Data protection for learner support software: roles and gaps

This page is written for data protection officers, information governance leads and anyone deciding whether learner support software is safe to use from a data protection point of view. It explains how we expect responsibilities to be split, how the product is designed to handle personal data, and what we have not done yet. It is not legal advice, and it does not replace your own assessment.

Does Inclusion Studio hold real learner data today?

No. Inclusion Studio is pre-pilot. The prototype uses five fictional learners and keeps changes only in browser memory. The production application is in development and uses synthetic data only. We will not accept real learner data until the gates on our assurance roadmap are met and a contract is signed with the provider.

The only personal data we handle today is what you send us when you contact us or ask about the pilot. Our draft privacy notice covers that.

Who will be the controller and who will be the processor?

We expect the college or training provider to be the controller for learner support records, because it decides why and how those records are used. We expect Inclusion Studio to act as the provider’s processor, handling records only on its documented instructions. This split will be set out in a written contract with the terms UK GDPR Article 28 requires. Where we act as a controller in our own right, for example for website enquiries or our own account administration, we will say so. See controller and processor for the distinction.

What data protection risks come with learner support software data?

Learner support records can include special category data, such as health and disability information, alongside ordinary personal data such as names, courses and contact details. The ICO treats special category data as needing extra protection and an additional condition for processing. Our guide to special category data in education explains this in more detail.

The product is designed so that:

• the minimum identity data sits with the sign-in provider, and no diagnoses, SEND details, support histories or case notes are stored there;
• uploaded files are kept in private storage and released only to people the server has checked;
• an apprenticeship employer contact sees only the workplace adjustments and their own actions;
• AI is optional, human-reviewed and never trained on case records (see our AI principles).

Where will data be processed?

The primary application database is hosted in London (Neon, AWS eu-west-2). Some supporting services, such as sign-in, hosting and file storage, may process data elsewhere, including in the United States. We do not describe Inclusion Studio as UK-only. Each service is mapped on where data is processed and listed on our draft subprocessors page. International transfers will be assessed and documented before real learner data is used.

Will you help with a DPIA?

Yes. Processing sensitive information about learners, some of whom are children or vulnerable adults, is likely to need a data protection impact assessment (DPIA). The provider, as controller, owns its DPIA. We will give pilot providers a description of the processing, the data flows, the subprocessors and our security measures to support it. We have not completed our own DPIA for the service yet. Our DPIA guide and DPIA screening checklist may help you start.

How are retention, export and deletion handled?

The design covers retention, export and deletion across original files, generated exports, extracts and any AI working data, not just the main database. Providers will set retention rules for their own records. Legal holds will be supported where they apply. These controls are designed but not built or tested yet, and we will not claim they work until they are.

How will individual rights requests work?

Learners and others can ask the controller (normally the provider) for access to, correction of or deletion of their data. As processor, we will help the provider respond, for example by making it possible to find and export a learner’s records. A controlled evidence export is part of the product design.

What is not done yet?

• No processor contract or data processing agreement is in place with any provider.
• No contracts are in place with the intended subprocessors for the service.
• No DPIA or transfer risk assessment for the service has been completed.
• No independent security or privacy review has taken place.

If your organisation needs something specific before a pilot, contact us. Our page for data protection officers lists the questions we expect to be asked.