Data (Use and Access) Act 2025 Q&A Guide for Schools with SchoolPro TLC

Our sponsor SchoolPro TLC have compiled some useful FAQs for schools about the new Data (Use and Access) Act 2025 that gained Royal Assent last month. It is worth a read as there will be some implications from a DPO perspective for schools over the next 12 months.

1. What is the Data (Use and Access) Act (DUAA) 2025? 
The DUAA is a new UK law designed to improve how personal data is accessed, shared, and protected. It updates and supplements UK data protection law by clarifying rules on data sharing between public services, streamlining access for individuals, and introducing stronger protections for children and educational settings.
 
2. What does DUAA mean for schools?
DUAA introduces clearer rules for schools on how they collect, use, and share personal data — especially pupil data. It simplifies certain legal bases for data processing, strengthens safeguards for children’s data, and provides greater clarity on data access rights and responsibilities.

3. Can schools still use “public task” as a legal basis under DUAA?
Yes. DUAA confirms that schools can rely on the “public task” lawful basis when processing data for their core educational duties, such as teaching, safeguarding, attendance, and reporting to local authorities or the Department for Education. The onus is on the requesting organisation to decide if the personal data they are requesting is for a “public task”.

4. What are the new rules around digital verification for schools?
Introduction of Digital Verification Services (DVS) aims to replace physical ID checks in services like school admissions, health care and financial services. DUAA enables the use of Digital Verification Services (DVS) to confirm a person’s identity. Schools may be encouraged to use DVS in areas like school admissions or online parent services. However, they must ensure these services meet accessibility, security, and child protection standards.

5. Are there new rights for pupils or parents under DUAA?
Yes. The Act simplifies the subject access request (SAR) process and reinforces a child's right to understand how their data is used. Schools must respond to SARs clearly and within time limits. Where a child is mature enough, they can request their own data without needing parental consent.

6. Do schools have to carry out extensive searches when complying with a data subject access request (DSAR)?
The DUA clarifies that organisations are only obliged to conduct searches that are 'reasonable and proportionate' when responding to SARs. This will empower schools and trusts to push back on overly broad requests and reiterate the principle that you don't need to send information to which the requester already holds or has access to. 
 
This advice is already provided within the ICO’s detailed SAR guidance and so this is unlikely to result in a huge change to existing SAR procedures. However, schools should ensure their SAR procedure is up to date to reflect the requirement to conduct 'reasonable and proportionate searches' and any staff involved in handling SARs are made aware of this change.

7. Can schools share data without consent under DUAA?
In many cases, yes — where there's a valid legal basis, such as a public task or safeguarding. DUAA clarifies when consent is not needed — for example, when sharing information for child protection or legal reporting duties.

8. What are “recognised legitimate interests,” and can schools use them?
DUAA introduces the concept of recognised legitimate interests, such as protecting public health or preventing fraud. Schools may be able to rely on this for non-core uses of data, like anti-bullying initiatives or running school-based research projects, provided safeguards are in place. As these purposes, under DUAA, are classed as being “pre-approved”, schools no longer have to rely on carrying out a legitimate interest assessment.

9. How does DUAA protect children's data in education?
DUAA includes a special focus on children, requiring schools to: minimise data collection, avoid unnecessary profiling, ensure that digital tools used in classrooms are age-appropriate and privacy-conscious, and document and justify data-sharing decisions.
 
10. What do schools need to document under DUAA?
Schools must maintain clear records showing what data they collect and why, the lawful basis used for each type of processing, how they protect children's data, and their decision- making around digital tools and third-party services.

11. How does the DUAA affect the use of Artificial Intelligence (AI) in schools?
DUAA introduces specific expectations around the use of AI in educational settings, particularly when AI processes personal data. Schools must:

• Assess risk before using AI tools, especially those that influence decisions about pupils (e.g. predicted grades, behavioural alerts).
• Ensure AI systems are transparent and explainable to pupils and parents.
• Avoid using AI that carries a high risk of bias or profiling without strong justification and safeguards.
• Maintain records of automated decision-making and demonstrate that human oversight is in place.

Schools must take extra care when deploying AI tools with children and should carry out Data Protection Impact Assessments (DPIAs) where appropriate.

12. Will there be further guidance for schools?
Yes. DUAA will be supported by updated Codes of Practice from the Information Commissioner’s Office (ICO) and the Department for Education, including tailored guidance for schools and education providers.

SchoolPro TLC will update schools with further guidance and information once Codes of Practice have been published.

contact Schoolpro tlc for further Data protection guidance

FIND OUT MORE ABOUT SCHOOLPRO TLC SERVICES FOR SCHOOLS HERE