How to do a DPIA for edtech in education
A DPIA guide and template approach for education: when colleges and training providers need a DPIA for edtech such as learner support software, and what to cover.
Glossary
Controller and processor: what the terms mean under UK GDPR
A controller decides why and how personal data is used; a processor acts on its instructions. How colleges, providers, employers and suppliers fit these roles.
Controller and processor
Glossary term · 2 sources
Definition
Under the UK GDPR, a controller decides the purposes and means of processing personal data, and a processor processes personal data on the controller's behalf and on its instructions. Colleges and training providers are normally controllers of learner records, and their software suppliers are normally processors.
These two terms decide who is responsible for what when personal data is used. Getting them right matters when you buy or change a system.
What is the difference between a controller and a processor?
A controller determines the purposes and means of processing personal data. A processor processes personal data on behalf of a controller. Article 4 of the UK GDPR contains the definitions. The controller carries the main responsibilities: choosing a lawful basis, being transparent, deciding retention, responding to rights requests and doing a DPIA. A processor must act only on documented instructions, keep data secure, use sub-processors only with authorisation, help the controller to meet its duties and delete or return data at the end.
The ICO says roles depend on what actually happens, not on labels in a contract. A supplier that decides for itself why to use learner data, for example for its own product development, is acting as a controller for that use.
How do controllers and processors apply in FE and apprenticeships?
A college or provider is the controller of the learner records it keeps for its own functions. A learner support software supplier hosting those records is typically a processor. Article 28 requires a written contract. Your data protection officer should check the contract, the list of sub-processors and where data is processed. Our guide on choosing learner support software and the subprocessors page explain what to ask.
Apprenticeships involve several organisations. The employer, the training provider, the end-point assessment organisation and the government department that funds apprenticeships each handle data for their own purposes and are usually separate controllers. Where two parties decide purposes and means together, they may be joint controllers and must have an arrangement setting out their responsibilities. Map data flows rather than assuming.
The wider legal framework is the UK GDPR.
What is a common misconception about controllers and processors?
People often think that a signed processor contract makes a supplier safe. It sets duties; the controller still has to check them. Another misconception is that only the supplier is accountable for security. The controller remains responsible for choosing a processor that provides sufficient guarantees. A third is that a processor has no liability. Processors have direct obligations under the UK GDPR as well.
Where can you find the official source?
See Articles 4, 26, 28 and 29 of the UK GDPR on legislation.gov.uk and the ICO’s guidance on controllers and processors. The ICO is reviewing its guidance following the Data (Use and Access) Act 2025. This is general information, not legal advice.
Frequently asked questions
Is a college a controller or a processor of learner data?
Normally a controller, because it decides why and how learner data is used. Roles depend on the facts, not on what a contract calls them.
Is an employer a controller of apprentice data held by the training provider?
The employer is a controller of its own employee data. The provider is usually a controller of the learner records it holds for its own purposes. They may be separate controllers, and in some cases joint controllers, depending on how they decide purposes.
What must a contract with a processor include?
Article 28 requires a written contract setting out the subject matter, duration, nature and purpose of processing, types of data, and the processor's obligations, including security, sub-processors and assistance with rights requests.
Sources and further reading
Official guidance changes. Check the source before relying on any detail, and take professional advice for individual cases.
Help shape the pilot
We are working with a small number of England FE colleges and apprenticeship providers first. Tell us about your learner support and we will be in touch.