What the Data Use and Access Act 2025 Means for Schools
Steve Cullen | Insight MSIG | September 2026
Schools do not need to rewrite their whole data protection framework because of the Data (Use and Access) Act 2025. They do need to make sure the parts that have changed are reflected in everyday practice.
The Act changes parts of the UK’s data protection regime. It does not replace the UK GDPR or the Data Protection Act 2018. For schools, academies and trusts in England, and maintained schools in Wales, the sensible response is practical: identify where the law now affects live processes, update the right documents, and make sure staff know what to do.
This article is for general information only and is not legal advice.
The Act changes parts of the current framework
The Data (Use and Access) Act 2025 sits alongside the existing UK GDPR and the Data Protection Act 2018. Those core duties still matter. Schools still need a lawful basis for processing personal data, clear privacy notices, appropriate security, data minimisation, retention controls, and processes for individual rights.
The point is not to start again. The point is to avoid missing the changes that now have a direct effect on school administration.
For many schools, the biggest operational changes will be:
a legal duty to provide and manage a data protection complaints process
clarification around searches for subject access requests
possible effects on data sharing, reuse of data, automated decision making, and children’s online services
Some of those areas will matter more to trusts with central systems, shared services, or new digital projects. A small maintained school may see fewer immediate changes, but it still needs a defensible process for complaints and subject access requests.
Data protection complaints now need a clear process
Since 19 June 2026, organisations must give people a way to complain about how their personal information has been handled.
For a school, that complaint could come from a parent, carer, pupil, former pupil, staff member, volunteer, governor, contractor, or another person whose data the school holds. It might arrive by email, letter, contact form, phone call, or in the middle of another complaint.
The rule is not limited to messages that use legal language. A person does not need to write “formal data protection complaint” for the duty to arise.
A data protection complaint might say:
“You sent my child’s report to the wrong parent.”
“You have not deleted my old records.”
“You shared information with another agency without telling me.”
“You missed emails from my subject access request.”
“The school has published information that identifies my child.”
“I do not agree with how you used my personal information in this investigation.”
The school must acknowledge the complaint within 30 days. It must then make appropriate enquiries without undue delay, keep the person informed, and tell them the outcome.
That means a general school complaints policy may not be enough on its own. It can still help, but staff need to know when a complaint is really about personal data and how to route it into a process that meets the legal requirements.
A general complaint may contain a data protection complaint
Many school disputes include more than one issue. A parent may complain about a behaviour decision, the conduct of a staff member, and the way records were shared during the investigation. A staff member may raise a grievance and also complain that personal information was disclosed too widely.
The data protection element should not get lost inside the wider dispute.
A complaint about how a subject access request was handled may need its own investigation, even if the school is still dealing with the wider matter. For example, a parent might say the school failed to search staff emails properly when responding to a request. That issue is separate from whether the underlying school decision was fair.
A good process should help staff answer three questions early:
Does this include a complaint about personal data?
Has the school acknowledged that complaint within the required period?
Who is responsible for investigating and responding?
This is especially important in multi-academy trusts, where a complaint may be received at school level but handled partly by a central team. The person receiving the complaint should not have to decide the legal position alone. They should know where to send it.
Schools need to train staff to spot the issue
The legal duty will only work if staff can recognise a data protection complaint when they see one.
That does not mean every staff member needs to become a data protection specialist. It does mean reception staff, pastoral staff, senior leaders, SEND teams, HR staff, governors, and trust central teams should know the warning signs.
A short internal script can help. For example:
If a person complains about how the school collected, used, shared, stored, disclosed, amended, deleted, or responded to a request for their personal information, treat it as a possible data protection complaint and refer it to the agreed lead.
The process should also say what information to capture at the start. This might include:
the date received
who made the complaint
the person the data relates to, if different
how the complaint arrived
what data handling issue has been raised
any linked complaint, grievance, safeguarding matter, or subject access request
the date acknowledgement is due
the person responsible for the response
Schools should avoid creating a complicated system that staff will not use. A simple log with clear ownership is often more useful than a long policy that no one follows.
Subject access searches must be reasonable and proportionate
The Act makes clear that an organisation only needs to carry out reasonable and proportionate searches for personal data when responding to a subject access request.
This is a practical clarification. It recognises that schools hold information across many systems, including management information systems, safeguarding records, SEN files, emails, behaviour systems, HR records, finance systems, paper files, archived material, and cloud storage.
It does not give schools permission to ignore inconvenient systems or difficult searches.
The question is whether the search is reasonable and proportionate in the circumstances. A request for “all information held about me” may require a broader search than a request about a single incident. A request from a former pupil covering many years will need careful scoping. A request linked to a recent exclusion, complaint, employment matter, or safeguarding issue may point to specific systems and staff.
A school should be able to explain why it searched some places and not others.
That explanation matters. If the requester later challenges the response, the school’s records will show that it made reasoned decisions rather than guessing.
Good records will protect the school’s position
A subject access request file should show how the school approached the search. The file does not need to be excessive, but it should be clear enough for another person to understand.
Useful records include:
Area to record | What to capture |
Scope of the request | The wording of the request and any clarified scope |
Search locations | Systems, folders, email accounts, paper files, and archives considered |
Date ranges | The period searched and why that period was chosen |
Search terms | Names, keywords, pupil numbers, staff names, or other identifiers used |
Limits applied | Any searches not carried out and the reason |
Review decisions | Redactions, exemptions, third-party data, and withheld material |
Timeline | Key dates, including receipt, clarification, pauses if relevant, and response |
This record should be made at the time. A note written months later will carry less weight and may miss key details.
Schools should also remember that subject access is about personal data, not every document that mentions the requester in some way. A document may need to be reviewed and redacted rather than disclosed in full. It may include the personal data of other pupils, parents, staff, or third parties.
That review stage often takes longer than the search itself. Build that into the process.
Clarification can help, but it must be focused
Schools sometimes receive long, broad, or AI-drafted subject access requests. Some ask for years of material across many topics. Others use legal terms copied from online templates.
The Act does not mean these requests can be put aside because they are long or difficult.
A school can ask a focused clarification question when it is genuinely needed to identify the information sought. The question should help define the search. It should not be used to delay the request or discourage the person from exercising their rights.
A poor clarification request might say:
“Please explain exactly what you want before we consider this request.”
A better question might say:
“You have asked for information about the handling of your child’s attendance. To help us identify the information you are seeking, are you asking for records from this academic year only, or do you also want us to search earlier attendance records?”
The difference is tone and purpose. The second version helps the school search properly. It also helps the requester understand what is being asked and why.
If the school needs clarification, it should keep a record of:
the question asked
why clarification was needed
when it was sent
whether and when the person replied
how the clarified scope affected the search
Staff should be careful with requests involving children. A parent may make a request concerning a child’s data, but the response may still require thought about the child’s rights, age, understanding, welfare, and any competing duties. Those issues are not changed by the Act, but they often affect the practical response.
Other changes may matter for digital projects
The Act also changes provisions concerning some reuse and sharing of data, automated decision making, and children’s use of online services.
For some schools, these changes may have little immediate effect. For others, they could be highly relevant.
They are more likely to matter when a school or trust is planning:
a new AI-based decision tool
automated risk scoring or prediction
a new digital service for children
a new data sharing arrangement with another organisation
wider use of pupil data across a trust
a new platform that profiles users or personalises content
a project that reuses existing data for a new purpose
A school using a system to support administrative tasks may face different risks from a school using a tool to influence decisions about attendance, behaviour, safeguarding referrals, admissions, interventions, or staff performance.
The key question is not whether the technology sounds advanced. The key question is what the tool does with personal data and whether it affects people in a meaningful way.
Before introducing a new tool or sharing arrangement, schools should ask:
What personal data will be used?
What is the lawful basis?
Is special category data involved?
Are children’s data and rights affected?
Who receives the data?
Will any decision be automated or partly automated?
Can a person challenge or ask for human review where needed?
Does the privacy notice explain the activity clearly?
Is a data protection impact assessment needed?
What does the contract or data sharing agreement say?
If the answers are unclear, the project should pause until the school has taken specific advice.
What schools should do now
The best response is measured. Schools should not panic, but they should not wait until the first complaint or difficult request exposes a gap.
A practical action plan could look like this.
Review the complaints route
Check whether your current complaints policy explains how data protection complaints are identified, acknowledged, investigated, and answered.
If it does not, add a clear route. Make sure the process works for complaints received by email, letter, phone, web form, or in person.
Update internal guidance
Staff need simple instructions, not legal commentary. Give them examples of data protection complaints and tell them where to send them.
Include subject access complaints too. A complaint about delay, missing searches, redactions, or refusal to disclose information may need separate handling.
Check your subject access request process
Make sure the process reflects reasonable and proportionate searches. Add prompts for staff to record search locations, date ranges, search terms, and reasons for limits.
This is a good time to check whether the school’s subject access templates still make sense.
Look at record storage
Reasonable searches are easier when records are organised. If key information is scattered across personal inboxes, unmanaged shared drives, or old paper files, the school will struggle to respond confidently.
Better information management reduces risk.
Review new and planned technology
Before adopting AI tools, pupil platforms, analytics systems, or new data sharing projects, check whether the changes in the Act affect the proposal.
This is especially important where children’s data is involved or where a tool may influence decisions about individuals.
Involve the right people early
Data protection is not only an IT issue. It often involves senior leaders, HR, safeguarding, SEND, pastoral teams, governance, procurement, and the data protection officer or adviser.
Bring the right people in before a process is agreed or a contract is signed.
The main takeaway for schools
The Data Use and Access Act 2025 means schools should tighten specific processes, not rebuild everything from scratch.
The most urgent change is the new legal requirement for a data protection complaints process. Staff must be able to spot these complaints, acknowledge them within 30 days, investigate them properly, keep the person informed, and provide an outcome.
The subject access clarification is also useful, but it should be handled carefully. Schools can limit searches to what is reasonable and proportionate, as long as they can explain and record their decisions.
For data sharing, automated decision making, AI tools, and children’s online services, the right response depends on the activity. If a school is changing how it uses personal data, it should check the position before the change goes live.
A calm review now will save time later. More to the point, it will help schools show that they take personal data seriously when parents, pupils, staff, and regulators ask how decisions were made.
Comments