Dr Nathan Lea is a Senior Research Associate at UCL

If you were to ask anyone “what is the first thing that comes to mind if you hear ‘GDPR’?” it is likely they have heard of it and the responses “bigger fines” and “right to be forgotten” will be top of the list. For the uninitiated though, GDPR and its sanctions applies just as much to education institutions as it does to businesses.

This is a great opportunity for schools, colleges and universities to think about how they handle data, be clear about what data they have, and be prepared to have an open and thorough discussion with data subjects about what data they hold, what they are doing with it, and what rights those data subjects have around any of the processing that happens.

What GDPR brings to the table

As of 25th May 2018 GDPR will be enforceable by law. But GDPR is not only the new rights, stiffer penalties and clearer points on what data protection officers are supposed to do. It’s also the need for transparency and accountability around what data is held, what is being done with it and being able to demonstrate clearly that it is being protected.

Further Education’s call to arms

This is why the further education sector has a particular challenge, but also a powerful opportunity to reflect on the kinds of data they handle, and why. The challenge lies in all the data intensive activities that go on in the education setting. Firstly, data is processed about students from different age groups, across different courses and with different needs. One student may have a chronic condition or a disability that has to be recorded and helps a college to provide them the support they need, whilst another may require acute assistance for financial or wellbeing support. Students will email their teachers and administrative staff with queries and concerns, and staff will need to have a discourse with one another to support their students as they progress through their studies.

Staff and students as data subjects and processors

But students will not only have personal data recorded about them, but students could also be recording personal data about others, particularly if they are undertaking research or practicals as part of their programme or training. Sometimes this will be sensitive data, subject to high standards of ethical oversight, pursuant to participant consent, especially if the student is undertaking a counselling course for example.

Meanwhile, their lecturers and supervisors will almost certainly be doing the same thing, on a larger scale. Perhaps their research may involve personal data related to people’s administrative or health or even mental health care, but at a scale of hundreds of thousands of participants.

Corporate duty and HR responsibility

Of course, no matter what role an individual holds within a further education establishment, staff will have personal data about themselves held by their employer, which will be subject to statutory monitoring and use pursuant to managing their employment, their salary, tax records and so forth. It may be used as part of a promotion review, or (hopefully not!) part of legal proceedings. There may be occupational health records that are being handled. There may also be a requirement to process data for an immigration inquiry.

Understanding the who, what and how

So a first step would be to understand what data is actually being handled and how. It may be the case that more and more FE courses are being handled online. In this event, not only does the student have a fully digital relationship with their educators and educational institutions, but they also have all their personal details online in services which the further education institution either runs themselves or procures through a third party.

This is where it is important to make sure that you know who is running what, and what contracts they need to be subjected to. But this is also where accountability is important – data controllers have to be confident that their processors are competent to handle personal data, and demonstrate that they and the processor, and any third party sub-contractors are protecting the data.

How does GDPR help all of this?

Transparency, accountability, and the justification for personal data use are all being much more rigorously mandated. GDPR talks about this in terms of data minimisation, i.e. using only what you need . The data must be relevant and up to date, and data subjects have a right for data to be rectified. The data can also only be kept for as long as necessary to achieve the purpose, and cannot be archived indefinitely for no reason whatsoever.

CONSENT : Understand your legal bases for processing data

Perhaps the most helpful aspect is around understanding the legal basis for processing the data. GDPR is providing an opportunity to check our understanding of what legal bases such as consent actually mean. Whereas before you may have relied upon consent as a legal basis for processing data, now GDPR has a much higher bar for what constitutes consent.       

One of the more noteworthy new tests for consent is whether it was freely given. The likelihood is that when a student registers to receive education for example, they do not have a free choice in your processing their personal data to achieve that purpose; so you could not call that consent under GDPR.

If you want to keep the student informed of other courses they may want or other marketing material, that is where you may need to seek consent or identify another legal basis for that: but beware! Under GDPR, opting out cannot be taken as consent, so if you have a pre-filled tick box in your registration form that permits you to contact the student for marketing or other purposes, that would not be valid consent, regardless of whether they choose to opt out by unticking the box. If you want their consent to receive marketing materials, GDPR means you have to allow them to grant their consent with an affirmative action (ticking a box) and that what they are signing up to has to be explicitly clear.

And you cannot coerce consent– it has to be freely given: a good example is that you cannot coerce consent for data processing that is not essential for performing a contract by claiming that you will not enter into that contract unless you get consent for the marketing.

People and relationships first…

Getting data protection right has long been dependent on a meaningful relationship of trust between data users and data subjects (including students and staff), where one would hope for a clear and transparent representation of how data is used. With GDPR, you have to get this right.

GDPR requires that organisations handling sensitive data put data protection at the core of their business and operations, and requires that certain kinds of breach are reported to a supervisory authority within 72 hours of discovery. It requires training and codes of practice, and makes a lot clearer the responsibilities of data protection officers. But the spirit and much of the letter of the law are around the rights and freedoms of the natural person. It would be ill advised to embark on a meaningful attempt at compliance in the belief that understanding the context of data acquisition and the people involved is unnecessary.

It is vital that awareness raising and understanding form part of the preparations and ongoing management of data protection requirements. This can be achieved by learning about GDPR and how to scale that learning and compliance across all your fellow employees. Remember the rule of thumb: it is better to seek clarification than beg forgiveness – where personal data is concerned, this is always the case.

Dr Nathan Lea is a Senior Research Associate at UCL

About Nathan: With special interest in information security, governance and ethics for shared data to support healthcare and industry, together with Ross Bogert at PA Consulting, Nathan has developed an online course in partnership with FutureLearn. The course supports professionals and their organisations to develop their understanding of protecting personal data and be able to handle data in the digital economy appropriately. The course, Introduction to GDPR, is available on FutureLearn. 

For more information about GDPR, take a look at the UK Supervisory Authority the Information Commissioner’s Office guide to GDPR available here

Copyright © 2018 FE News


You may also be interested in these articles:

Sponsored Video

Register, Login or Login with your Social Media account:


Upcoming FE Events

Advertiser Skyscrapers

Newsroom Activity

Latest Education News

Further Education News

The FE News Channel gives you the latest education news and updates on emerging education strategies and the #FutureofEducation and the #FutureofWork.

Providing trustworthy and positive Further Education news and views since 2003, we are a digital news channel with a mixture of written word articles, podcasts and videos. Our specialisation is providing you with a mixture of the latest education news, our stance is always positive, sector building and sharing different perspectives and views from thought leaders, to provide you with a think tank of new ideas and solutions to bring the education sector together and come up with new innovative solutions and ideas.

FE News publish exclusive peer to peer thought leadership articles from our feature writers, as well as user generated content across our network of over 3000 Newsrooms, offering multiple sources of the latest education news across the Education and Employability sectors.

FE News also broadcast live events, podcasts with leading experts and thought leaders, webinars, video interviews and Further Education news bulletins so you receive the latest developments in Skills News and across the Apprenticeship, Further Education and Employability sectors.

Every week FE News has over 200 articles and new pieces of content per week. We are a news channel providing the latest Further Education News, giving insight from multiple sources on the latest education policy developments, latest strategies, through to our thought leaders who provide blue sky thinking strategy, best practice and innovation to help look into the future developments for education and the future of work.

In Jan 2021, FE News had over 173,000 unique visitors according to Google Analytics and over 200 new pieces of news content every week, from thought leadership articles, to the latest education news via written word, podcasts, video to press releases from across the sector, putting us in the top 2,000 websites in the UK.

We thought it would be helpful to explain how we tier our latest education news content and how you can get involved and understand how you can read the latest daily Further Education news and how we structure our FE Week of content:

Main Features

Our main features are exclusive and are thought leadership articles and blue sky thinking with experts writing peer to peer news articles about the future of education and the future of work. The focus is solution led thought leadership, sharing best practice, innovation and emerging strategy. These are often articles about the future of education and the future of work, they often then create future education news articles. We limit our main features to a maximum of 20 per week, as they are often about new concepts and new thought processes. Our main features are also exclusive articles responding to the latest education news, maybe an insight from an expert into a policy announcement or response to an education think tank report or a white paper.

FE Voices

FE Voices was originally set up as a section on FE News to give a voice back to the sector. As we now have over 3,000 newsrooms and contributors, FE Voices are usually thought leadership articles, they don’t necessarily have to be exclusive, but usually are, they are slightly shorter than Main Features. FE Voices can include more mixed media with the Further Education News articles, such as embedded podcasts and videos. Our sector response articles asking for different comments and opinions to education policy announcements or responding to a report of white paper are usually held in the FE Voices section. If we have a live podcast in an evening or a radio show such as SkillsWorldLive radio show, the next morning we place the FE podcast recording in the FE Voices section.

Sector News

In sector news we have a blend of content from Press Releases, education resources, reports, education research, white papers from a range of contributors. We have a lot of positive education news articles from colleges, awarding organisations and Apprenticeship Training Providers, press releases from DfE to Think Tanks giving the overview of a report, through to helpful resources to help you with delivering education strategies to your learners and students.


We have a range of education podcasts on FE News, from hour long full production FE podcasts such as SkillsWorldLive in conjunction with the Federation of Awarding Bodies, to weekly podcasts from experts and thought leaders, providing advice and guidance to leaders. FE News also record podcasts at conferences and events, giving you one on one podcasts with education and skills experts on the latest strategies and developments.

We have over 150 education podcasts on FE News, ranging from EdTech podcasts with experts discussing Education 4.0 and how technology is complimenting and transforming education, to podcasts with experts discussing education research, the future of work, how to develop skills systems for jobs of the future to interviews with the Apprenticeship and Skills Minister.

We record our own exclusive FE News podcasts, work in conjunction with sector partners such as FAB to create weekly podcasts and daily education podcasts, through to working with sector leaders creating exclusive education news podcasts.

Education Video Interviews

FE News have over 700 FE Video interviews and have been recording education video interviews with experts for over 12 years. These are usually vox pop video interviews with experts across education and work, discussing blue sky thinking ideas and views about the future of education and work.


FE News has a free events calendar to check out the latest conferences, webinars and events to keep up to date with the latest education news and strategies.

FE Newsrooms

The FE Newsroom is home to your content if you are a FE News contributor. It also help the audience develop relationship with either you as an individual or your organisation as they can click through and ‘box set’ consume all of your previous thought leadership articles, latest education news press releases, videos and education podcasts.

Do you want to contribute, share your ideas or vision or share a press release?

If you want to write a thought leadership article, share your ideas and vision for the future of education or the future of work, write a press release sharing the latest education news or contribute to a podcast, first of all you need to set up a FE Newsroom login (which is free): once the team have approved your newsroom (all content, newsrooms are all approved by a member of the FE News team- no robots are used in this process!), you can then start adding content (again all articles, videos and podcasts are all approved by the FE News editorial team before they go live on FE News). As all newsrooms and content are approved by the FE News team, there will be a slight delay on the team being able to review and approve content.

 RSS IconRSS Feed Selection Page