The school data checklist has changed. Can the process behind it stand up to scrutiny?

01 / 01

The checklist is new. The underlying responsibilities are already in force

A privacy notice can be current while the process behind it is out of date. An AI policy can require human oversight while nobody has the authority to overturn a system's recommendation. A school can have a data protection officer and still leave reception staff unsure where a parent's information complaint should go. The significance of DfE's 14 October publication lies in those gaps between documented intention and everyday practice.

DfE has replaced its previous DUAA chapter with a school compliance checklist. The Act amends existing data protection legislation; it does not replace UK GDPR. The publication is a review prompt for arrangements already in force, rather than a new school-specific commencement date or a certification scheme. Leaders should record the date of this review separately from the dates on which legal provisions commenced.12

That makes a proportionate response possible. A trust does not need to rewrite every policy simply because the chapter title has changed. It needs to establish which operational processes are affected, test whether they work and correct the documents that describe them. The useful output is an accountable action record: the gap, the responsible person, the change, the evidence of completion and the point at which it will be tested again.

02 / 02

Begin where a family asks a question or raises a concern

The complaints route is a good first test. ICO guidance requires organisations to make it possible to complain about personal-information handling, acknowledge complaints within 30 days and respond without undue delay. Acknowledgement is not a 30-day deadline for resolving every case. A school should be clear about the distinction when explaining its process to families.2

Take an illustrative concern: a parent says sensitive information was shared with the wrong recipient. The school's first task is to recognise what has arrived. It may need to investigate a potential breach, answer a complaint and respond to an information-rights request through connected but distinct processes. Sending the message through a generic complaints queue should not obscure a time-sensitive data protection issue. This is a suggested operational test, not a reported case.

School Connection's practical test is to follow one enquiry from arrival to closure. Who recognises it? Who records the receipt date? Can the DPO see it promptly? Where is the investigation stored? How is the family kept informed? A published email address proves little if absence, turnover or a central-versus-local misunderstanding leaves the message without an owner.

For subject access, DfE's checklist addresses pausing the response period when clarification of an unclear request is needed, and reasonable and proportionate searches. Those are bounded provisions, not general permission to delay or search only the easiest system. Record the question requiring clarification and the reasoning behind the search scope.1

In practice, the hard work is often the information map. A pupil's records may sit across email, the management information system, safeguarding records and an approved support platform. Leaders should examine whether the people handling requests know where relevant material may be held, how restricted records are reviewed and who decides on disclosure. The right process needs both access and judgement.

03 / 03

Human review must be a capability, not a sentence in a policy

The DUAA broadens the circumstances in which significant decisions can be made solely through automated processing, subject to safeguards. The ICO distinguishes decisions with a legal or similarly significant effect from ordinary automation, and retains stricter conditions for special-category information. A product labelled 'AI' does not by itself settle whether these provisions apply.3

This distinction matters when a school reviews an attendance-risk model, a behaviour flag, an admissions workflow or a staff recruitment tool. These are illustrative uses, not a claim that any particular product makes unlawful decisions. The questions are what the system actually does, what information it uses, who relies on its output and whether the human can meaningfully influence the resulting decision.

A member of staff clicking 'approve' is a weak control if they cannot inspect the underlying information, understand the limitations or change the result. A useful review route names a competent person, gives them sufficient authority and provides a way to hear the affected person's explanation. The record should make visible when professional judgement disagreed with a recommendation and what happened next.

Consider an attendance flag involving a pupil with health needs. The score may be technically correct against its inputs while the proposed response is inappropriate for the child's circumstances. The leadership question is whether relevant context reaches the decision-maker before action. This joins digital governance to SEND, safeguarding and pastoral practice rather than leaving assurance entirely with the IT team.

A sensible first step is a small inventory of systems that recommend, prioritise, score or decide. Record the purpose, affected people, input data, significance of the outcome and accountable reviewer. Assess the actual processing with the DPO; do not assume that every dashboard is a solely automated decision, or that any human presence makes the issue disappear.

04 / 04

Safeguarding and privacy need a shared account of purpose

DfE says public authorities cannot use recognised legitimate interests for their statutory functions; public task will usually remain the relevant basis for that work. Its checklist also reinforces necessary, proportionate and recorded safeguarding sharing. Schools should assess the specific activity rather than replace lawful bases across their records with a new label.1

For a leadership team, the practical issue is consistency. A DSL, a DPO and a pastoral lead should be able to explain the purpose of a disclosure, the information needed, the recipient and the decision recorded. Where a concern spans schools or agencies, uncertainty about roles should be resolved through the responsible professionals rather than left to individual staff to improvise.

A good review can therefore examine an existing pathway instead of creating another policy folder. Follow a referral or transfer and ask whether staff understood when to share, where to seek advice and how to preserve the rationale. The point is to make sound decisions easier under pressure, while retaining enough evidence to explain them afterwards.

05 / 05

A compliant purchase can change after the contract is signed

DfE's EdTech procurement guidance connects controller and processor roles, subcontractors, security, international transfers, retention and exit arrangements. It also calls for scrutiny of AI uses and ongoing review when a tool changes. Supplier assurance is therefore a continuing responsibility, not a one-off questionnaire at purchase.4

This is where the new checklist becomes a business-management issue. A platform purchased for a narrow classroom task may later add analytics or AI functions. A trust may inherit different applications when schools join. A supplier's new feature may be enabled locally without the people responsible for privacy notices, safeguarding or contracts knowing that the use has changed. These are plausible review scenarios, not measured findings about school practice.

Link the approved-system register to contract ownership and change notifications. For each material change, decide who checks the data flow, whether a DPIA needs revisiting, whether staff guidance must change and whether families need clearer information. Include the end of the relationship: what returns to the school, what is deleted, what is retained and how the school knows the process has happened.

Website services deserve the same discipline. Cookie exemptions are conditional; an update to the law does not justify removing every consent control. Ask whoever maintains the site to identify the technologies actually running, the purposes and third parties involved, and the basis for the configuration. Resolve uncertainty against current ICO guidance before changing the banner.2

06 / 06

A focused leadership review can replace scattered compliance work

School Connection suggests a short, coordinated review led by the accountable senior leader with the DPO, DSL, IT lead and business or procurement team. Start with the highest-impact pathways: a data complaint, a subject access request, a safeguarding disclosure and a technology-supported decision. Add the website and one significant supplier relationship. The sample is a starting method, not evidence that all other processing is compliant.

For each pathway, compare what the policy says with what staff and systems can actually do. Keep a single action record with ownership and an achievable completion date. Where the same problem appears across several schools, fix the shared process; where local circumstances differ, retain the explanation. Centralisation should remove repeated work without hiding local responsibility.

Governors and trustees need an intelligible account of residual risk rather than raw operational logs. A useful paper identifies the review scope, unresolved high-risk matters, overdue actions and decisions requiring resources or authority. It should state what was not tested. This lets the board distinguish an assurance gap from a proven failure and ask a useful next question.

The benefit is practical as well as regulatory. Staff can route requests more quickly, families can understand how concerns are handled, and decisions about new tools can be taken with a clearer view of responsibility. Those are outcomes to test locally. Neither this checklist nor a completed review demonstrates educational effectiveness, cyber resilience or full legal compliance on its own.

Leadership questions

Questions that turn the development into a governing conversation.

School Connection intelligence lens

What the national Observatory can add, and where it must stop.

This feature uses published national guidance. It makes no school-level finding from private Observatory records and claims no measurement of compliance across the school estate.

What we are monitoring next

Publication is the beginning of the watch.

• Changes to DfE’s checklist and ICO guidance, including any clarification of automated decisions and children’s data.
• Material changes to a school’s approved tools, supplier purposes, data flows or governance arrangements should prompt a local review. This is an editorial review trigger, not a claim that a new automated monitoring service has been activated.