Education is the one sector where the rules are meaningfully stricter, because most of the people whose data you hold are children, and the law treats that differently.
The Act applies to every organisation that holds personal data. What reasonable looks like changes a great deal by sector, and this is what it changes to here.
What makes this sector different
Schools, coaching centres, training institutes and edtech platforms hold admission records, family details, identity documents, attendance, assessment results, photographs and often health or dietary information. A large share of it concerns people under eighteen.
The additional requirements around children's data are the part most institutions have not addressed. Permission is usually assumed from the fact that a parent enrolled the child, rather than captured, recorded and capable of being withdrawn.
Where personal data usually sits
Drawn from engagements and from the questions that come up most often on first calls in this sector.
| System | What it holds | What usually needs attention |
|---|---|---|
| Admission and enrolment | Applicant records, family details, identity and address documents | Records of unsuccessful applicants kept indefinitely |
| Student information system | Attendance, assessment, discipline records, health notes | Access is wider than it needs to be across the staff body |
| Communication groups | Parent and student WhatsApp groups run by staff | Every parent's number is visible to every other parent by default |
| Photography and media | Event photographs, published results, social media posts | No permission on file, and no way to withdraw it later |
| Learning platforms | Logins, progress data, recordings of online classes | Vendor terms never reviewed, recordings retained with no rule |
| Alumni and fundraising | Contact details retained long after a student leaves | No basis recorded for continued contact |
What we look at first here
Assumed parental permission. Enrolment is not permission for everything that follows, particularly for photography and third party platforms.
Students turning eighteen. At that point the young person holds their own rights, and almost no institution has a process for the handover.
Staff run WhatsApp groups. Created informally, holding every parent's number, and continuing long after the class ends.
Photographs on social media. The most common complaint parents actually raise, and the hardest to undo once published.
Behavioural advertising to minors. Edtech platforms must be especially careful here, and it is worth checking what your own analytics tools do.
Which steps carry the most weight
The full sequence is on the engagement page. In this sector, these three usually do the heavy lifting.
Gap Analysis
What permission you actually hold, for what, from whom, and whether any of it can be evidenced.
Compliance Support
A parental permission flow that works in under five minutes, plain language notices for families, rules on photography, and a process for students who turn eighteen.
Training, assurance and close out
The people who need this most are teachers and front office staff, not the IT team. Training is built for them.
This is the sector where we most often recommend going beyond the minimum. Parents raise complaints here more than in any other sector we work in, and a clear, published position prevents most of them.
Not quite your business?
Every engagement is scoped to what you actually run, so none of these pages will match you exactly.
Thirty minutes, and you will know where you stand.
Tell us what your business runs on. We will tell you which gaps matter most, whether or not you engage us.