Question to the Department for Education:

To ask His Majesty's Government whether educational technology products adopted by schools are required to undergo a data protection impact assessment before deployment.

Schools, academy trusts and local authorities are responsible for complying with data protection law when adopting educational technology products.

Under the UK General Data Protection Regulation and the Data Protection Act 2018, they must complete a data protection impact assessment where the processing of personal data is likely to result in a high risk to individuals’ rights and freedoms.

This can include, for example, large-scale processing of children’s data, profiling, biometric data or other high-risk uses.

The department published guidance for schools on data protection and procuring educational technology, which encourages schools to consider data protection from the outset and consult their data protection officer when introducing new tools. This guidance is available on GOV.UK.