Question to the Department for Education:

To ask the Secretary of State for Education, how her Department ensures compliance with data protection requirements relating to the processing of special category data, including data relating to health or protected characteristics.

The department ensures compliance with data protection requirements relating to the processing of special category personal data, including data concerning health and protected characteristics, in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and Data (Use and Access) Act 2025.

The department processes special category data only where there is a lawful basis and a relevant condition for processing under Articles 6 and 9 and of the UK GDPR. The department has appropriate technical and organisational measures to safeguard data, including access controls, data minimisation, secure storage arrangements, and regular monitoring of compliance.

Where processing is likely to present a high risk to individual’s rights, the department undertakes Data Protection Impact Assessments to identify and mitigate risks. Staff receive mandatory data protection and information security training, supported by specialist advice from the department's Data Protection team.

The department also maintains privacy notices and an Appropriate Policy Document, where required, to support transparency and accountability. Compliance arrangements are kept under regular review to ensure processing remains necessary, proportionate and consistent with legal requirements.