UK GDPR: using apps and online services with pupils

Stay compliant with data protection law when using educational apps or other online services with pupils. Work through these questions before setting up a new app or service to figure out your responsibilities, then check your next steps.

Last reviewed on 16 January 2023

School types: All · School phases: All

Ref: 35317

Contents

If pupils’ using the service means your school has to process any personal data, you're the data controller.

This applies if:

You need to collect and share personal data with the service provider (e.g. you'll give them the names of the pupils using the service); and/or
You receive data back from the provider (e.g. you'll get scores from a test done on the service)

If your school doesn't need to process personal data, then you're not the data controller.

You're not processing data if:

My school is the controller You’re responsible for getting everything in check under data protection