ICO statement on ‘Edtech examined’ report

An ICO spokesperson said: 

“The ICO is committed to ensuring that children’s personal information is processed responsibly and fairly, complying with data protection law. This includes processing that occurs through educational technology (edtech) products used in schools. 

Because children may not be able to choose or opt out of many digital tools their schools adopt, it is essential that parents, caregivers and pupils can trust that this technology meets the highest standards of data protection. 

Today, the ICO has published ‘Edtech examined’, a new report which outlines how we have worked directly with edtech providers to review and improve data protection practices within the sector.  

It details the findings from a programme of audits carried out during 2024 and 2025 with 28 edtech providers, whose products are widely used across primary and secondary schools in the UK. 

The consensual audits examined a range of products including management information systems, safeguarding tools, behaviour management platforms, learning management systems, classroom apps, and data integration services. 

The ICO found positive practices, particularly around information security. 

However, the audits also identified and addressed compliance gaps across the sector.  

Common issues included providers not correctly identifying whether they were acting as data processors or controllers — particularly where children's data was used for product development or analytics.  

We also found insufficiently detailed contracts with schools, incomplete data flow mapping, weak application of data minimisation and storage limitation principles, outdated or inaccessible privacy information, and gaps in Data Protection Impact Assessments. 

Through the audits, the ICO has successfully driven improvements across the sector, with providers accepting and putting in place 98% of the 596 recommendations that were made. 

Moving forward, the ICO is engaging with the Department for Education and devolved authorities on their work with schools to help improve how children's personal information is handled in educational settings.  

As part of this, we are discussing how a new edtech code could contribute to ensuring children's data is better protected across the tools and platforms schools use widely, as one of a range of measures to drive lasting change.”