Earlier this year, the Data (Use and Access) Act 2025 received Royal Assent, introducing some targeted changes to UK data protection law. While this isn’t a major overhaul, there are important updates that schools and multi-academy trusts should be aware of as we move towards implementation.
Why This Matters
The Act amends parts of the UK GDPR and the Data Protection Act 2018, bringing the law in line with existing ICO guidance and adding new obligations for education providers. Most changes are expected to come into effect from December 2025, with some requirements following in 2026. Preparing now will help schools avoid last-minute compliance challenges and ensure policies and processes remain robust.
What’s Changing?
Three key changes to look out for:
- Subject Access Requests (SARs) – Confirming timeframes and clarifying what counts as a “reasonable and proportionate” search.
- Automated Decision-Making – Loosening some requirements but schools should remain cautious around AI-driven processes.
- Data Protection Complaints – Introducing new obligations for schools to provide clear complaint routes and respond within set timeframes.
These changes may seem straightforward, but they do require schools to review existing practices and ensure staff understand what’s expected.
What Should Schools Do?
Now is a good time to check your policies and procedures, refresh staff awareness and consider how emerging technologies are used in decision-making. Taking proactive steps will help you stay compliant and avoid unnecessary risk.
Support When You Need It
Through the EIS Data Protection Officer Service, delivered in partnership with Invicta Law, schools gain practical, hands-on support to meet GDPR obligations. DPOs work directly with school teams to interpret legislation, manage compliance tasks and respond confidently to data requests and breaches.
Invicta Law also provides a full range of legal services to support schools and public sector organisations, from governance and employment law to safeguarding and data protection. Please get in touch to find out how we can help.
Disclaimer: This article does not constitute legal advice and is provided for general information purposes only. Published 18 November 2025.
