Data (Use and Access) Act 2025: Q&A Guide for Schools
July 16, 2025
The DUAA is a new UK law that came into force in June 2025. It is designed to improve how personal data is accessed, shared, and protected. It updates and supplements UK data protection law by clarifying rules on data sharing between public services, streamlining access for individuals, and introducing stronger protections for children and educational settings.
DUAA introduces clearer rules for schools on how they collect, use, and share personal data — especially pupil data. It simplifies certain legal bases for data processing, strengthens safeguards for children’s data, and provides greater clarity on data access rights and responsibilities.
Yes. DUAA confirms that schools can rely on the “public task” lawful basis when processing data for their core educational duties, such as teaching, safeguarding, attendance, and reporting to local authorities or the Department for Education. The onus is on the requesting organisation to decide if the personal data that they are requesting is for a “public task”.
Introduction of Digital Verification Servcies (DVS) aims to replace physical ID checks in services like school admissions, health care and financial services. DUAA enables the use of DVS to confirm a person’s identity. Schools may be encouraged to use DVS in areas like school admissions or online parent services. However, they must ensure these services meet accessibility, security, and child protection standards.
Yes. The Act simplifies the Subject Access Request (SAR) process and reinforces a child’s right to understand how their data is used. Schools must respond to SARs clearly and within time limits. Where a child is mature enough, they can request their own data without needing parental consent.
The DUA clarifies that organisations are only obliged to conduct searches that are ‘reasonable and proportionate’ when responding to SARs. This will empower schools and trusts to push back on overly broad requests and reiterate the principle that you don’t need to send information to which the requester already holds or has access to.
This advice is already provided within the ICO’s detailed SAR guidance, so this is unlikely to result in a huge change to existing SAR procedures. However, schools should ensure the SAR procedure is up-to-date to reflect the requirement to conduct ‘reasonable and proportionate searches’ and any staff involved in handling SARs are made aware of this change.
In many cases, yes: where there’s a valid legal basis, such as a public task or safeguarding. DUAA clarifies when consent is not needed, for example, when sharing information for child protection or legal reporting duties.
DUAA introduces the concept of recognised legitimate interests, such as protecting public health or preventing fraud. Schools may be able to rely on this for non-core uses of data, like anti-bullying initiatives or running school-based research projects, provided safeguards are in place. As these purposes, under DUAA, are classed as being “pre-approved”, schools no longer have to rely on carrying out a legitimate interest assessment.
DUAA includes a special focus on children, requiring schools to: minimise data collection, avoid unnecessary profiling, ensure that digital tools used in classrooms are age-appropriate and privacy-conscious, and document and justify data-sharing decisions.
Schools must maintain clear records showing: what data they collect and why, the lawful basis used for each type of processing, how they protect children’s data, and their decision- making around digital tools and third-party services.
DUAA introduces specific expectations around the use of AI in educational settings, particularly when AI processes personal data.
Schools must:
Schools must take extra care when deploying AI tools with children and should carry out Data Protection Impact Assessments (DPIAs) where appropriate.
Yes. DUAA will be supported by updated Codes of Practice from the Information Commissioner’s Office (ICO) and the Department for Education, including tailored guidance for schools and education providers. SchoolPro TLC will update schools with further guidance and information once Codes of Practice have been published.
Existing customers can use the SchoolPro Data Protection Portal to access templates for policies and procedures contact their Data Protection Officer about data compliance decisions and SARs and our team will respond quickly with advice that takes into account all the latest guidance. If you have any other questions about this or any other topic, please contact us contact@schoolpro.uk.
The SchoolPro TLC Team is here to help!
SchoolPro TLC Ltd (2025)
SchoolPro TLC guidance does not constitute legal advice.
SchoolPro TLC is not responsible for the content of external websites.
For a confidential conversation about the needs of your school or organisation, please contact SchoolPro TLC using the links below. Based in Gloucestershire, available anywhere in the UK!
SchoolPro TLC Limited was formed by school and education leaders with over 60 years of experience across all stages of education and in a variety of contexts. The company founders have worked to improve educational provision as both senior leaders and school governors.
© 2025 SchoolPro TLC – All Rights Reserved