Transparency data

Your information rights under UK GDPR

Published 18 March 2025

Applies to England

UK General Data Protection Regulation (UK GDPR) gives you certain rights about how your information is collected and used.

The Department for Education (DfE) must have a valid reason to collect your personal data. These reasons are called the lawful basis in UK GDPR.

You have different rights depending on our reason to collect your personal data. In our privacy notices, we tell you which lawful basis we use to process your data. Find out more in the section on ‘how we use your information’ in the Personal information charter.

This information gives details on your rights under each lawful basis.

Public task

When we process your data under public task, you have the right to:

• be informed about the collection and use of your personal data – this is called the ‘right to be informed’
• ask us for copies of the personal information we have about you – this is called the ‘right of access’, also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
• ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
• ask us to stop using your information – this is called the ‘right to restriction of processing’
• object to us processing your information, in certain circumstances
• complain to the Information Commissioner’s Officer (ICO) if you feel we have not used your information in the right way

Consent

When we process your data under consent you have the right to:

• be informed about the collection and use of your personal data – this is called the ‘right to be informed’
• ask us for copies of the personal information we have about you – this is called the ‘right of access’, also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
• ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
• ask us to delete your personal information – this is called the ‘right to erasure’
• ask us to stop using your information – this is called the ‘right to restriction of processing’
• object to us processing your information, in certain circumstances
• be informed about automated decision-making and profiling using your personal information
• withdraw your consent at any time, where relevant
• complain to the ICO if you feel we have not used your information in the right way

As we’re processing your personal data with your consent, you have the right to:

• withdraw consent to the processing of your personal data at any time by using our contact form
• ask DfE to cease publication of your image, words or voice on its social media channels
• withdraw your consent for us to use your data for a webinar up until the webinar recording is published – if you change your mind or are unhappy with our use of your personal data, let us know, stating the name of the event or webinar

If you ask us to stop publishing your image, words or voice on our social media channels, we’ll do this, but we cannot remove or delete existing posts. The DfE social media channels are captured by the The National Archives as a permanent record of DfE’s social media communication.

You can unsubscribe from our emails at any time. You can also use the ‘unsubscribe’ or ‘change your email preferences’ links in the emails you get from GOV.UK.

Further information on your rights and the ways in which your data may be used are contained in the filming, photography and audio recordings consent form, if you’ve completed one.

Legitimate interest

When we process your data under legitimate interest, you have the right to:

• be informed about the collection and use of your personal data – this is called the ‘right to be informed’
• ask us for copies of the personal information we have about you – this is called the ‘right of access’, also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
• ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
• ask us to delete your personal information – this is called the ‘right to erasure’
• ask us to stop using your information – this is called the ‘right to restriction of processing’
• object to us processing your information, in certain circumstances
• be informed about automated decision-making and profiling using your personal information
• complain to the ICO if you feel we have not used your information in the right way

Contract

When we process your data under contract, you have the right to:

• be informed about the collection and use of your personal data – this is called ‘right to be informed’
• ask us for copies of the personal information we have about you – this is called ‘right of access’, also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
• ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
• ask us to delete your personal information – this is called ‘right to erasure’
• ask us to stop using your information – this is called ‘right to restriction of processing’
• object to us processing your information, in certain circumstances
• be informed about automated decision-making and profiling using your personal information
• withdraw your consent at any time, where relevant
• complain to the ICO if you feel we have not used your information in the right way

Legal obligation

When we process your data under legal obligation, you have the right to:

• be informed about the collection and use of your personal data – this is called ‘right to be informed’
• ask us for copies of the personal information we have about you – this is called ‘right of access’, also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
• ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
• ask us to stop using your information – this is called ‘right to restriction of processing’
• object to us processing your information, in certain circumstances
• complain to the ICO if you feel we have not used your information in the right way

Vital interests

We’ll only process your personal data under vital interests if we need to do this to protect someone’s life. The ‘immediate protection’ section of the Working together to safeguard children 2023: statutory guidance has information on the actions DfE and stakeholders will take if there is a threat to life.

When we process your data under vital interests, you have the right to:

• be informed about the collection and use of your personal data – this is called the ‘right to be informed’
• ask us for copies of your personal information we have about you – this is called ’right of access’, also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
• ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
• ask us to delete your personal information – this is called ‘right to erasure’
• ask us to stop using your information – this is called ‘right to restriction of processing’
• be informed about automated decision-making and profiling using your personal information
• complain to the ICO if you feel we have not used your information in the right way

Requesting your personal information

Requesting your personal information from DfE has details about:

• what you’re entitled to ask us or any of our executive agencies
• your rights about how your information is collected and used

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

Find out more from ICO’s guide to:

• individual rights
• lawful basis