for up to 10 years past the end of the financial year in which your return was made, to support financial audit requirements.

Your rights

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of your personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
your ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

We sometimes need to make personal data available to other organisations. These might include contracted partners (who we have employed to process your personal data on our behalf) and/or other organisations (with whom we need to share your personal data for specific purposes).

We will share your information with the Association of Colleges, the Education and Training Foundation, and the Institute for Apprenticeships and Technical Education so they can provide you with information on the support packages available.

For T Level data collection, we share information on potential student take-up of individual T Levels with the Institute for Apprenticeships and Technical Education and awarding organisations.

Where we need to share your personal data with others, we ensure that this data sharing complies with data protection legislation.

Question 4

4. Using your data to get your views

Accepted Answer

4.1 Using your data to contact you for feedback

DfE measures the impact and effectiveness of each of our services, our programmes or our events to make improvements to the service we offer to you. We do this through surveys, public consultations and feedback about our help desks.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Sections 10 and 11 of the Education Act 1996 allows us to do this.

Data we collect

We collect and use the following personal information directly from you. We use the information you provide to us when you contact DfE or attend one of your programmes or events:

your full name
email address
job title
phone number
date of birth
your address

Using your data to contact you for research has more information.

What we do with your data

We use your data to make improvements to the services we offer to you.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 5 years. This is in line with the DfE retention policy for business operational data.

Your rights

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information from DfE for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

we use Arvato to provide our service desk
we may use data processors to contact you for feedback

Question 5

5. Using your data to carry out research

Accepted Answer

5.1 Using your data when we contact you for research

DfE undertakes research to learn how you interact with our services and to support our operational development and delivery. We do this research to make improvements to the services we offer to you. We will always seek your permission to take part in any research.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Section 10 of the Education Act 1996 allows us to do this.

When we use your sensitive information, this is special category data. The reason we use it is because we have a substantial public interest under article 9(2)(g) of the UK GDPR.

Data we collect

We collect and use the following personal information. We use the information you provide to us when you contact DfE, attend one of your programmes or events, or use our digital services:

your full name
email address
phone number

We may collect and use the following special category data:

demographic data, such as health or disability data or ethnic data, to identify people for the research

We may also use details of what service you’ve used or what school or organisation you work in to identify people for the research.

What we do with your data

We use your data to make improvements to the services we offer to you, and to develop policy and new services. We use your data to contact you to invite you to participate in research that is relevant to you. You are under no obligation to participate in any research we invite you to. We will not contact you about research using your data if you tell us not to. Read Using your data to gather evidence for policy development and delivery for more information on how we process your personal information during the research.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We will delete your personal information after we have used it to contact you for research, for example:

if it is a one-off processing task, such as contacting DfE service users’ data for research, we would delete the data after we have contacted you
if we have invited you to take part in an ongoing research panel, we will process your data for as long as we are contacting you for that research panel, specifying in the invite how long we will keep the data, how we will keep it accurate, and how you can request your data is deleted from that specific research panel

Your rights

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information
rights in relation to automated decision making and profiling
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read the Request your personal information for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity

5.2 Using your data to gather evidence for policy development, evaluation and delivery

DfE undertakes research to gather evidence to support our policy development and delivery. Having this evidence is important when improving outcomes for children, young people, families and adults. Read Research at DfE for more details.

DfE may also seek your professional opinion on materials in development for national curriculum assessments.

Purpose and lawful basis for processing

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Section 10 of the Education Act 1996 allows us to do this.

When we use your sensitive information, this is special category data. The reason we use it is because we have a substantial public interest under article 9(2)(g) of the UK GDPR and the Education Act 2002 allows this.

If you have agreed that we can link your survey responses to other government-held data, we are undertaking this processing with your consent under article 6(1)(a) of the UK GDPR.

Data we collect

We collect and use the following personal information directly from you:

your full name
email address
phone number
your date of birth
your address
occupation
workplace location
professional qualifications and experience

When we use your sensitive or special category data, we use it because we have a substantial public interest and you have given your ethical consent to participate in the research. As part of our research, we may need to collect information about your:

heath or disability
racial or ethnic origin
gender

We use information on gender, ethnicity and geographical location to ensure that the panels are representative of our diverse society, as far as is possible within a small group.

Full details about how we process special category data are given in DfE’s appropriate policy document.

What we do with your data

We’ll use your personal information for research that DfE undertakes to provide high-quality evidence to inform policy development and delivery.

We use information about your professional expertise and experience, where relevant to our work (for example, teaching qualifications and subjects taught), to ensure that appropriately qualified professionals take part in the review of national curriculum assessments.

Sometimes we link your survey responses to other government-held data. The lawful basis for this processing is ethical consent. At any time, you can tell us you no longer want us to link your data to other data. You can do this by using our contact form.

We may publish a summary of the research and the full research report. Your responses may be attributed to an organisation where this information has been provided, but our publications will not contain any personal data. DfE will anonymise or desensitise the data where possible.

Research reports published since May 2010 are available on GOV.UK.

Research reports published before May 2010 are available on the National Archives.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information until 12 months after the end of the survey or research. The national curriculum assessment review panel will keep your personal data as part of the assessment development expert review process for 5 years, after which it will be securely destroyed.

Read Research at DfE and Parent, pupil and learner panel omnibus surveys for more information.

Your rights

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

If you have agreed that we can link your survey responses to other government-held data, we are undertaking this processing with your consent. You have the right to withdraw that consent up until the data is analysed for the publication. If you change your mind, or you are unhappy with our use of your personal data, contact DfE and state the project or initiative name.

Further information on rights and the ways in which your data may be used are contained in the ethical consent form you will be given when you start your research.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

DfE uses contractors to work on its behalf to undertake the research - they will receive your personal data directly from you during the survey
the Programme for International Student Assessment (PISA) is an international comparison of reading, maths and science performance of 15-year-old pupils - Pearson will process your personal data to deliver the PISA 2025 study on behalf of DfE (read About PISA25 for more information)

5.3 Using your data to take part in our stakeholder or user groups

DfE has various user or stakeholder groups that enable us to receive feedback and evidence to support our policy development and delivery, as well as data developments, analysis and research findings.

Purpose and lawful basis for processing

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under section 11 of the Education Act 1996, to promote learning and education.

Data we collect

We collect and use the following personal information:

your full name
your job role
your address
email address
phone number

What we do with your data

We’ll use your personal information to manage the stakeholder and user groups, including circulating meeting invites, agendas, meeting documents and meeting minutes.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal data for 10 years, as it supports our policy making.

Your rights

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

DfE uses contractors to work on behalf of DfE to undertake the research. Our contractors will receive your personal data directly from you during the survey

5.4 Using your data to take part in our consultations

DfE holds public consultations to develop our policies, programmes and guidance.

Purpose and lawful basis for processing

The lawful basis we rely on for processing your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under section 11 of the Education Act 1996, to promote learning and education.

Data we collect

We collect and use the following personal information:

your full name
your job role
your address
email address
phone number
IP address

What we do with your data

We’ll use your personal information when gathering feedback from our public consultations.

Information provided in response to consultations, including personal information, may be subject to publication or disclosure under the Freedom of Information Act 2000, the Data Protection Act 2018 or the Environmental Information Regulations 2004.

If you want all or any part of a response to be treated as confidential, explain why in the relevant section of the consultation response.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal data for 10 years, as it supports our policy making.

Your rights

We are relying on public task for this processing. This means you have:

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

DfE uses Delib to manage our public consultations - Delib’s website enables you to provide feedback on the documents

Question 6

6. Using your data to protect learners

Accepted Answer

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. Section 11 of the Children Act 2004, section 175 of the Education Act 2002 and the Education and Inspections Act 2006 allows us to do this.

Special categories of personal data need to also be processed for reasons of substantial public interest under section 10 (3) of the DPA 2018 (Special categories of personal data) and 18 (Safeguarding of children and individuals at risk). The Education Act 2002 allows this. Full details about how we process special category data are given in DfE’s appropriate policy document.

Data we collect

DfE collects information from educational settings, local authorities, your employer and other government departments to safeguard children and adults. We collect and use the following personal information:

name, date of birth and address of the child, young person or adult
name and contact details of the person reporting or involved in the safeguarding case

We collect and use the following special category data:

characteristics (such as gender, ethnicity and disability)

We collect and use the following sensitive information:

episodes of being a child in need, if applicable
notes about the concern

Full details about how we process special category data are given in DfE’s appropriate policy document.

For further details about safeguarding children with special educational needs and disability in schools, colleges and children’s services, read children with special educational needs and disability (SEND) and special educational needs and disability (SEND) and high needs.

What we do with your data

We use your personal information to support these children, young people and adults, and to monitor their progress.

We’ll use your personal information to:

keep you or another pupil or learner safe from potential harm
identifying issues and providing support for mental and physical health issues
prevent extremism in the education system - DfE works to ensure children and young people are not exposed to extremists and extremist messages

The Teaching Regulation Agency (TRA) is an executive agency of DfE. TRA regulates the teaching profession in England and investigate cases of serious misconduct. If you are a witness or potential witness within a teacher misconduct investigation, TRA processes your information to investigate allegations of serious misconduct.

We may share your personal data with other organisations where DfE and its executive agencies are notified of an issue regarding safeguarding of children and young people.

Other people and organisations may also share personal data with DfE and its executive agencies, for example, when they make a complaint or raise a concern with us. This can include information shared in accordance with the statutory guidance keeping children safe in education and working together to safeguard children. This information will be used to investigate complaints and to ensure trusts and academies comply with the regulations (including Independent schools (Education (Independent School Standards) Regulations 2014).

Read when we share your personal information for more details.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

For safeguarding cases, we keep your personal information until you are aged 25, or 10 years after the date of the allegation, whichever is longer, and then it is reviewed.

TRA will only keep your personal data for as long as it needs to for the purpose of regulating the teaching profession - specifically up to 50 years after the closure of a case. After 50 years, it will be securely destroyed.

Your rights

We are relying on public task for this processing. This means you have:

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

Question 7

7. Using your data for learner assessments

Accepted Answer

7.1 Using your data to maintain lists of markers and coders

The DfE is responsible for the development and delivery of assessments for children in education between reception and the end of key stage 2.

DfE will collect, process and store for individuals who may be interested in providing primary assessment marking or trialling and sampling coding services.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is legitimate interest, under article 6(1)(f) of the UK GDPR.

When we use your sensitive information, this is special category data. The reason we use it is because we have a substantial public interest under article 9(2)(g) of the UK GDPR. This data is collected for equal opportunity monitoring and the Equal Opportunity Act 2010 allows this. This data is processed by Capita and the data is not shared with DfE.

Data we collect

DfE collects and uses the following personal information:

name and address
your job role
email address
date of birth
phone number
TRN
National Insurance number
bank account data

We also collect data on your recent teaching employment history, any connections you have to schools, and your qualifications and experience, where they are relevant to our work (for example, teaching qualifications and subjects taught).

Special category data processed:

gender
ethnicity
disability

Full details about how we process special category data are given in DfE’s appropriate policy document.

For markers recruited by Capita to mark key stage 2 tests, special category data, National Insurance numbers and pay and bank details are not shared with STA. The Capita Marker Privacy Notice has details.

Bank account data will only be processed by STA for services provided directly to us.

What we do with your data

We use your personal information so we can undertake marking for live primary assessments and coding for trialling and sampling. We maintain a register of individuals that have previously undertaken marking and coding services with us or our contracted partners.

We will process your data to contact you and invite you to mark, review or code our materials.

We share this data with our contracted partners that are responsible under contract to deliver marking, trialling, live national curriculum assessment services and coding services on our behalf or other organisations with which we need to share your personal data for specific purposes.

Our contracted partners will liaise with you regarding the marking and coding opportunities available.

If you enter into any agreements (for example, a temporary employment contract) with our contracted partners, the contracted partner will be the data controller for any personal data they process in connection with the services you provide to them.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

If you have not provided any services to us or our contracted partners within the previous 3 years, your personal data contained within our register will be securely destroyed. If you provide services to us or our contracted partners within a 3-year rolling period, your personal data will remain on our register.

Where you enter into an agreement to provide services to us or our contracted partners, commercial and financial information relative to those services will be retained for 7 years, after which point it will be securely destroyed.

Your rights

We are relying on legitimate interest for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to delete your personal information – this is called the ‘right to erasure’.
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. For this activity, DfE is the data controller.

7.2 Using your data to undertake pupil assessments

DfE is responsible for the development and delivery of assessments for children in education between reception and the end of key stage 2.

The assessments include:

reception baseline assessment (RBA) supported by Baseline e-Portal (BeP)
key stage 1 and key stage 2 assessments
multiplication tables check (MTC) accessed via DfE sign-in
primary literacy and phonics assessment

The KS1 and 2 assessments system has a number of users including headteachers, school staff, local authorities, multi academy trusts and key stage 2 markers, each of whom have different reasons for logging into the system.

School representatives (headteachers and staff) will use the system to provide information to STA on pupils participating in key stage 1 and key stage 2 assessments (such as test orders, where required, pupil registration and access arrangements), as well as accessing the system to view secure materials and pupil assessment results.

Key stage 2 markers can access the system to manage their user accounts and view evaluation scores for their marking work.

The National Foundation for Education Research (NFER) is contracted by DfE to deliver the reception baseline assessment (RBA) via the Baseline ePortal. NFER collect personal data for school staff in order to communicate with schools, create user accounts and organise observation visits. Further information can be found in NFER’s privacy notice Reception baseline assessment: staff data privacy notice.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. Section 87 of the Education Act 2002 allows us to do this.

Read Using your data to maintain a list of markers and coders.

Data we collect

For assessments, DfE may collect and use the following personal information:

your name
your email address
your phone number

For consultants contracted to undertake projects for teacher assessment (this includes individuals contracted directly and via the agency’s commercial partners) we use your data to keep you informed about developments within teacher assessment and moderation, and to recruit for future projects and events run by STA or contracted suppliers.

We will also use your data to contact you regarding any external moderation visits we may undertake at your local authority.

The data we collect is:

name
email address
phone number
bank account details (where expenses need to be claimed for attendance to events or payment of contracted fees)

What we do with your data

For services run by STA or organisations working for DfE under contract, we use your personal information to set up a user account and send assessment update and reminder emails to schools.

We may sometimes need to make personal data available to the modified test agency we have employed to validate modified test orders on our behalf. We ensure that this sharing complies with data protection legislation and is done securely.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 7 years.

Your rights

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activities:

processing your data for the key stage 1 and key stage 2 national curriculum assessments by our national curriculum contracted supplier
processing your data for the Baseline ePortal (BeP) – by NFER

7.3 Using your data to carry out item validation trials

STA engages with its delivery partners (trialling agencies) to carry out key stage 1 and key stage 2 item validation trials (IVT) and technical pre-tests (TPT). Both the IVT and the TPT are known as trials.

Purpose and lawful basis for processing

The legal basis for processing the personal data used and collected during the trials is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary for the exercise of a function of a government department, specifically, the requirement of the DfE to provide an effective and robust testing, assessment and moderation system to measure and monitor pupils’ progress and attainment through primary school from reception to the end of key stage 2. Section 87 of the Education Act 2002 allows us to do national curriculum assessments.

Participation in trialling for the national curriculum tests is statutory, regardless of whether the test being trialled is statutory or not. All schools drawn in the random samples are required to take part.

Data we collect

Trialling agencies will collect the following data for pupils who participate in the trials:

school names, and pupils’ names and dates of birth, which are used to cross check against pupil IDs and test data
item responses for the pupils selected to take part in the trials, to feed into analysis on test items in development and their suitability for inclusion in future national curriculum assessments

We collect special category data, this includes details about:

any access arrangements pupils may need for them to take part in the trials - this information is collected directly from the school through their secure school portal - only data that is needed to administer the tests will be collected

Trialling agencies will collect the following data for pupils who do not participate in the trials:

school names, and pupils’ names and dates of birth - this could be because a pupil is working below the overall standard of the tests, is unable to access the tests (even with the use of access arrangements) or is absent on test day

Full details about how we process special category data are given in the DfE appropriate policy document.

STA has a data sharing agreement in place to provide its trialling agencies with the selected pupils’ names, gender and date of birth and school name. The sample is selected from information already stored by DfE and which was originally provided by schools as part of the autumn census.

The trials are completed by the selected pupils, and their completed scripts are returned to suppliers for coding.

For on-screen coding, completed questions are distributed anonymously to coders, so that no coder has access to pupil data.

For paper-based coding, the test script will include only the pupil’s name.

When coding is complete, item responses for each pupil are collated by trialling agencies and submitted to STA for further analysis.

What we do with your data

STA will use the information from the trials to determine which questions are suitable, taking pupils’ background characteristics into account, for the purposes of developing appropriate tests for use nationally by other pupils in the future.

The results of the trials will not be published, and no individual school or pupil will be identified in any reports produced by STA or its trialling agencies.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

Trialling agencies (the data processor) will securely dispose of the data after 6 months, in accordance with their agreement with STA.

Your rights

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of your personal information we have about you – this is called the ‘right of access’, this is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read requesting your personal information from DfE for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf.

DfE’s trialling agencies, as data processors, are responsible for securely storing and handling any personal data required to administer the trials

Question 8

8. Using your data for education sector governance

Accepted Answer

8.1 Using your data to maintain lists of education sector contact details

DfE maintains lists of:

contact details for schools, academies, colleges, training providers, apprenticeship employers, higher education, secure units, online providers, independent schools, British schools overseas, children’s centres and children’s centres linked sites, local authority nurseries, non-maintained special schools, service children’s education and special post 16 and children’s homes
education sector contacts in local authorities
contacts for DfE programmes and services - for example, the staff wellbeing charter
safeguarding partner contacts
stakeholders, including unions, advisory boards and external bodies, such as Ofqual and Ofsted
teachers
school governors, trustees or proprietors
chief financial officer and the accounting officer for single-academy trusts, multi-academy trusts and secure single-academy trusts
honours nominations, read Privacy information relating to honours nominations for more details about the honours process

DfE publishes contact details for schools, Get Information about Schools, and a searchable list of governors and trustees.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. The Education Acts 2002 and 2011 allow this.

Data we collect

DfE collects and uses the following personal information:

name and address
job role
personal email address
phone number
date of birth, where applicable

In the case of contacts for budget forecast return, accounts return and land and buildings collection tool, we also collect individuals’ IP addresses to monitor use of the service and produce anonymised statistics to help us understand how easy our services are to use and how we can improve them. We use AppInsights software to collect information about how you use the academy trust data collections.

AppInsights processes information about:

the pages you visit on academy trust data collections
how long you spend on each academy trust data collections page
how you got to the site
what you click on while you’re visiting the site

What we do with your data

We use your personal information to ensure we have up-to-date contacts for the whole education sector in England. We use these contacts for our data collections and education sector governance.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

How long we keep your personal information for:

policy making: 10 years
teachers: TRA will only keep your personal data for as long as it needs to for the purpose of regulating the teaching profession - specifically up to 50 years after the closure of a case - and after 50 years, it will be securely destroyed. If we receive a valid date of death from Teachers’ Pensions, we will delete your record once 5 years have elapsed.

For data collected in relation to the budget forecast return, accounts return, and land and buildings collection tool, we retain these details for 12 months

Your rights

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

8.2 Using your data when we gather the fire safety survey results

DfE has a responsibility to collate data about fire safety.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is legal obligation, under article 6(1)(c) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under Regulatory Reform (Fire Safety) Order 2005 (FSO) and Fire Safety Act 2021.

Data we collect

DfE collects and uses the following personal information:

name
address
email address
job title or position

What we do with your data

DfE uses your information to review estates of state-funded providers of education to ensure they meet fire safety standards. DfE ensures there is no aluminium composite cladding on buildings used as residential accommodation for learners or on buildings above the government threshold that are used for discrete education and training. Read the Building Safety Programme for more information.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 5 years.

Your rights

We are relying on legal obligation for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling.
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

8.3 Using your data so we can support the regional advisory boards

Advisory boards use knowledge, professional expertise and experience to consider proposals brought forward under the regional director’s decision-making framework and offer advice and challenge to the regional director to inform those decisions.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under section 11 of the Education Act 1996, to promote learning.

Data we collect

We’ll use your personal information:

full name
address
email
mobile number, if applicable

What we do with your data

We use your personal information to manage the nine regional advisory boards, including circulating meeting invites, agendas, meeting documents and meeting minutes.

Membership of the regional boards is published on the advisory boards page.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal data for 10 years, as it supports our policy making.

Your rights

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

8.4 Using your data to maintain a list of teachers

DfE maintains the central list of teachers in England and provides access to it to teachers and relevant organisations.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. The Education Acts 2002 and 2011 allow this.

Data we collect

We receive your personal data from you and third parties, including:

accredited providers of initial teacher training (ITT), either directly or through Jisc (with which the Higher Education Statistics Agency (HESA) has merged)
appropriate bodies that quality assure the early career teacher (ECT) induction process
approved providers of mandatory qualifications for specialist teachers
approved providers of national professional qualifications (NPQs)
Teachers’ Pensions
Disclosure and Barring Service (DBS)
other teaching regulators, including the General Teaching Council for Scotland (GTCS), General Teaching Council for Northern Ireland (GTCNI), the Teaching Council Ireland and Education Workforce Council (EWC)

We hold and process personal data to support the delivery of our functions, which support education services and help to maintain public confidence in the teaching profession.

DfE collects and uses the following personal information:

personal identifiers (name, date of birth, National Insurance number, TRN)
contact information (email address, telephone number)
teacher status (QTS or early years teacher status (EYTS), induction status, ITT result)
qualifications (previous degrees)
supplementary teaching qualifications (mandatory qualifications, NPQs) – read the section on NPQs
decisions in relation to teaching in England (decisions, prohibitions, restrictions or sanctions)
employment details (current employer)

If you undertook a course of ITT or a period of statutory induction prior to 2013, we may retain an electronic copy of paper records of any decisions in relation to these activities for historical enquiries. If you undertook professional skills tests between 2001 and 2020 and went on to become a teacher, never became a teacher, or have subsequently left teaching, we retain electronic evidence recording the outcome of that test for historical enquiries.

What we do with your data

We use your personal information to ensure we have up-to-date contacts for the whole education sector in England.

We use your personal data to build and maintain a permanent central record of teachers in England. This allows us to award you QTS or EYTS and confirm you have passed induction.

The Access your teaching qualifications service provides teachers and other relevant persons with access to their qualification data held on our system. DfE’s identity account service allows teachers and other relevant persons to update their personal details within their personal records.

We also use this data for workforce analysis and administration – for example, to assist the management of funding initiatives and to support the delivery of training and development programmes.

We may also use your data when analysing activity within our services. Your contact details are used by us, or organisations acting on our behalf, to support our work, including, but not limited to, communication exercises in relation to your ITT and ECT induction period, and the administration of the Teachers’ Pensions scheme.

We may also use your personal data to contact you for research purposes. Your participation in research or survey activity is entirely voluntary, and your personal data will remain secure and confidential.

We sometimes need to make personal data available to other organisations, where the law allows it or where there is a legal requirement. We share this data through secure services and via department helpdesks, who may discuss your information either directly with you or with other approved third parties by email. We ensure this sharing complies with data protection legislation. Not all your personal data is shared with every third party.

Employers within the education sector and organisations involved with the delivery of education services – we share personal data with these organisations (including schools, colleges, nurseries, local authorities, teacher supply agencies and Ofsted). This allows these organisations to check an individual is suitably qualified and has no restrictions against them in relation to teaching in England. This is compliant with Education Acts 2002 and 2011.

Approved providers and appropriate bodies – we share personal information with:

ITT providers (school-centred ITT providers and higher education institutions that provide courses that lead to the award of QTS and EYTS) to document your ITT outcome
appropriate bodies who quality assure the ECT induction process (and any third parties they use to manage statutory induction data on their behalf)
mandatory qualifications for specialist teachers’ providers
NPQ providers

This is compliant with Education Acts 2002 and 2011.

Teachers’ Pensions – we share personal data with Teachers’ Pensions to support the accurate administration of the teaching workforce pension scheme. Teachers’ Pensions share personal data with DfE to support accurate record keeping of the central list of teachers.

Disclosure and Barring Service (DBS) – we may need to share personal data with DBS to safeguard children, young people and adults. This is compliant with Section 45 and 46 of the Safeguarding and Vulnerable Groups Act 2006.

Other teaching regulators – we may share personal data with other teaching regulators so they can regulate the whole education sector. This includes, but is not limited to the:

Education Workforce Council (EWC)
General Teaching Council for Northern Ireland (GTCNI)
General Teaching Council for Scotland (GTCS)
Teaching Council Ireland

This is compliant with Schedule 2 Paragraph 6 of the Data Protection Act.

Professional regulators in countries other than England, Wales, Scotland and Northern Ireland - we share personal data with professional regulators in other countries so they can confirm an individual’s eligibility to teach when they apply to have their professional standing in England recognised in that country and identify if they are subject to a decision in relation to teaching in England. This is compliant with Education Acts 2002 and 2011.

Relevant law enforcement bodies – we share personal data with the National Crime Agency and the police to promote employer safeguarding of children within the education system. This is compliant with section 31 of the Data Protection Act 2018.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We maintain the electronic archives of:

QTS and induction outcomes for 45 years
professional skills tests outcomes for 80 years

If you applied for professional recognition prior to 31 January 2023, we may also retain your application alongside your teacher record. If you unsuccessfully applied for professional recognition, we will maintain your application in full for one year, from the point of decline. After one year, we remove your contact data and full name to anonymise your application.

Where, in the course of maintaining the list of teachers, we share your data with you, or other parties, through email, it is retained within a third-party correspondence management system and Microsoft Outlook for a period of 6 months. We reserve the ability to retain specific correspondence for longer where there is a business need to (for example, contentious cases).

From 26 May 2023, we closed our telephone helpdesk. If you contacted us prior to this date, your call would have been recorded and securely saved for training and monitoring purposes. These recordings are permanently deleted after 12 months. We reserve the ability to retain specific telephone enquiries for longer where there is a business need to (for example, contentious cases).

Your rights

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

8.5 Using your data to maintain lists of prohibited or sanctioned teachers

DfE maintains list of prohibited and sanctioned teachers.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. The Education Acts 2002 and 2011 allow this.

When we use your sensitive information, this is special category data. The reason we use it is because we have a substantial public interest under article 9(2)(g) of the UK GDPR, and the Education Acts 2002 and 2011 allow this. Full details about how we process special category data are given in DfE’s appropriate policy document.

Data we collect

DfE collects and uses the following personal information:

your full name
address
your job role
email address
telephone number
TRN
date of birth
National Insurance number

We collect and use the following special category data:

characteristics (such as gender, ethnicity and disability)
notes about the concern – this may include health information or information about criminal activities

Full details about how we process special category data are given in DfE’s appropriate policy document.

What we do with your data

We use your personal information to ensure we have up-to-date contacts for the whole education sector in England. The Secretary of State for Education must keep a list of all persons who are prohibited from teaching.

We sometimes need to make personal data available to other organisations where the law allows it, or where there is a legal requirement. We share this data through secure services and via department helpdesks, who may discuss your information either directly with you or with other approved third parties by email. We ensure this sharing complies with data protection legislation. Not all your personal data is shared with every third party.

Employers within the education sector and organisations involved with the delivery of education services - we share personal data with these organisations (including schools, colleges, nurseries, local authorities, teacher supply agencies and Ofsted). This allows these organisations to check an individual is suitably qualified and has no restrictions against them in relation to teaching in England. This is compliant with Education Acts 2002 and 2011.

Disclosure and Barring Service (DBS) - we may need to share personal data with DBS to safeguard children, young people and adults. This is compliant with Section 45 and 46 of the Safeguarding and Vulnerable Groups Act 2006.

Relevant law enforcement bodies - we share personal data with the National Crime Agency and the police to promote employer safeguarding of children, young people and adults. within the education system. This is compliant with section 31 of the Data Protection Act 2018.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We hold information on the teaching workforce, and those with restrictions placed upon them, to support education services and to maintain public confidence in the teaching profession. Your personal data are therefore held for the active lifetime of a teacher.

How long we keep your personal information for:

policy making: 10 years
teachers: TRA will only keep your personal data for as long as it needs to for the purpose of regulating the teaching profession - specifically up to 50 years after the closure of a case - and after 50 years, it will be securely destroyed. We will delete your record once 5 years has elapsed after a valid date of death is received from Teachers’ Pensions

Your rights

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

8.6 Using your data to investigate teacher misconduct

The Teaching Regulation Agency (TRA) is an executive agency of DfE investigates cases of serious misconduct and decides whether to refer a case to a professional conduct.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. The Education Acts of 2002 and 2011 allows this.

When we use your sensitive information, this is special category data. The reason we use it is because we have a substantial public interest under article 9(2)(g) of the UK GDPR, and the Education Acts 2002 and 2011 allow this.

Data we collect

We receive your personal data from you, including referrals on our:

digital services, including Report serious misconduct by a teacher, and
third parties, including employers or supply agencies, police forces, the Disclosure and Barring Service (DBS) and members of the public

We process this information to regulate the teaching profession by investigating allegations of serious misconduct.

DfE collects and uses the following personal information:

personal identifiers (name, date of birth, email address, home address, telephone number, National Insurance number, TRN)
contact information (home address, email address, telephone number)
teacher status (QTS or EYTS, induction status, ITT result)
qualifications (previous degrees)
supplementary teaching qualifications (mandatory qualifications, national professional qualifications)
employment details (current or previous employer)
financial details (for expense purposes, if applicable)

We collect and use the following special category data:

your racial or ethnic origin
your political opinions
your religious beliefs or other beliefs of a similar nature
whether you are a member of a trade union
your physical or mental health
your sexual orientation
the commission or alleged commission of any offence by you, i.e. details of the allegation
any proceedings for any offence committed, or alleged to have been committed, by you, the disposal of such proceedings or the sentence of any court in such proceeding

Full details about how we process special category data are given in DfE’s appropriate policy document.

What we do with your data

As a teacher, witness or potential witness within a teacher misconduct investigation, or a person making an allegation, we receive your personal data from you and third parties including:

employers or supply agencies
police forces
the Disclosure and Barring Service (DBS)
members of the public.

We process this information to regulate the teaching profession by investigating allegations of serious misconduct.

We sometimes need to make personal data available to other organisations. This also includes contracted partners.

Where we need to share your personal data with others, we comply with data protection legislation.

Accused teacher and their employer - if there is an investigation, we tell them the name of the person who made the referral and details of their allegation. If there is no investigation, we do not share any information. If the teacher makes a subject access request, we give details of the allegation but not the name of the referrer, unless the referral came from an organisation, when we give the name of the referring organisation. This is compliant with Education Acts 2002 and 2011.

Legal firms - we hold contracts with legal firms to process your personal data on our behalf. They process the data we provide to gather information to support misconduct investigations and hearings. Some legal firms will also review this data to provide impartial legal advice during misconduct hearings. This is compliant with Education Acts 2002 and 2011.

Professional conduct panels - we appoint independent panel members who sit on professional conduct panels to consider cases of serious misconduct and they may make recommendations on prohibition to the Secretary of State. They need this information to fulfil this role. This is compliant with Education Acts 2002 and 2011.

Published decisions - we will publish your personal data within a decision document on GOV.UK if a finding of serious misconduct is made. This is accessible by members of the public. This is compliant with section 15 of the Teachers’ Disciplinary (England) Regulations 2012 and section 141c of the Education Act 2002 (updated).

DBS and other organisations - we may need to share your personal data with DBS and other organisations (including, but not limited to, local authority organisations and employers) to safeguard children, young people and adults. This is compliant with Section 45 of the Safeguarding and Vulnerable Groups Act 2006.

Police - we may need to share your personal data with the police and the police share information with DfE so we can fulfil our statutory roles. This is compliant with section 31 of the Data Protection Act 2018.

Other teaching regulators - we may need to share your personal data with other teaching regulators so they can regulate the whole education sector. This includes, but is not limited to the:

General Teaching Council Scotland (GTCS)
General Teaching Council Northern Ireland (GTCNI)
Teaching Council Ireland (TCI)
Education Workforce Council (EWC)

This is compliant with Schedule 2 Paragraph 6 of the Data Protection Act.

Our finance team - if applicable, we may need to share your financial details with our finance team to pay any expense claims you make.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We hold information on the teaching workforce, and those with restrictions placed upon them, to support education services and to maintain public confidence in the teaching profession. Your personal data is therefore held for the active lifetime of a teacher.

We keep your personal information for as long as we need to for the purpose of regulating the teaching profession, specifically up to 50 years after the closure of a case. After 50 years it will be securely destroyed.

Your rights

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity

8.7 Using your data when you register for an NPQ

National professional qualifications (NPQ) are funded professional development courses for teachers and leaders who want to develop skills, progress their career and improve outcome school outcomes. Read National professional qualification (NPQ) courses for more details.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under section 132 of the Education Act 2002, together with regulation 5 of the Education (School Teachers’ Qualifications) (England) Regulations 2003.

Data we collect

DfE collects and uses the following personal information:

your contact information – name, phone number, email address, date of birth
your TRN
your National Insurance number
where you work and what your role is
the institution that awarded your QTS

What we do with your data

When processing NPQ registrations, we:

send your registration details to NPQ providers
validate your TRN
work out any funding you’re eligible for
get in touch with you and NPQ providers about your NPQ registration
determine the NPQ outcomes
compare your data to other data we hold
get in touch if there’s a security issue concerning your data

We use your data to run and improve our services. We may contact you about taking part in user research and look at any feedback you share - for example, through website surveys.

We have a data sharing agreement with NPQ providers so they can only use your data to:

process NPQ registrations and applications, which may include contacting you
get statistics for internal use
get in touch with you if there’s a security issue concerning your data

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for up to 6 months after completion of the processing of the data.

Your rights

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

When you register for an NPQ you’re asked to choose an NPQ provider. We share your data with your chosen provider.

Question 9

9. Using your data when you contact us

Accepted Answer

9.1 Using your data to make an enquiry

We collect, process and store your personal data when you contact the department, by the DfE contact us form, the Customer help portal, telephone, email, message or live chat. In addition, telephone calls to our helplines may be recorded for training and monitoring purposes. If provided, we will also use your email address to send a customer satisfaction survey.

We use this information to resolve your enquiry, to progress a follow up enquiry or to action a request, as appropriate. It is also used to ensure our call agents are appropriately trained and to enable us to continually improve the quality of the service provided.

Read using your data when you make a complaint about education providers, children’s social care or DfE.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department.

Data we collect

DfE collects and uses the following personal information directly from you:

your full name
email address
details about your enquiry or compliant
IP address

The following information may also be collected and processed:

job title
school name, local authority name, academy trust name or organisation name
school DfE number, local authority number or academy trust number

If your enquiry is about a pupil, the following data may also be collected and processed:

unique pupil number
date of birth
initials

What we do with your data

We need information from you to investigate your complaint or enquiry properly.

We use the IP address to detect and block malicious visitors to our websites.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 7 years from the date of the enquiry or complaint.

Your rights

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

9.2 Using your data to use our websites

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department.

Data we collect

DfE websites use cookies to collect information from you about how you use this website. The section on cookies has more details.

DfE websites use Google Analytics, Hotjar or Microsoft Clarity. We do not collect or store your personal information through these tools, so it cannot be used to identify who you are.

You can find out which cookies are used in the footer section of each website.

What we do with your data

We use your personal information to:

ensure we present our website content in the best way for you
allow you to take part in the interactive features of our service, when you choose to do so

Read Using your data when you sign up to our notifications for more information on when we use your data to:

notify you about changes to our website or services
provide you with information or services that you request from us or which may interest you

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

Your personal information is retained for up to 2 years. Read Details about cookies on GOV.UK for more information.

If you create an account on our websites or sign up for an alert your personal information is kept as long as you have an account. If you delete your account or cancel your alert, your data will also be deleted. Read Using your data when you sign up to our notifications for more information.

Your rights

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

we use Google Analytics cookies and a real user monitoring (RUM) cookie from SpeedCurve to collect information about how you use GOV.UK

We use social media to share news and views with people working in:

schools
colleges
local authorities
children’s services

We also use social media to communicate with parents, children and young people.

Read our Social media use policy for more details.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is consent under article 6(1)(a) of the UK GDPR – this is when we ask your consent to use your information.

Data we collect

When you interact with our social media channels we collect and use:

your name

What we do with your data

When you use our websites and social media channels, we use your personal information to:

allow you to take part in interactive features of our service, when you choose to do so
ensure we present our website content in the best way for you
provide you with information or services that you request from us or which may interest you - we always get your consent when you request these DfE services
notify you about changes to our website or services

Read the section on cookies for more details.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

DfE social media channels are captured by the National Archives as a permanent record of DfE’s social media communication.

Your personal information is retained for up to 2 years, read the Details about cookies on GOV.UK page for more information.

Your rights

We are relying on consent for this processing. This means you have:

As we are processing your personal data with your consent, you have the right to:

withdraw consent at any time, by using our contact form
ask DfE to cease publication of your image, words or voice on its social media channels

If you do so, DfE will not publish further social media posts featuring this content, but it is not obligated to remove or delete existing posts. DfE social media channels are captured by the National Archives as a permanent record of DfE’s social media communication

If you change your mind, or you are unhappy with our use of your personal data, contact DfE and state the project or initiative name.

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

we use Google Analytics cookies and a real user monitoring (RUM) cookie from SpeedCurve to collect information about how you use GOV.UK

You can sign up for notifications, such as about teaching as a career, our events or our services and work.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is consent under article 6(1)(a) of the UK GDPR – this is when we ask your consent to use your information. At any time, you can tell us you no longer want us to use it. You can do this by using our online contact form.

Data we collect

DfE collects and uses the following personal information:

first name and surname
your job role
establishment name
email address (where you want to receive the communication)

What we do with your data

We’ll use your personal information to enable you to sign up to specific messages, such as when promoting apprenticeships or our careers service, or to invite you to events, etc.

Your rights

We are relying on consent for this processing. This means you have:

As we are processing your personal data with your consent, you have the right to withdraw that consent. If you change your mind, or you are unhappy with our use of your personal data, contact us and state the project or initiative name.

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

9.5 Using your data when you attend our events or webinars

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is consent under article 6(1)(a) of the UK GDPR – this is when we ask your consent to use your information. At any time, you can tell us you no longer want us to use it. You can do this by using our DfE contact form.

Data we collect

DfE collects and uses the following personal information:

first name and surname
your job role
establishment name
email address or telephone number (where you want to receive communication about the event or webinar)
IP address (if applicable)

What we do with your data

We use your email address to provide you with the event details. This will include information about any recording taking place. For recorded events, we will also email you a link to the recording once the event has concluded.

For some events, we may publish the recording on our website or YouTube channels so this is accessible to a wider audience. If an event recording will be published, we will always notify you before the event.

We don’t publish delegate lists for event or webinars, but your name and email address may be visible to others in attendance during the event.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 5 years after the event.

Your rights

We are relying on consent for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to delete your personal information – this is called the ‘right to erasure’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling
the right to withdraw consent at any time, by using our DfE contact form
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

As we are processing your personal data with your consent, you have the right to withdraw that consent. You can withdraw your consent up until the webinar recording is published. If you change your mind, or you are unhappy with our use of your personal data, contact us and state the name of the event or webinar.

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

to help organise our events – the details of the organiser of the event is provided in the sign-up email

9.6 Using your data when you make a complaint about education providers, children’s social care or DfE

DfE processes your data when you make a complaint about a school, a college, an early year’s provider, a children’s social care service or DfE. Our Complaints procedure page has more information.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department.

DfE considers complaints about schools and education settings on behalf of the Secretary of State for Education, whose duties in relation to complaints about academies are set out in their funding agreements. Duties in relation to maintained schools are set out under sections 496 and 497 of the Education Act 1996.

Data collected

DfE collect and use the following personal information:

your full name
email and postal address
telephone number
details about your enquiry or complaint
information held by third parties, such as schools, colleges and local authorities

We collect and use sensitive data, including details about:

safeguarding and child protection matters
special educational needs assessments
medical details

Full details about how we process special category data are available in the DfE appropriate policy document.

What we do with your data

We need information from you and, potentially, other third parties to consider your complaint.

Before we consider a complaint, we may need documentary evidence that the complaints procedure has been completed in full, which we usually ask the complainant to provide.

Depending on the nature of the complaint, we may then need additional documentation, such as CPOMS records or statements from staff and other pupils. We may contact the school, an early years provider, a children’s social care service or other local authority department to provide this information.

Schools have a legal duty to provide this information to the Secretary of State for Education under section 538 of the Education Act 1996. Local authorities have a legal duty to provide this information to the Secretary of State for Education under section 29(1) of the Education Act 1996.

DfE may also share your data under public task with:

Ofsted, local authorities or police and criminal investigation authorities, through court orders – to safeguard and promote welfare of children in the UK

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 10 years.

Your rights

We are relying on public task for this processing. This means you have:

For more information, read the ICO’s guide to individual rights.

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

Read requesting your personal information from DfE for more information on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

9.7 Using your data when you make a referral of serious teacher misconduct to the Teaching Regulation Agency (TRA)

The Department for Education (DfE) has processes in place that enable anyone to complain about a teacher. Separately, DfE, through the TRA, has a process to consider allegations of serious misconduct by a teacher.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under the Education Acts of 2002 and 2011.

When we use your sensitive information, this is special category data. The reason we use it is because we have a substantial public interest under article 9(2)(g) of the UK GDPR, and the Education Acts 2002 and 2011 allow this.

Data collected

DfE collect and use the following personal information:

We receive your personal data from you when you use this service and from third parties including:

employers or supply agencies
police forces
the Disclosure and Barring Service (DBS)
members of the public
other professionals, such as a local authority designated officer (LADO)

We process this information to regulate the teaching profession by investigating allegations of serious misconduct.

DfE collects and uses the following personal information:

personal identifiers (name, date of birth, email address, home address, telephone number, National Insurance number, TRN)
contact information (home address, email address, telephone number)
teacher status (QTS or EYTS, induction status, ITT result)
qualifications (previous degrees)
supplementary teaching qualifications (mandatory qualifications, national professional qualifications)
employment details (current or previous employer)
financial details (for expense purposes, if applicable)

We collect and use special category data, this includes details about:

your racial or ethnic origin
your political opinions
your religious beliefs or other beliefs of a similar nature
whether you are a member of a trade union
your physical or mental health
your sexual orientation
the commission or alleged commission of any offence by you – for example, details of the allegation
any proceedings for any offence committed or alleged to have been committed by you, the disposal of such proceedings, or the sentence of any court in such proceeding

Full details about how we process special category data are available in the DfE appropriate policy document.

What we do with your data

As a teacher, witness or potential witness within a teacher misconduct investigation, or a person making an allegation, we receive your personal data from you and third parties including employers or supply agencies, police forces, the Disclosure and Barring Service (DBS) and members of the public. We process this information to regulate the teaching profession by investigating allegations of serious misconduct.

We sometimes need to make personal data available to other organisations. This also includes contracted partners.

Where we need to share your personal data with others, we comply with data protection legislation.

Teachers who are subject to an investigation and their employer

If there is an investigation, we tell them the name of the person who made the referral and details of their allegation. If there is no investigation, we tell the teacher that there has been an allegation, but we do not share your personal data. If the teacher makes a subject access request, we give details of the allegation but not the name of the referrer, unless the referral came from an organisation, when we give the name of the referring organisation. This is compliant with Education Acts 2002 and 2011.

Legal firms

If there is an investigation, legal firms we hold contracts with will process your personal data on our behalf. They process the data we provide to gather information to support misconduct investigations and hearings. Some legal firms will also review this data to provide impartial legal advice during misconduct hearings. This is compliant with Education Acts 2002 and 2011.

Professional conduct panels

We appoint independent panel members who sit on professional conduct panels to consider cases of serious misconduct and they may make recommendations on prohibition to the Secretary of State. They need this information to fulfil this role. This is compliant with Education Acts 2002 and 2011.

Published decisions

We will publish the teacher’s personal data within a decision document on GOV.UK if a finding of serious misconduct is made. We will not publish the referrer’s data. This is accessible by members of the public. This is compliant with Regulations 8 & 15 of the Teachers’ Disciplinary (England) Regulations 2012 and section 141C of the Education Act 2002 (updated).

DBS and other organisations

We may need to share your personal data with DBS and other organisations (including, but not limited to, local authority organisations and employers) to safeguard children, young people and adults. This is compliant with Section 45 of the Safeguarding and Vulnerable Groups Act 2006.

Police

We may need to share your personal data with the police and the police share information with DfE so we can fulfil our statutory roles. This is compliant with section 31 of the Data Protection Act 2018.

Other teaching regulators

We may need to share your personal data with other teaching regulators so they can regulate the whole education sector. This includes but is not limited to the:

General Teaching Council Scotland (GTCS)
General Teaching Council Northern Ireland (GTCNI)
Teaching Council Ireland (TCI)
Education Workforce Council (EWC)

This is compliant with Schedule 2 Paragraph 6 of the Data Protection Act.

If applicable, we may need to share your financial details with our finance team to pay any expense claims you make.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for up to 50 years after the closure of a case. After 50 years, it will be securely destroyed.

Your rights

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of your personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
your ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

For more information, read the ICO’s guide to individual rights.

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

Requesting your personal information has more information on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

Question 10

10. Using your data when we contact you

Accepted Answer

You can sign up for notifications, such as about teaching as a career, our events or our services and work.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is consent under article 6(1)(a) of the UK GDPR – this is when we ask your consent to use your information. At any time, you can tell us you no longer want us to use it. You can do this by using our DfE contact form.

Data we collect

DfE collects and uses the following personal information:

first name and surname
your job role
establishment name
email address (where you want to receive the communication)

What we do with your data

We’ll use your personal information to enable you to sign up to specific messages, such as when promoting apprenticeships or our careers service, or to invite you to events, etc.

Read Get Into Teaching privacy notice for more details.

Your rights

We are relying on consent for this processing. This means you have:

As we are processing your personal data with your consent, you have the right to withdraw that consent. If you change your mind, or you are unhappy with our use of your personal data, contact us and state the project or initiative name.

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

10.2 Using your data when we send you messages about administering learning, including qualifications or exams

DfE will send out messages relating to the administration of examinations, or qualifications, or funding requirements. These are public service messages - read the ICO website for more details.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under section 10 and 11 of the Education Act 1996, promoting education and providing funding for primary, secondary or further education.

Data we collect

DfE collects and uses the following personal information:

first name and surname
your job role
establishment name and address
email address (where you want to receive the communication)

What we do with your data

We’ll use your personal information to send you specific public messages, such as when promoting teaching as a career, or reminders to submit data to DfE, etc.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for as long as you are the contact for the educational setting.

Your rights

We are relying on public task for this processing. This means you have:

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activity:

DfE uses contractors to work on behalf of DfE - for example, Netbuilder (Marketo), Parkhouse Agency (for mailing list purchases), and creative agencies and PR agencies

10.3 Using your data when we send you messages about education issues

DfE will send you messages by email on key education issues or if there is a problem. Messages include ‘for action’ or ‘service notifications’ messages, news and developments, ‘for information’ messages, and details of events. Updates are for people working in early years, children’s social care, schools or further education.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is consent under article 6(1)(a) of the UK GDPR – this is when we ask your consent to use your information.

At any time, you can tell us you no longer want us to use it. You can do this by using our DfE contact form.

Data we collect

DfE collects and uses the following personal information:

first name and surname
your job role
establishment name
email address (where you want to receive the communication)

What we do with your data

We’ll use your personal information to enable you to sign up to receive specific messages, such as when promoting apprenticeships or our careers service, or to invite you to events, etc.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for as long as you are signed up to our notifications and alerts.

If you create an account on our websites or sign up for an alert, your personal information is kept as long as you have an account. If you delete your account or cancel your alert, your data will also be deleted.

You can unsubscribe from our emails at any time on the manage your GOV.UK email subscriptions page. You can also use the ‘unsubscribe’ or ‘change your email preferences’ links in the emails you get from GOV.UK.

Your rights

We are relying on consent for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of personal information we have about you – this is called the ‘right of access’ and is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to delete your personal information – this is called the ‘right to erasure’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
rights in relation to automated decision making and profiling
the right to withdraw consent at any time, by using our DfE contact form
the right to complain to the Information Commissioner (ICO) if you feel we have not used your information in the right way

As we are processing your personal data with your consent, you have the right to withdraw that consent. If you change your mind, or you are unhappy with our use of your personal data, contact us and state the project or initiative name.

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

Question 11

11. Using your data when you use DfE Sign-In

Accepted Answer

DfE Sign-in is how schools and other education organisations access DfE online services. Read the DfE Sign-In page for details of the DfE services that use DfE Sign-In.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. The legislation to support this is Section 8 of the Data Protection Act 2018 – exercising official authority as part of public body tasks and DfE functions.

Data we collect

DfE collect and use the following personal information directly from you:

your first name and last name
the email address you provide
the organisation details the account is linked to

What we do with your data

We use the data to allow you access to DfE online services.

Occasionally, DfE will contact users on the email address provided with essential information about DfE Sign-in.

We may share your information where the law allows, or where we have a legal obligation to do so.

For Ofsted users, we regularly share your details with Ofsted for monitoring purposes.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 6 years from the date on which an individual deactivates or deletes their account.

Your rights

We are relying on public task for this processing. This means you have:

the right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’
the right to ask us for copies of your personal information we have about you – this is called the ‘right of access’. This is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
the right to ask us to stop using your information – this is called the ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Requesting your personal information from DfE for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. We do not use any data processors for this processing activity.

Question 12

12. Using your data to administer the Department for Education’s Risk Protection Arrangement

Accepted Answer

12.1 Using your data for the RPA Risk Management Services

The DfE Risk Protection Arrangement (RPA) is an alternative to commercial insurance for schools, which is an initiative that seeks to help public sector schools achieve savings on their non-staff spend.

The aim of the RPA Risk Management Services is to support the effective management of the DfE Risk Protection Arrangement for the benefit of RPA Members. This includes providing resources and opportunities for RPA Members to improve their risk management knowledge and practices, with a view to reducing risk exposure and the number of RPA claims raised.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under section 11 of the Education Act 2002.

Data collected

DfE collect and use the following personal information:

your name and job title
your email address and phone number
your internet protocol (IP) address.
your organisation’s details, including postal address, phone number and email address
any other necessary personal data required to be able to effectively deliver the RPA Risk Management Services

What we do with your data

We collect and process your personal information to support the effective management and delivery of the DfE Risk Protection Arrangement for the benefit of RPA Members, for example:

to provide resources and opportunities for RPA Members to improve their risk management knowledge and practices, with a view to reducing risk exposure and the number of RPA claims raised
to gather information about the risks you, or your RPA Member school, face or require more support on
to help inform where RPA Risk Management Services resources should be focused
to monitor customer satisfaction, identify best practice and gain insight to help inform the strategic direction of the RPA

If the law allows it, we might share your personal information with other parts of DfE including the Education and Skills Funding Agency (ESFA), and with other government departments.

We will share your personal information with:

organisations who work for ESFA or DfE under contract
organisations that request information to help prevent and detect crime or fraud

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 10 years then we review the data. DfE will identify if we are required by law to retain the data for longer periods, for example for crime or fraud cases. If we no longer need the data, we will delete it.

Your rights

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

We are relying on public task for this processing. This means you have:

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor to:

issue communications and information relating to risks or risk management
conduct risk surveys and track/follow up on queries, concerns identified
arrange and conduct risk audits, and track and follow up on risks, issues, concerns identified
provide risk help, advice and support through services such as the RPA Helpdesk, and the provision of RPA Risk Workshops, RPA Risk Management Tools, Resources and Learning Modules
provide support and advice to DfE to inform and contribute to the strategic management of RPA

12.3 Using your data for RPA claims handling services

DfE’s risk protection arrangement is an alternative to commercial insurance for schools, and an initiative that seeks to help public sector schools achieve savings on their non-staff spend.

The aim of RPA claims handling services is to support the effective management of the DfE risk protection arrangement for the benefit of RPA members. This includes processing RPA member claims to an appropriate conclusion.

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is legitimate interest, under article 6(1)(f) of the UK GDPR. The special category data is processed under article 9 (2)(g) UK GDPR, substantial public interest.

Data collected

We receive your personal data from RPA claims you raise as an RPA member or RPA claims that you make against an RPA member.

We also receive personal data of yours due to your involvement in the investigation and resolution of RPA claims – for example, as:

a witness
third parties acting on behalf of a claimant
a legal representative
loss adjusters
valuation experts
suppliers involved in processing the claim on our behalf via our claims handling supplier

DfE collect and use the following personal information:

names of people involved in the claim (which can include children)
personal addresses
telephone numbers
date of birth
bank account details
the extent of damage (which could include injury to children or adults and medical reports)
car registration numbers
solicitor names, telephone numbers, addresses
names and contact numbers of others involved in helping bring the claim to a resolution such as loss adjusters, school project managers, suppliers involved in property reinstatement
any other necessary personal data required to be able to process the claims to resolution

We collect and use special category data. This includes details about the extent of damage (which could include injury to children or adults and medical reports).

Full details about how we process special category data are given in the DfE appropriate policy document.

What we do with your data

The RPA claims handling service uses your personal data to ensure claims that fall within the RPA membership rules are professionally processed and resolved for RPA members.

We sometimes need to make personal data available to other organisations. These might include contracted partners (who we have employed to process your personal data on our behalf) and/or other organisations (with whom we need to share your personal data for specific purposes).

Where we need to share your personal data with others, we ensure that this data sharing complies with data protection legislation. For this project, we will share personal data with:

our claims handling supplier
the supply chain involved in the investigation or resolution of the RPA claim
supporting delivery partners of the RPA service as required, which include but are not limited to risk management, actuarial and research support services

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 10 years then we review the data. DfE will identify if we are required by law to retain the data for longer periods – for example, for crime or fraud cases. If we no longer need the data, we will delete it.

Your rights

We are relying on legitimate interest for this processing. This means you have:

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, see the ICO’s guide to individual rights.

See Requesting your personal information for more on:

what you’re entitled to ask us, or any of our executive agencies
your rights about how your information is collected and used

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the RPA claims handling services.

Question 13

13. Using your data to check our IT systems

Accepted Answer

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is legitimate interest, under article 6(1)(f) of the UK GDPR.

When we use your sensitive information, this is special category data. The reason we use it is because we have a substantial public interest under article 9(2)(g) of the UK GDPR, and the Education Acts 1996, 2002, 2005 and 2011 allow this.

Data we collect

DfE collects information from educational settings, local authorities, your employer and other government departments. We will process the following information about you:

personal contact details
date of birth
ethnicity
data and information about your learning, including your courses and assessments

If the IT system or database contains special category data, we would be processing details about:

your equality, diversity and inclusion information
your health

If the IT system or database contains sensitive information about you, we would be processing details about:

children that are looked after or are in care

What we do with your data

When we are designing a new system or database, it is sometimes necessary to use ‘live’ personal data to test the design in a secure environment. This is because ‘dummy data’ is not capable of replicating the complexity of the data that is actually collected.

Similarly, it is necessary to extract copies and run quality checks for the purposes of identifying unnecessary duplication or even conflicting data about the same data subject. In order to maintain the accuracy of our data, if duplicate records are identified, we would either merge the duplicate records under one Unique Learner Number or maintain existing records but include cross referencing so all the records are linked and are retrieved when searching for the one data subject.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

This processing activity is for the length of time it takes to test or check the data, any copies of the data created would be deleted as soon as the text or check is complete.

Your rights

We are relying on legitimate interest for this processing. This means you have:

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

For more information, read the ICO’s guide to individual rights.

Read Request your personal information section for more on what you’re entitled to ask us or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activities:

we use contractors to do our IT health checks (ITHC) - an ITHC is a series of controlled tests and actions that check the security of our IT systems

Question 14

14. Using your data when we share your personal information

Accepted Answer

We will only share your personal data with others where it is lawful, secure and ethical to do so. Where these conditions are met, we can share your personal information with:

schools and other education providers
local authorities
researchers (like universities, think tanks, research organisations)
organisations connected with promoting the education or wellbeing of children in England
organisations fighting or identifying crime (like police, courts, the Home Office, etc)
other specified crown and public bodies (like Ofqual, Ofsted, UCAS, Office for Students, etc)
organisations working for DfE under contract (like DfE commissioned research or training providers)
organisations that provide careers and other guidance
organisations that provide statistics and research about education, training, employment and wellbeing, including Jisc (with which the Higher Education Statistics Agency (HESA) has merged) as detailed in Jisc’s collection notices - your data is also submitted to Jisc so you can take part in the graduate outcomes survey

DfE shares personal data where this is a benefit to education, the children’s services sector or it is in the interests of the wider public or society, such as sharing data to fight crime or for policy development is in the interests of society.

How DfE shares personal data gives details of the protections DfE has in place when sharing your data and the relevant legislation.

The DfE Data Sharing Approval Panel (DSAP) must approve all data share requests. The panel of experts assesses each application for public benefit, proportionality, legal underpinning and strict information security standards. The DSAP panel has external members who analyse decisions to increase public trust in the data share process.

DfE will only share data with a third party where we have a lawful basis for the data share under article 6(1) of the UK GDPR. In most cases, DfE relies on article 6(1)(e) ‘public task’ as the lawful basis where the task or function has a clear basis in law or 6(1)(f) ‘legitimate interest’ where the sharing of your data does not override your rights or when you expect us to share your data. But DfE will review each data share request on a case-by-case basis to ensure the right lawful basis is used. Read the ICO guide to Lawful basis for processing for more details.

For example, we share data under public task with:

awarding organisations – to allow exam outcomes to be accurately predicted
the Children’s Commissioner’s Office (CCO) – to protect and promote the rights and interests of children in England, especially the most vulnerable
fraud prevention and law enforcement agencies such as the police and the National Crime Agency – to prevent and detect fraud in the funding of education and learning.
the Home Office (HO) – to prevent abuse of immigration control
police and criminal investigation authorities, through court orders – to safeguard and promote the welfare of children in the UK

For example, we share data under legitimate interest with the:

Education Policy Institute (EPI) - to identify if government policies are delivering a high-quality education system
NFER and Scottish Qualifications Authority (SQA) - to investigate developments to the national curriculum

Full details of who we share data with are available: DfE external data shares.

Question 15

15. How to contact us and how to make a complaint

Accepted Answer

15.1 How to contact us

Contact the Data Protection Team if you have any questions about this document or how we use your information.

15.2 How to make a complaint

If you have concerns about how we use your personal information, you can make a complaint in writing to the Data Protection Officer and Information Commissioner’s Office.

15.3 How to whistleblow

Whistleblowing is an important source of intelligence to identify wrongdoing and risks to public service delivery. The DfE’s contact us form includes an option to make a ‘disclosure in the public interest’ including whistleblowing. However, we cannot advise you if disciplinary or regulatory action is taken, or about the outcome to an investigation.

If you request anonymity, the form will be logged as ‘anonymous’, however we will not be able to suggest other sources of information or confirm if we referred your report to another public body to consider.

15.4 How to access your personal information

A request to access your personal information can be made verbally or in writing.

Cookies on GOV.UK

Applies to England

1. Using your data to provide funding

1.1 Using your data to fund learning, including apprenticeships

Purpose and lawful basis for processing

Data we collect

What we do with your data

Sharing your data

How long we keep your data

Your rights

Data processors

1.2 Using your data to fund school, academy or college buildings

Purpose and lawful basis for processing

Data we collect

What we do with your data

How long we keep your data

Your rights

Data processors

1.3 Using your data to ensure the protection of public funds by preventing and detecting fraud

Purpose and lawful basis for processing

Data we collect

What we do with your data

Sharing your data

How long we keep your data

Your rights

Data processors

1.4 Using your data to process expense claims

Purpose and lawful basis for processing

Data we collect

What we do with your data

How long we keep your data

Your rights

Data processors

1.5 Using your data when you claim additional payments for teaching

Purpose and lawful basis for processing

Data we collect

What we do with your data

How DfE uses your data:

Sharing your data

How long we keep your data

Your rights

Data processors

2. Using your data to support teaching as a career

2.1 Using your data so we can support your teaching career

Purpose and lawful basis for processing

Data we collect

What we do with your data

How long we keep your data

Your rights

Data processors

2.2 Using your data when undertaking early career framework (ECF) induction training

Purpose and lawful basis for processing

Data we collect

What we do with your data

Sharing your data

How long we keep your data

Your rights

Data processors

2.3 Using your data when we promote career development to you

Purpose and lawful basis for processing

Data we collect

What we do with your data

How long we keep your data

Your rights

Data processors

2.4 Using your data when we create case studies about you

Purpose and lawful basis for processing

Data we collect

What we do with your data

How long we keep your data

Your rights

Data processors

2.5 Using your data when you use the Apply for Qualified Teacher Status (QTS) in England service

Purpose and lawful basis for processing

Data collected

What we do with your data

Processing applications

Safeguarding and fraud

Processing references

If you’re awarded QTS