Tuition centres and AP providers hold a surprising amount of sensitive information: health conditions, SEN details, social care involvement and family circumstances, often spread across spreadsheets, email and paper folders. Most managers know UK GDPR matters but are not sure which parts actually apply to a setting their size.
UK GDPR applies to every tuition centre and AP provider that holds pupil or staff details. You need a lawful basis for each use, an extra condition for health and SEN data, a paid ICO fee unless exempt, a clear privacy notice, sensible retention periods, and the ability to answer access requests within one month.
What is UK GDPR, and who is responsible?
UK GDPR is the UK’s main data protection law, alongside the Data Protection Act 2018. It was updated by the Data (Use and Access) Act 2025, with changes coming in stages.
Your setting is almost always the controller: you decide why and how pupil data is used, so you are responsible for getting it right. That is true whether you are a limited company, a charity or a sole trader tutor.
What lawful basis do you need?
Every use of personal information needs one of the lawful bases. For a typical tuition centre or AP provider:
- Contract covers the details you need to deliver the service a parent or commissioning school has agreed to.
- Legal obligation covers things the law requires, such as employment and tax records.
- Legitimate interests can cover everyday running of the setting, provided it does not override the pupil’s interests.
- Recognised legitimate interest is a new basis added by the 2025 Act for set purposes, including safeguarding vulnerable people and responding to emergencies.
- Consent suits optional extras, like using a pupil’s photo on social media.
Pupil referral units and other public bodies will often rely on public task instead. Write down which basis you use for each type of data. It saves a lot of thinking later.
Why are health and SEN details treated differently?
Health information is special category data. SEN records often include health or disability details, so treat them the same way. To use special category data you need both a lawful basis and a separate special category condition. Some of those conditions also require an “appropriate policy document” explaining how you handle the data.
In practice this means collecting only what staff need, limiting who can see it and being able to explain why you hold each item.
Do you need to pay the ICO fee?
Most organisations that process personal information must pay the data protection fee unless exempt. The smallest tier, for organisations with no more than 10 staff or a turnover up to £632,000, is currently £52 a year. The ICO’s self-assessment tells you whether you need to pay and which tier applies.
What should your privacy notice say?
People have the right to be informed. Your privacy notice should explain what you collect, why, your lawful basis, who you share it with (schools, local authorities, social care), how long you keep it and people’s rights. Give it to parents at enrolment and write a simpler version pupils can understand.
Since 19 June 2026, organisations must also give people a clear way to raise a data protection complaint and acknowledge complaints within 30 days. Mention how in your privacy notice.
How long should you keep pupil records?
UK GDPR sets no fixed periods. The storage limitation principle says keep data no longer than you need it, and be able to justify your choice. Write a short data retention schedule: for example, attendance and progress records for a set number of years after a pupil leaves, and safeguarding records for longer, following your local safeguarding partnership’s advice. Then actually delete on schedule.
What happens when a parent asks for their child’s records?
That is a subject access request. According to the ICO’s guide to subject access, you must respond within one month, extendable by up to two months for complex requests. The clock stops while you wait for genuinely needed clarification. Requests can be verbal, you normally cannot charge, and you must make a reasonable and proportionate search. Remember that the data belongs to the child. A parent can usually act on behalf of a younger child, but an older child who understands their rights may make, or object to, a request themselves.
Who counts as a data processor?
Any supplier that handles personal data on your behalf is a processor: your pupil database, email provider, cloud storage or payroll bureau. You need a written contract with each processor covering the terms UK GDPR requires, such as security, confidentiality and what happens to data at the end. Ask where data is hosted and how it is protected.
What about photos and consent?
Photos of pupils are personal data. Using them on your website, social media or in marketing is optional, so consent is usually the right basis. Ask separately for each use, record the answer, check it before posting and make withdrawing as easy as giving it. For pupils in care, check who can give consent.
When do you need a DPIA?
A DPIA (data protection impact assessment) is required when processing is likely to result in a high risk to individuals. The ICO notes that children are vulnerable, which can tip a project into needing one. Moving all your pupil records into a new system, introducing CCTV or starting to share data with a new partner are good moments to do one, even when it is not strictly required.
Take a fictional example: a tuition centre in Leeds with six staff kept medical notes in a shared spreadsheet that every tutor could open. After a DPIA, the director moved records into a system with role-based access, wrote a retention schedule and added a photo consent question to enrolment. The whole exercise took two afternoons.
How PupilDB helps
PupilDB keeps pupil records, medical notes and social media and photo consent together in one system, instead of scattered across files. It has separate admin and teacher roles, with teachers working from the timetable and registers. Data is hosted on AWS in the EU (Ireland) and passwords are stored hashed. You can read more on our security and data protection page or see how it fits tuition centres.
