Edtech Examined — the UK ICO's Audits of 28 School-Technology Providers and 596 Data-Protection Recommendations

Between 2024 and 2025, the UK's Information Commissioner's Office (ICO) carried out consensual data-protection audits of 28 edtech providers whose products - management information systems, safeguarding tools, behaviour-management platforms, learning-management systems, classroom apps and data-integration services - are widely used across primary and secondary schools in England and beyond.

The ICO published its findings in the 'Edtech examined' report in June 2026. Auditors made 596 recommendations across the 28 providers; by publication, providers had accepted and implemented 98% of them. Common problems identified included providers failing to correctly distinguish their role as data controller versus processor (particularly where children's data was reused for product development or analytics), insufficiently detailed data-processing contracts with schools, incomplete data-flow mapping, weak application of data-minimisation and storage-limitation principles, outdated or inaccessible privacy notices, and gaps in data protection impact assessments.

The ICO also flagged that this was a self-selected, consensual sample rather than a full-market audit, and it is now engaging with the Department for Education and devolved authorities to develop a dedicated statutory edtech code of practice under the Data (Use and Access) Act 2025, so that the improvements found in this cohort extend across the wider market. Child-rights groups such as 5Rights and the Digital Futures for Children Centre have used the report to argue that stronger, code-backed enforcement - not just audits - is needed to stop commercially exploitative use of children's educational data.

Read the full analysis: https://ico.org.uk/media2/13yfm55z/edtech-examined-key-findings-from-our-audits.pdf