What is UK GDPR? Data protection law explained for FE providers

The UK GDPR is the starting point for any question about personal data in a college or training provider. It applies whether the data sits on paper, in a spreadsheet or in a learner support system.

What does the UK GDPR require?

Article 5 sets out the principles: personal data must be processed lawfully, fairly and transparently; collected for specified, explicit and legitimate purposes; adequate, relevant and limited to what is necessary; accurate; kept no longer than necessary; and processed securely. The controller must be able to show that it complies, which is the accountability principle.

You need a lawful basis for processing, such as a task carried out in the public interest, a legal obligation, a contract, consent or legitimate interests. Public bodies cannot generally rely on legitimate interests for tasks they carry out as public authorities. Special category data needs an additional condition. Individuals have rights, including to be informed, to access their data, to have errors corrected and, in some circumstances, to have data erased, to restrict or object to processing.

How does the UK GDPR apply in FE and apprenticeships?

Colleges and providers hold large amounts of personal data about learners, including contact details, funding records and support information. They must give clear privacy information, keep records of processing, protect data with proper security, decide how long to keep it, and respond to requests such as subject access. They must also consider who is a controller or processor in each arrangement, and assess risk with a DPIA where needed.

Apprenticeships add data sharing between employer, provider and others. Share only what each party needs. Our guide to special category data in education and the trust page on data protection describe how this applies to learner support records.

What is a common misconception about the UK GDPR?

Some believe the GDPR was dropped after Brexit. It was retained in UK law as the UK GDPR, and continues to apply with amendments. Another belief is that it forbids sharing information about learners. It does not. It requires that sharing be lawful, fair and proportionate, and it expressly allows sharing where necessary, including to safeguard a learner. A third is that every use of data needs consent. Consent is just one of the lawful bases, and often not the right one for an education provider.

Be wary of any claim that a product or provider is “compliant” with data protection law in the abstract. Compliance depends on how an organisation actually uses data.

Where can you find the official source?

The UK GDPR and the Data Protection Act 2018 are on legislation.gov.uk. The ICO publishes the Guide to data protection. Parts of both have been amended by the Data (Use and Access) Act 2025, so check the current text and ICO guidance. This is general information, not legal advice.