How to do a DPIA for edtech in education
A DPIA guide and template approach for education: when colleges and training providers need a DPIA for edtech such as learner support software, and what to cover.
Guide · Data, AI and technology
Special category data in education: a guide for further education
When learner support records are special category data in education under UK GDPR, the Article 9 and DPA 2018 conditions FE providers use, and safe handling.
Guide at a glance
- Reading time
- 7 minutes
- Sections
- 9
- Primary sources
- 5
- Questions answered
- 6
Checked against official guidance. Updated 9 October 2026.
In short
Information about a learner's health, including disability and mental health, is special category data under Article 9 of the UK GDPR. FE providers need both an Article 6 lawful basis and an Article 9 condition to use it, often substantial public interest under Schedule 1 to the Data Protection Act 2018 with an appropriate policy document, and usually a DPIA.
Almost everything an inclusion team records is sensitive. A support plan for an autistic learner, a note about panic attacks, a medical letter, a record that a learner uses a hearing aid: each reveals something about a learner’s health. Under UK data protection law, that makes it special category data, which needs extra justification and extra protection. This guide explains what special category data is, the conditions FE providers commonly rely on, and the practical controls that matter most in learner support.
It explains the law and good practice. It is not legal advice; involve your data protection officer in any decision about your own processing.
What is special category data?
Special category data is personal data that needs more protection because it is sensitive. Article 9 of the UK GDPR lists the categories:
- racial or ethnic origin
- political opinions
- religious or philosophical beliefs
- trade union membership
- genetic data
- biometric data used to identify someone
- data concerning health
- data concerning a person’s sex life or sexual orientation
Criminal offence data is handled under separate rules.
The ICO explains that health data covers any information about a person’s physical or mental health, including “any information on injury, disease, disability or disease risk”, medical history, diagnoses and treatment. It also says disability may count in so far as it reveals information about health.
Is learner support data in education special category data?
Usually, yes. SEN is not a category by itself, but most learner support records reveal or concern health:
| Record | Special category? | Why |
|---|---|---|
| Diagnosis of autism, ADHD or dyslexia | Usually yes | Reveals a condition or disability |
| Mental health concern or crisis plan | Yes | Concerns mental health |
| Medical letter or EHCP section C | Yes | Health information |
| “Uses a reader in exams” | Often yes | Can reveal an underlying condition |
| Learner says “I need instructions written down” | Possibly | Depends on whether it reveals health |
| Attendance at a support session | Possibly | Can allow health to be inferred |
| Ethnicity for equality monitoring | Yes | Racial or ethnic origin |
The ICO’s guidance also says inferences count. If you infer a health condition from patterns in data, or treat a learner differently because of a suspected condition, you are processing special category data, however confident the inference.
The practical default for inclusion teams: treat the whole learner support record as special category data and design your controls around that.
What do you need before processing special category data?
You need two things, plus documentation:
- An Article 6 lawful basis, as for any personal data.
- An Article 9 condition for the special category data.
- Where your Article 9 condition relies on Schedule 1 to the Data Protection Act 2018, any extra requirements in that schedule, often including an appropriate policy document.
Which Article 6 basis applies?
For colleges and other public authorities, the main basis for support work is usually public task (Article 6(1)(e)), because supporting learners is part of their functions under education and equality law. Some processing may rest on legal obligation. Public authorities cannot rely on legitimate interests for processing in the performance of their public tasks. Independent training providers that are not public authorities may rely on different bases. Confirm yours with your DPO.
Which Article 9 condition applies?
The ICO lists ten conditions. The ones most relevant to learner support are:
| Condition | When FE providers may use it | Extra requirements |
|---|---|---|
| Article 9(2)(g) substantial public interest, with Schedule 1 Part 2 paragraph 6, statutory and government purposes | Processing necessary to carry out functions given by law, such as SEND duties and Equality Act duties | Appropriate policy document; necessity |
| Article 9(2)(g) with paragraph 18, safeguarding of children and individuals at risk | Protecting a learner under 18, or an adult at risk, from harm, where consent cannot reasonably be sought | Appropriate policy document; specific tests |
| Article 9(2)(g) with paragraph 8, equality of opportunity or treatment | Equality monitoring of health, ethnicity, religion or sexual orientation | Not for decisions about individuals; appropriate policy document |
| Article 9(2)(a) explicit consent | Limited, optional processing where the learner has a genuine choice | Must be freely given, specific, informed and withdrawable |
Schedule 1 Part 2 of the DPA 2018 says a substantial public interest condition is met only if the controller has an appropriate policy document in place. The ICO provides a template.
Note that paragraph 16 (support for individuals with a particular disability or medical condition) applies to not-for-profit bodies, not colleges, so it is not usually available to FE providers.
Why not just ask for consent?
Consent is often the wrong main basis for learner support. It must be freely given, and a learner who needs support to stay on their course may not feel free to say no. If they withdraw consent, you may still need the data to meet legal duties. You should still explain clearly what you record and why, involve learners in their own records, and give genuine choices where they exist, for example over what is shared with an employer.
Do you need a DPIA?
For learner support systems, very likely. The ICO says a DPIA is required for large-scale processing of special category data. It also lists processing data about vulnerable people, including children, as a factor that points towards a DPIA, and treats innovative technology such as AI combined with another factor as requiring one. A college-wide learner support system typically meets several of these.
See DPIA for learner support software and the DPIA screening checklist.
What controls matter most in learner support?
Lawful processing is only the start. These controls do the most to protect learners in practice:
- Share the adjustment, not the diagnosis. Most tutors need to know what to do, not why. “Provide slides 24 hours in advance” protects privacy better than “learner has dyslexia”.
- Role and relationship-based access. A tutor should see their own learners, not the whole college. An employer contact should see only workplace adjustments. Enforce this in the system, not by hiding buttons.
- Field-level restriction. Health details, safeguarding notes and support plans can need different access levels within one record.
- Data minimisation. Record what you need to support the learner and meet your duties. Avoid copying full medical letters into notes.
- Secure documents. Store uploads in private storage, released only to authorised people, and avoid email attachments.
- Accurate records. Let learners see their plan and correct errors. Record disagreements rather than overwriting them.
- Retention. Set and apply retention periods for support records. Keeping data “just in case” increases risk.
- Processor contracts. Any software supplier processing learner data for you needs an Article 28 contract and clear information on where data is processed.
- Audit. Keep logs of who accessed sensitive records, and check them.
- Training. Staff need to know what special category data is and how to handle requests and incidents.
Who can see a learner’s support data?
Learners aged 16 and over at college generally exercise their own data protection rights, including the right of access. Parents do not have an automatic right to their child’s college records, so share with parents with the learner’s agreement unless another lawful reason applies, such as a safeguarding concern.
For apprentices, employers should receive only what they need for workplace adjustments, agreed with the apprentice first. See working with employers on adjustments.
Within the college, access should follow the need to know. Safeguarding information should follow your safeguarding procedures and statutory guidance, not general support access rules.
Fictional example: a fictional college’s tutors could open any learner’s full support record in its shared drive. After a DPIA, it moves to a system where tutors see only the adjustments for learners they teach, ALS staff see full plans for their caseload, and medical letters are visible only to two named staff. Tutors report that the adjustment summaries are easier to use than the old full records.
What about AI and special category data?
Treat any use of AI with learner support data as high risk until assessed. Do not paste learner information into public AI tools. If you use an AI service, assess it in your DPIA, check where data is processed and whether it is used for training, keep a human in control of every decision, and tell learners. See using AI safely in learner support.
Is the law changing?
The Data (Use and Access) Act has amended UK data protection law. The ICO says its guidance on special category data and DPIAs is under review as a result. The core requirement, a lawful basis plus an Article 9 condition for sensitive data, remains. Check the ICO website for updated guidance and speak to your DPO.
How does Inclusion Studio handle special category data?
Inclusion Studio is learner support software in development for England FE colleges and apprenticeship providers. It is at pre-pilot stage, and the production application uses synthetic data only; no real learner data is processed yet. It is being designed with permissions enforced on the server by organisation, relationship and field, private document storage, and employer access limited to workplace adjustments. The primary application database is hosted in London; some supporting services may process data elsewhere, and each will be documented and assessed before real learner data is used. Read more on data protection and where data is processed. Your organisation remains the controller and responsible for its own compliance.
Frequently asked questions
Is SEN information special category data?
Special educational needs are not listed as a category in their own right, but SEN records very often reveal or concern a learner's physical or mental health, including disability, which is health data. In practice, treat learner support records as special category data unless you are confident they reveal nothing about health.
Should colleges rely on consent to process learner support data?
Usually not as the main basis. Consent must be freely given, which is hard where there is an imbalance of power, as between a college and a learner who needs support. Most colleges rely on public task under Article 6 and a substantial public interest condition under Schedule 1 to the DPA 2018, while still involving learners and explaining what happens to their information.
Do we need a DPIA for learner support software?
Very likely. The ICO says a DPIA is required for large-scale processing of special category data, and that processing data about vulnerable people, including children, is a factor pointing towards one. Learner support systems usually combine both.
Can parents see their child's college support records?
Learners aged 16 and over at college are usually able to exercise their own data protection rights. Parents do not have an automatic right to their child's college records, so a request from a parent should normally be made with the learner's agreement unless there is another lawful reason to share.
What should an employer of an apprentice see?
Only what they need to make workplace adjustments and support the apprentice. Share the adjustment and the action needed, not the diagnosis or support history, and agree what will be shared with the apprentice first.
Has the Data (Use and Access) Act changed the rules on special category data?
The ICO says its special category data and DPIA guidance is under review following the Data (Use and Access) Act. Check the ICO website for updated guidance before relying on detailed points.
Sources and further reading
- ICO, special category data
- ICO, what is special category data?
- Data Protection Act 2018, Schedule 1 Part 2 (substantial public interest conditions)
- ICO, when do we need to do a DPIA?
- UK GDPR, Article 9 (processing of special categories of personal data)
Official guidance changes. Check the source before relying on any detail, and take professional advice for individual cases.
Help shape the pilot
We are working with a small number of England FE colleges and apprenticeship providers first. Tell us about your learner support and we will be in touch.