language: en · status: in-force · last checked: 2026-10-06

Data Protection Act 2018 (DPA 2018)

The UK's framework data protection statute, read alongside the UK GDPR: it supplements the UK GDPR for general processing, and separately regulates law-enforcement and intelligence-services processing. Enforced by the Information Commissioner.

The Act's own structure (from the consolidated contents):

Key schedules: Schedule 1 (special categories and criminal convictions conditions), Schedule 2 (exemptions from the UK GDPR), Schedule 3 (exemptions for health, social work, education and child abuse data — Part 4 is education data).

Applicability to EdTech

For EdTech the operative regime is Part 2 (general processing) plus the UK GDPR together: the Act supplies the public-interest lawful-basis detail, the child's-consent provision for information society services, the Schedule 1 conditions needed to process special-category data, and the Schedule 2/3 exemptions — including the education-data exemptions in Schedule 3 Part 4 that govern access to pupil records.

• Special-category data a pupil discloses in a safeguarding context can rest on Article 9(2)(g) through the Schedule 1 Part 2 condition "Safeguarding of children and of individuals at risk" (paragraph 18), which requires the processing to be "necessary for reasons of substantial public interest" and carried out without consent for one of the reasons it lists. "Except as otherwise provided", a Part 2 condition is met only if the controller has an appropriate policy document in place (paragraph 5; Part 4).
• Schedule 3 Part 4 defines "educational record" separately for England and Wales (paragraph 14), Scotland, where it covers records processed "by an education authority in Scotland" (paragraph 15) and Northern Ireland (paragraph 16), and restricts the right of access where it would cause serious harm (paragraph 19). Exam scripts are exempt from the listed GDPR provisions, and access to exam marks requested before results are announced is deferred (Schedule 2 paragraph 25). Part 5 of Schedule 3 restricts access to child abuse data requested by a person with parental responsibility, and "does not apply in relation to Scotland" (paragraph 21).
• In Scotland, a person aged under 16 is taken to have the capacity to exercise a data protection right or give consent "where the person has a general understanding of what it means to exercise the right or give such consent" (section 208(2)), and "A person aged 12 or over is to be presumed to be of sufficient age and maturity to have such understanding, unless the contrary is shown" (section 208(3)). The GIRFEC information sharing guidance relies on this presumption (girfec-information-sharing).

Contents

Scope note: the Act has 259 sections; this folder reproduces Part 1, the EdTech-critical Part 2 provisions, section 208 and Schedules 1–3 verbatim. Parts 3–6, the rest of Part 7 and the other Schedules are mapped above and can be added as fact documents when needed.

Licence

The corpus reproduces the consolidated text of the Data Protection Act 2018 from legislation.gov.uk. The legislation.gov.uk footer (read 2026-10-01 on legislation.gov.uk) says: "All content is available under the Open Government Licence v3.0 except where otherwise stated." and "© Crown and database right". The text is Crown copyright, which is not an exclusion from copyright, so the label is open-licence.

The Open Government Licence v3.0 (read 2026-10-01) says: "You are free to: copy, publish, distribute and transmit the Information; adapt the Information; exploit the Information commercially and non-commercially". Its conditions: "acknowledge the source of the Information in your product or application by including or linking to any attribution statement specified by the Information Provider(s) and, where possible, provide a link to this licence", and, where no statement is specified, "Contains public sector information licensed under the Open Government Licence v3.0."; and, under Non-endorsement, the licence "does not grant you any right to use the Information in a way that suggests any official status or that the Information Provider and/or Licensor endorse you or your use of the Information."

Conditions, and how this corpus meets them:

• Acknowledge the source: each provision carries a {.meta} provenance line naming legislation.gov.uk with the consolidation date, and Sources links the publication. Attribution statement: "Contains public sector information licensed under the Open Government Licence v3.0." (licence).
• Non-endorsement: the corpus does not claim official status or endorsement by the Crown or The National Archives.
• Changes: the OGL does not require changes to be marked; the selection, layout and added anchors are described in Meta.
• Exemptions: no personal data, logos, crests or Royal Arms are reproduced.

The ICO guidance pages listed in Sources are cited, not reproduced.

Related

• UK GDPR — this Act must be read alongside it; Part 2 supplements it for general processing

Sources

• legislation.gov.uk — Data Protection Act 2018, consolidated text
• ICO — UK GDPR and DPA 2018 guidance