ICO publishes Edtech in schools report, finds widespread GDPR failings

A comprehensive new report by the Information Commissioner's Office (ICO) outlines the findings of 28 consensual audits conducted with educational technology (Edtech) providers operating in the UK. 

The audits evaluated widely used primary and secondary school products, including management information systems, safeguarding tools, behaviour management platforms, learning management systems, classroom apps, and data integration services.

While the ICO identified positive information security practices, the audits revealed several industry-wide gaps in data protection compliance. Common challenges included providers failing to correctly identify whether they functioned as data processors or controllers, particularly when utilising children's data for product development or analytics. The ICO also identified insufficiently detailed contracts with schools, incomplete data flow mapping, weak application of data minimisation and storage limitation principles, outdated or inaccessible privacy information, and lax data protection impact assessments (DPIAs).

Despite the issues identified, the ICO claims the initiative was a success, leading to widespread operational improvements, with providers accepting and implementing 98% of the regulator's 596 recommendations. Moving forward, the ICO is collaborating with the Department for Education (DoE) and devolved authorities to establish a potential new educational technology code to safeguard children's data.

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.