On 15 July 2026, the Department for Education published How to reduce procurement risk: good practice guide for academy trusts. The guide is aimed at business managers, finance staff and others involved in procurement decision making, and follows the four phases of the procurement lifecycle: plan, define, procure and manage.
On 9 July 2026, the DfE added a new section to its Data Protection in Schools guidance: Procuring educational technology (EdTech). It sets out what schools should consider before, during and after procuring EdTech tools, and the questions to put to prospective suppliers. Significantly, it is the first DfE guidance to directly reference the ICO's EdTech Examined audit report, telling schools to take the ICO's findings into consideration when procuring EdTech tools.
A summary of the data protection changes in the new KCSIE guidance, including the Data (Use and Access) Act 2025, information sharing and child protection file transfers.
The Statutory Independent Inquiry into Grooming Gangs has issued a formal notice to preserve all documents potentially relevant to their investigation. As this is a formal statutory inquiry under the Inquiries Act 2005, schools may be required to produce relevant records to assist.
The ICO's edtech audit programme, covering 28 providers used across UK primary and secondary schools, has resulted in one of the most significant data protection reports to affect the education sector in years. Published in June 2025, the ICO's EdTech Examined report made 596 recommendations and found widespread compliance failures in how edtech providers handle children's personal data. This article sets out what was found and what schools and DPOs need to do about it.
The Department for Education (DfE) updated its Data protection in schools guidance on 17 June 2026, this refresh aligns the guidance with the wider expected KCSIE 2026 guidance and reinforces existing obligations that schools should already be acting on.
This article sets out what has changed, what it means for your school in practice, and the actions your data protection lead should be taking now.
The Keeping Children Safe in Education (KCSIE) document obliges schools and colleges in England to “ensure appropriate filters and appropriate monitoring systems are in place and regularly review their effectiveness”. This responsibility is now a standard, no just a technical tick box, but a core leadership and safeguarding function.
When a Multi-Academy Trust (MAT) accidentally leaks highly sensitive pupil data, it makes national headlines.
When we talk about environmental responsibility, we reach for the obvious symbols: carbon footprints, single-use plastic, recycling bins in the staffroom. But in schools and Multi-Academy Trusts, there’s another kind of clutter building up quietly and can carry its own consequence.
As your external Data Protection Officer, we are pleased to introduce the May 2026 updates to our suite of model privacy notices. These revisions ensure that the schools we support remain at the forefront of compliance, specifically addressing the requirements of the Data Use and Access Act (DUAA) and the Children's Wellbeing and Schools Act.
ChatGPT, Gemini, Copilot and Data Protection
A Practical Guide for School Leaders and Data Protection Officers
©2026 Data Protection Education Ltd.