New data protection rules for UK schools under the Data Use and Access Act 2025
Official title: Data (Use and Access) Act 2025 (DUAA): compliance checklist for schools
The useful part first
In 20 seconds.
- What changes
- New procedures for data requests, complaints, and automated decisions are now required.
- Who is affected
- School staff and administrators responsible for data protection and policy management.
- What you may need to do
- Schools must review and update their data protection policies, privacy notices, and staff training procedures.
- When
- The Act is currently in force as of October 2026.
- Legal status
- In forceAlready applies
Choose your summary
Key points
The essentials, point by point- 1
Schools must update procedures for subject access requests to allow for pausing timelines.
- 2
New requirements for handling data protection complaints are now in place.
- 3
Automated decision-making is permitted with new safeguards and transparency requirements.
- 4
Rules regarding cookies and online tracking have been updated for website use.
- 5
Privacy notices must be reviewed and updated to reflect these regulatory changes.
Written automatically by AI from the source text. It can contain mistakes. The impact level is our estimate, not an official rating.
Related publications
More on the same topics, from official sources.
How the government handles your personal information for reciprocal healthcare services.
Reciprocal healthcare privacy notice
Government funding helps public research organisations turn their inventions into new commercial products.
Commercialising Knowledge Assets Fund: successful projects
A free government programme helps public research organisations develop business ideas for their research projects.
PRIMA: Public Research Innovation and Market Accelerator