Summary
- The new checklist was added to DfE guidance on 14 October 2026.
- It addresses Data (Use and Access) Act changes to UK data protection rules.
- Schools are directed to review privacy notices, records and safeguards around AI and EdTech.
The Department for Education has updated its data protection guidance for schools to include a compliance checklist reflecting changes made by the Data (Use and Access) Act 2025. The new chapter was published on 14 October 2026 and replaces earlier material explaining the legislation without the same structured operational checklist.
The Act amended existing UK data protection and electronic communications rules, including arrangements for subject access requests, complaints and certain automated decisions. The department's guidance explains how schools should review policies, records of processing, privacy notices and other controls to reflect requirements already in force. Its publication is not a newly enacted law or a declaration that schools previously failed to comply.
Subject access requests are one focus of the revised checklist, including the ability to pause the one-month response period while clarification is sought about an unclear request. Schools may pause the response period when they need clarification of an unclear request, while searches need to be reasonable and proportionate rather than exhaustive. That creates a procedural requirement to document how requests are interpreted and handled, particularly where information is spread across teaching, pastoral, finance and safeguarding systems.
The guidance also addresses recognised legitimate interests, a statutory basis available for certain processing activities. It cautions that public task will usually remain the appropriate basis where a school carries out official functions. Organisations must therefore avoid assuming that a new option allows every existing processing activity to switch legal basis without examination.
Children's information features prominently. Schools manage attendance, performance, medical, safeguarding and family information that can be especially sensitive when assembled across systems. The new checklist advises proportionate records of safeguarding data sharing and age-appropriate explanations of privacy. It also points to data protection impact assessments for higher-risk processing involving AI, education technology and monitoring tools.
Technology procurement can change who handles school information without changing the school's underlying responsibilities. Cloud learning products may process account information, behavioural data or communications, while external suppliers manage hosting and application controls. The department's guidance connects the legal framework to decisions about contracts, disclosures and records, rather than treating a technical supplier's security claim as complete compliance evidence.
The update also covers amended rules on some lower-risk cookies, complaint-handling procedures, and digital verification services. The latter may be used by schools under appropriate conditions, but the guidance does not require schools to adopt a certified identity service. Distinguishing optional mechanisms from mandatory responsibilities is important for procurement planning and public communications.
A previous Cyber Insider assessment of school websites examined browser-side controls; the DfE's October checklist concerns a broader legal and procedural framework and is a separate development. Compliance depends on actual handling of information, records and safeguards rather than whether a website has a particular security header alone.
The checklist is also relevant to smaller schools that rely on a trust, local authority or outside provider for some privacy and technology decisions. Outsourcing administrative work does not automatically settle who is responsible for answering a parent's information request or evaluating a monitoring application. The DfE asks institutions to review records of processing and data sharing agreements, a practical way to connect legal obligations to the actual flow of information. Where automated decisions affect pupils, the safeguards and privacy disclosures require particular attention because decisions may concern access to services, assessment or welfare. The guidance does not ban AI tools; it calls for assessment of higher-risk processing and documentation of the safeguards used.
The Department for Education's update history confirms that the new DUAA checklist replaced the earlier chapter on 14 October. Schools can now assess their local practices against the revised guidance while retaining the statutory obligations already applicable under UK privacy law.
