What is UK GDPR (UK General Data Protection Regulation)?

UK GDPR is the UK’s version of the EU General Data Protection Regulation, kept in UK law after Brexit and since amended, including by the Data (Use and Access) Act 2025. It applies to any organisation that handles personal data, from large schools to one-person tuition businesses.

The law is built on principles. Personal data must be used lawfully, fairly and transparently; only for clear purposes; limited to what you need; kept accurate; kept no longer than necessary; and kept secure. You must also be able to show how you comply. Some information, such as health data, needs extra protection, and children’s data needs particular care.

People have rights over their data, including the right to be informed through a privacy notice, the right of access (subject access requests), and rights to have data corrected or, in some cases, erased. Most organisations that handle personal data must also pay a data protection fee to the ICO unless they are exempt.

Why it matters for your setting

• You hold sensitive information about vulnerable children, such as medical, SEN and safeguarding details, so the stakes are high.
• You need a lawful basis for what you collect, a privacy notice, sensible retention periods and secure systems.
• Schools and local authorities that commission places will want assurance that you handle shared data properly, sometimes through a data sharing agreement.

How PupilDB helps

PupilDB keeps pupil and staff records in one place rather than in scattered spreadsheets and email attachments, which makes it easier to control who sees what and to find data when you need to.