The British data protection authority (ICO) has published a report on data protection practices in the educational technology sector, following an audit program.
This report, entitled "Educational Technologies Examined," details the findings of audits conducted in 2024 and 2025 with 28 providers of products used in British primary and secondary schools. While positive information security practices were noted, the audits revealed compliance gaps. Common issues included poor identification of the role of data controller or processor, especially when children's data were used for product development or analysis. Other shortcomings involved insufficiently detailed contracts with schools, incomplete mapping of data flows, weak application of the principles of data minimization and storage limitation, outdated privacy information, and inadequate data protection impact assessments. Following these audits, providers accepted and implemented 98% of the 596 recommendations made by the authority.
The ICO is now collaborating with the Department for Education and decentralized authorities to improve the management of children's personal information in the school environment. In this context, discussions are underway on the creation of a new code of conduct for educational technologies to ensure better data protection for children on platforms used by schools.