A (slight) improvement for schools under data privacy law

Schools are under increasing pressure and scrutiny to ensure they are treating pupil and third-party data correctly under data privacy legislation.

The Data Use and Access Act 2025 received Royal Assent on 19 June 2025, and is now coming into force, stage by stage.

Although this Act is not going to make huge changes to the law, it does contain one clear provision which is set to make life easier for schools in ensuring their compliance with data protection laws. Currently, when considering processing certain data, particularly special category data, schools seeking to rely on the “legitimate interests” ground need to complete a legitimate interests assessment to assess the benefits of the proposed data processing against its impact on the rights and freedoms of the data subjects. This imposes an extra layer of assessment and care that schools need to take (in addition to demonstrating that the processing is necessary), and comes up particularly when processing data for the purposes of ensuring compliance with safeguarding principles – although the test is very often met in such circumstances, the assessment still needs to be completed.

The Act introduces the concept of a “recognised legitimate interest” condition which, when in force, schools will be able to rely on in place of the standard “legitimate interests” condition when processing certain types of data. The new condition creates some established and accepted legitimate interests at a statutory level, removing the need to perform a legitimate interests assessment if one of the statutory interests is met. A welcome point for schools is that the safeguarding of vulnerable people is included in this list of recognised legitimate interests, which will remove a layer of assessment and work for schools when processing personal data for safeguarding purposes.

It is a modest improvement, admittedly, but in a time where the changes and increased pressures and obligations on schools seem to be somewhat relentless, it will come as a welcome respite. The recognised legitimate interest condition is expected to be in force later this year or early next year.