EdLaw
UK General Data Protection Regulation (UK GDPR)
The UK GDPR is Regulation (EU) 2016/679 as it forms part of UK domestic law, published on legislation.gov.uk under the title "United Kingdom General Data Protection Regulation" and read alongside the Data Protection Act 2018. It is enforced by the Information Commissioner (referred to in the text as "the Commissioner").
Applicability to EdTech
EdTech products typically process personal data of UK teachers and pupils (accounts, device telemetry, uploaded content, audio/image data). Schools are typically the controller and the EdTech vendor a processor — Article 28 processor obligations and children's-data provisions are the most frequently cited in RFIs.
Contents
| Document | Covers |
|---|---|
| PRINCIPLES.md | Art. 5, 8A — processing principles, accountability, further-processing compatibility |
| LAWFUL-BASES.md | Art. 6, 7, 9, 10, 11, 11A — lawfulness, consent conditions, special categories, criminal-offence data |
| CHILDREN.md | Art. 8, 8ZA — children's consent (age 13 in the UK), age verification |
| DATA-SUBJECT-RIGHTS.md | Art. 12–23 (incl. 12A, 22A–22D) — transparency, access, erasure, portability, objection, automated decision-making |
| CONTROLLER-PROCESSOR.md | Art. 24–31, 37–39 — controller responsibility, data protection by design, Art. 28 processor contracts, records, DPOs |
| SECURITY-AND-BREACH.md | Art. 32–34 — security measures, breach notification |
| DPIA.md | Art. 35–36 — impact assessments, prior consultation |
| INTERNATIONAL-TRANSFERS.md | Art. 44–50 (incl. 44A, 45A–45C, 47A, 49A) — transfer principles, adequacy regulations, safeguards, derogations |
| ENFORCEMENT.md | Art. 58, 77–84 — Commissioner's powers, remedies, compensation, administrative fines |
Key obligations at a glance
Each line is a compressed pointer; the verbatim text in the linked documents is authoritative.
- Personal data must be processed according to the Art. 5 principles, and the controller must be able to demonstrate compliance (Art. 5(1)–(2) — PRINCIPLES.md).
- Processing needs an Art. 6(1) lawful basis; consent must meet the Art. 7 conditions (LAWFUL-BASES.md).
- For information society services offered directly to a child on the basis of consent, the child must be at least 13 years old; below 13, consent must come from the holder of parental responsibility (Art. 8(1) — CHILDREN.md).
- Services likely to be accessed by children must take the "children's higher protection matters" into account in design (Art. 25(1A)–(1B) — CONTROLLER-PROCESSOR.md).
- Processing by a processor must be governed by a contract containing the Art. 28(3) stipulations (documented instructions, confidentiality, security, sub-processor terms, assistance, deletion/return, audit) (CONTROLLER-PROCESSOR.md).
- Personal data breaches must be notified to the Commissioner without undue delay and where feasible within 72 hours, unless unlikely to result in risk (Art. 33(1) — SECURITY-AND-BREACH.md).
- High-risk processing requires a data protection impact assessment before it starts (Art. 35 — DPIA.md).
- Personal data may be transferred to a third country or international organisation only if the transfer is approved by regulations (Art. 45A), made subject to appropriate safeguards (Art. 46), or made in reliance on a derogation (Art. 49) (Art. 44A — INTERNATIONAL-TRANSFERS.md).
- Article 22 (automated individual decision-making) is repealed in the UK GDPR; the regime is now Art. 22A–22D (DATA-SUBJECT-RIGHTS.md).
Enforcement
Enforced by the Information Commissioner. Administrative fines reach £8,700,000 or 2% of total worldwide annual turnover (whichever is higher) for the Art. 83(4) tier, and £17,500,000 or 4% for the Art. 83(5) tier, which includes infringements of the basic principles, data subjects' rights, and transfer rules. Verbatim text in ENFORCEMENT.md.
Licence
The corpus reproduces the consolidated text of the UK GDPR (legislation.gov.uk/eur/2016/679) from legislation.gov.uk. The legislation.gov.uk footer (read 2026-10-01 on legislation.gov.uk) says: "All content is available under the Open Government Licence v3.0 except where otherwise stated." and "© Crown and database right". The text is Crown copyright, which is not an exclusion from copyright, so the label is open-licence.
The Open Government Licence v3.0 (read 2026-10-01) says: "You are free to: copy, publish, distribute and transmit the Information; adapt the Information; exploit the Information commercially and non-commercially". Its conditions: "acknowledge the source of the Information in your product or application by including or linking to any attribution statement specified by the Information Provider(s) and, where possible, provide a link to this licence", and, where no statement is specified, "Contains public sector information licensed under the Open Government Licence v3.0."; and, under Non-endorsement, the licence "does not grant you any right to use the Information in a way that suggests any official status or that the Information Provider and/or Licensor endorse you or your use of the Information."
Conditions, and how this corpus meets them:
- Acknowledge the source: each provision carries a
{.meta}provenance line naming legislation.gov.uk with the consolidation date, and Sources links the publication. Attribution statement: "Contains public sector information licensed under the Open Government Licence v3.0." (licence). - Non-endorsement: the corpus does not claim official status or endorsement by the Crown or The National Archives.
- Changes: the OGL does not require changes to be marked; the selection, layout and added anchors are described in Meta.
- Exemptions: no personal data, logos, crests or Royal Arms are reproduced.
The UK GDPR began as EU legislation. legislation.gov.uk adds: "This site additionally contains content derived from EUR-Lex, reused under the terms of the Commission Decision 2011/833/EU on the reuse of documents from the EU institutions." That reuse decision also permits commercial reuse with acknowledgement of the source (see the EU GDPR Licence section), so the label is the same. The ICO guidance pages listed in Sources are cited, not reproduced.
Related
- Data Protection Act 2018 — companion statute; the UK GDPR must be read alongside it
- EU GDPR — the instrument the UK GDPR was retained from; diverging over time