The DfE now points schools to the ICO's EdTech audit findings. Here's what that means for your next supplier decision.
On 9 July 2026 the Department for Education added a new section on procuring educational technology to its Data protection in Schools guidance. It arrived without much fanfare, but if you sign off new systems for a school or trust, it's worth a careful read.
Two points stand out. The DfE tells schools to take the ICO's Edtech examined findings into account when buying EdTech. It also says to consult your Data Protection Officer at the very start of procurement and throughout implementation, not once a product has already been picked. Your designated safeguarding lead should be involved too, particularly where a tool uses AI.
None of this is new law. But it puts the DfE's name behind something DPOs have been saying for years: choosing a supplier is a data protection decision, not just an IT, curriculum or budget one.
The ICO's report, published in June 2026, is based on voluntary audits it carried out in 2024 and 2025 with 28 EdTech providers. Between them they cover MIS, safeguarding and behaviour systems, learning platforms, classroom apps and data integration services used across UK primary and secondary schools.
Security was generally in good shape. The problems were mostly about governance:
About half did no meaningful due diligence on their own sub-processors.
The ICO made 596 recommendations and providers accepted 98% of them. That's welcome, but it doesn't mean the products your trust uses have been fixed. Only 28 providers were audited, and the ICO is still following up with 12 of them.
One case from the report is worth passing on to anyone who thinks AI risk only comes with products sold as AI. A few providers had added AI features through a third-party sub-processor on that company's standard terms. Those terms let it keep customer data, including children's information, to train its own model. The providers only found out during the audit, and this was in a review that deliberately left out generative AI chatbots.
The school or trust is usually the controller, and stays accountable for processing a supplier carries out on its behalf. Where a supplier uses pupil data for its own purposes, such as training an AI model, it becomes a controller for that activity and needs its own lawful basis. The DfE guidance uses exactly this example.
The practical problem is visibility. If the contract is vague and nobody asks the question, the school may not know this is happening, and so can't tell parents about it.
The same applies to the ICO's Children's Code: schools aren't directly in scope, but many EdTech suppliers are when they act as controllers, and the DfE expects schools to check they meet it.
Our AI Governance in MATs 2026 Benchmark, based on responses from over 30 trust leaders and governors, found that only 25% know which of their suppliers process children's data using AI. Just 13% are fully confident that AI use involving children aligns with the ICO's Children's Code.
Put that next to the ICO's findings and the gap is plain. Most trusts can't yet see what their suppliers are doing with AI, and the audits show some suppliers didn't fully know either.
The DfE guidance suggests a set of questions to put to suppliers. These are the ones the ICO's findings suggest matter most:
What personal data does the tool need, and why does it need each item? Can optional fields be switched off?
Does the supplier use pupil data for its own purposes, such as product development, analytics or AI training? Can that be turned off?
Who are the sub-processors, how will you hear about changes, and do any of them keep data to train AI?
What happens to the data when the contract ends?
These are much easier to get answered before the contract is signed than after.
The ICO says it is working with government on secondary legislation that will require it to produce a new code on the use of children's data in digital systems in education. Trusts that build these checks into procurement now will have less to change when it arrives.
Find out where your trust stands. Complete the GDPRiS AI Governance & Readiness Assessment to see how you compare with the benchmark findings and spot gaps before your next supplier decision.