Using your data when you use DfE Sign-in

DfE Sign-in is how schools and other education organisations access DfE online services. See the DfE Sign-in landing page for details of the DfE services that use DfE Sign-in.

Applies to:

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is public task, under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. The legislation to support this is Section 8 of the Data Protection Act 2018 - exercising official authority as part of public body tasks and Department for Education functions.

Data we collect

DfE collect and use the following personal information directly from you:

Your first name and last name
The email address you provide
The organisation details the account is linked to

What we do with your data

We use the data to allow you access to DfE online services.

Occasionally, DfE will contact users on the email address provided with essential information about DfE Sign-in.

Sharing your data

We may share your information where the law allows, or where we have a legal obligation to do so.

For Ofsted users, we regularly share your details with Ofsted for monitoring purposes.

How long we keep your data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and also what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for 6 years from the date on which an individual deactivates / deletes their account.

Your rights

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

We are relying on public task for this processing, this means you have:

the right to be informed about the collection and use of your personal data – this is called ‘right to be informed’
the right to ask us for copies of your personal information we have about you – this is called ‘right of access’. This is also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
the right to ask us to change any information you think is not accurate or complete – this is called ‘right to rectification’
the right to ask us to stop using your information – this is called ‘right to restriction of processing’
the ‘right to object to processing’ of your information, in certain circumstances
the right to complain to the Information Commissioner if you feel we have not used your information in the right way

For more information, see the ICO's guide to individual rights.

See Requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

Data processors

A data processor is an organisation that processes your information on DfE's behalf. We do not use any data processors for this processing activity.

Changes to this notice

We may occasionally change this privacy notice. When we make changes to this notice, the 'last updated' date at the bottom of this page will also change. Any changes to this privacy notice will apply to you and your data immediately. If these changes affect how your personal data is processed, the DfE Sign-in team will take reasonable steps to make sure you know.

Last updated: 5 January 2024