Your School Data May Be Travelling Further Than You Think

Steve Cullen

Oct 20

6 min read

International sharing of personal information: why schools need to know where their data goes, who can access it and what safeguards are in place.

When a pupil moves to another country, it is perfectly understandable that their new school may need information about their education, additional needs or safeguarding arrangements. But what about the information that travels overseas without anyone physically leaving the country?

Every day, schools use management information systems, educational applications, cloud storage, communication platforms and other online services. Some are provided by international companies, while others rely on overseas technical support teams or subcontractors.

A school might be using a system hosted in the UK, yet its information could potentially be accessed by technical support staff in India or the United States.

The important question is not simply where the data is stored, but who can access it, from where and under what legal arrangements.

Not all international transfers are the same

The UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, establish the legal framework for handling personal information.

These requirements do not prohibit schools from sharing personal information internationally. However, where the international transfer rules apply, schools must ensure that appropriate legal arrangements are in place. The destination country makes a considerable difference.

Sharing with the EU and EEA

Despite Brexit, sharing personal information with organisations in European Union and European Economic Area countries remains relatively straightforward. The UK recognises these countries as providing adequate protection for personal information, meaning that an additional international transfer agreement is not generally necessary. For example, a school in Birmingham providing appropriate educational records to a verified school in France would not normally need a special international data transfer agreement.

However, this does not remove the usual obligations to share information lawfully, securely and only where necessary.

What about the United States?

The arrangements for sharing personal information with organisations in the United States have a particularly interesting history. Some readers may remember the original Safe Harbor arrangements, introduced to facilitate transfers of personal information between Europe and participating American businesses. These arrangements were invalidated by the European Court of Justice in 2015.

Their replacement, Privacy Shield, was subsequently invalidated in 2020 following further legal challenges concerning the protection of personal information and access by US authorities.

The current arrangements include the EU–US Data Privacy Framework and the UK's own extension, commonly referred to as the UK–US Data Bridge, introduced in 2023. Under these arrangements, qualifying American organisations can certify their commitment to specified data protection standards.

This is particularly relevant to schools using American educational software providers.

However, there is an important distinction: an American company's claim that it is GDPR compliant does not automatically mean that every transfer of school information to that company is lawful. Schools should establish whether the relevant organisation has an active certification covering the UK Extension and the type of information being transferred. They must also consider contractual arrangements, security and any further sharing with subcontractors.

And what about India?

India is increasingly important in the international technology and technical support industries. A school may contract with a British company without realising that some technical support services are provided from India. India does not currently benefit from a general UK adequacy decision.

Where a restricted transfer takes place, appropriate legal safeguards will therefore normally be needed. These may include an International Data Transfer Agreement or the UK Addendum to standard contractual clauses, supported by an assessment of the risks involved. India's own data protection legislation does not, by itself, remove the UK's international transfer requirements.

The fact that a supplier has its registered office in the UK, or stores information on British servers, is not sufficient reassurance on its own.

A pupil moves overseas: what should the school share?

International transfers are not limited to technology suppliers. Consider a family relocating from England to Australia, France, India or the United States. The receiving school may reasonably request information about the pupil's attainment, attendance, special educational needs, medical requirements and other matters relevant to their education.

There will often be sound educational reasons for sharing appropriate information.

However, schools should consider whether the entire pupil record is necessary or whether a carefully prepared summary would meet the receiving school's needs. The receiving organisation should be verified, appropriate arrangements for transferring the information established, and the disclosure recorded.

Particular care is needed with safeguarding information. For example, a family may have relocated because of domestic abuse, threats or other safeguarding concerns. Information that might ordinarily appear harmless could reveal a protected address or the whereabouts of a vulnerable child.

A request from an overseas school should not automatically result in the wholesale transfer of everything held about a pupil. Equally, data protection legislation should not become an unnecessary obstacle to protecting a child. Where information needs to be shared for safeguarding purposes, schools should work with their designated safeguarding lead and relevant authorities to establish a lawful and safe approach.

What happens when a pupil arrives from another country?

The issue also works in reverse. Schools receiving pupils from overseas may obtain educational, medical or safeguarding records created under very different legal and administrative arrangements. Information may require translation or clarification, and schools should be cautious about relying on unfamiliar terminology, assessments or conclusions without understanding their context.

Schools should consider the accuracy, relevance and sensitivity of information received, particularly where it may affect decisions about a pupil's education, welfare or safeguarding.

The hidden international transfers in everyday school technology

Perhaps the greatest practical risk is not the occasional transfer of a pupil record overseas, but the international movement or accessibility of information through everyday technology.

Consider a school using an online educational platform. The supplier may be based in the UK, the servers may be located in Europe, technical support may operate from India and certain specialist services may be provided by an American subcontractor. That does not necessarily mean the arrangement is unlawful. It does mean the school should understand the arrangement and establish whether the necessary safeguards are in place.

Questions worth asking include:

Where is our information stored, backed up and accessible from?
Can staff or subcontractors outside the UK access personal information?
What contractual and legal arrangements protect that information?
Does the supplier use other organisations to process our data?
What happens if the supplier changes its hosting or support arrangements?
How will our information be returned or securely deleted when the contract ends?

These considerations are particularly important where systems contain safeguarding records, health information, special educational needs information, staff records or other sensitive personal information.

They are also increasingly relevant when schools consider introducing artificial intelligence tools.

Data protection is not a reason to stop sensible sharing

It is important to avoid creating unnecessary bureaucracy. Schools need to share information to educate children, support families, protect vulnerable pupils and operate effectively. The objective is not to prevent international sharing, but to ensure that it is necessary, proportionate, secure and legally justified.

The Information Commissioner's Office provides guidance on international transfers, including the circumstances in which additional safeguards are required.

The Department for Education also provides guidance on school data protection, information sharing and procurement of management information systems.

A sensible approach involves understanding existing arrangements, asking appropriate questions of suppliers, recording important decisions and seeking advice where there is uncertainty.

Schools do not need to become experts in international data protection law. They do, however, need to know enough to recognise when international sharing requires closer examination.

New Insight guidance available to subscribers

To help schools, academies and multi-academy trusts understand these issues, Insight Management Services and Information Governance Ltd has produced updated guidance:

Insight MSIG - International Sharing & Transfers of Personal Data (20-10-26) v2.1.docx

The guidance examines the relevant UK legislation, ICO and Department for Education guidance, and established good practice. It explains the different arrangements applying to the EU and EEA, United States, India and other overseas destinations, including the history of international data transfer agreements and the safeguards schools should consider.

It also addresses the practical challenges of sharing pupil records when families relocate internationally, safeguarding considerations, overseas access to school systems and the responsibilities of schools when engaging technology suppliers. The guidance includes practical examples and a checklist to help schools assess proposed arrangements.

The document is available at no additional cost to schools and academies subscribing to the Insight annual information governance support service.

For further information or to request a copy, please contact:

Insight Management Services and Information Governance Ltd

Email: insightmsig@outlook.co.ukWebsite: www.insightmsig.co.uk

This article provides general information for schools and academies. International transfer arrangements and regulatory guidance can change, and individual cases may require further assessment.