When conversations turn to data protection in schools and colleges, one word tends to appear more than any other: consent.
For many educators, consent can feel like the default answer to any question involving personal data. Yet one of the most surprising aspects of data protection law is that consent is often not the most appropriate basis for processing information.
Understanding when consent is necessary, when it is not, and when explicit consent is required can help schools make more confident decisions while maintaining trust with pupils, parents and staff.
Why Consent Isn’t Always the Answer
There’s a common assumption that if personal data is being used, consent must be obtained first.
In reality, schools process large amounts of personal information every day as part of their educational responsibilities. Attendance records, assessment data, safeguarding concerns and communications with parents are all examples of processing that is often necessary for a school to function effectively.
A helpful question to ask is:
If someone says no, can we genuinely stop processing their data?
If the answer is no, consent may not be the most appropriate lawful basis.
In these situations, relying on consent can create confusion because it suggests that individuals have a choice when, in practice, the processing still needs to occur.
When Consent Is Not Usually Appropriate
Attendance Monitoring
Schools have legal and safeguarding responsibilities to record attendance.
While pupils may not always be enthusiastic about having their attendance monitored, maintaining accurate attendance records is an essential part of a school’s role and does not depend on consent.
Safeguarding
Safeguarding is one of the clearest examples of processing that should not rely on consent.
If a member of staff has concerns about a child’s welfare, the school has a duty to act appropriately. In some circumstances, seeking consent before sharing information could delay important action or increase risk.
Recording Progress and Achievement
Assessment data forms the backbone of educational decision-making.
Whether recording test scores, tracking progress or reporting outcomes, schools need to process this information to support learning and meet their responsibilities.
Students may occasionally wish certain results could be quietly forgotten, but educational records remain an important part of supporting learning and development.
Essential Communications
Parents expect schools to communicate important information about their children and about school operations.
Messages regarding closures, timetable changes, behaviour concerns or academic progress are generally part of a school’s core responsibilities rather than activities requiring consent.
When Consent Is Appropriate
Consent works best when people have a genuine and meaningful choice.
Publicity and Promotional Activities
Many schools enjoy celebrating achievements through websites, prospectuses and social media.
Where participation is genuinely optional, consent can provide a clear and transparent way of giving individuals control over how their information is used.
Optional Photography
Photography often sits at the centre of data protection discussions in education.
Using a photograph internally for identification purposes may be very different from using it in promotional materials or on social media.
When images are being used beyond the school’s essential functions and individuals have a genuine choice, consent may be appropriate.
Alumni and Success Stories
Schools and colleges are rightly proud of their former students.
However, featuring a former pupil in a newsletter, website article or promotional campaign is very different from maintaining their educational record. In these circumstances, seeking consent is often the most respectful and transparent approach.
When Explicit Consent Is Required
Some situations require a higher standard than ordinary consent.
Explicit consent requires a clear and specific indication that the individual understands exactly what they are agreeing to.
This often becomes relevant when processing particularly sensitive information, including:
- Health data
- Biometric information used for identification
- Religious beliefs
- Ethnic origin
- Certain other categories of sensitive personal data
Examples in education might include:
Sharing Personal Health Stories
A pupil may wish to participate in a fundraising campaign discussing their medical experiences.
While such stories can be powerful and inspiring, the use of detailed health information requires particularly careful consideration and may require explicit consent.
Publishing Sensitive Case Studies
A college may wish to highlight a student’s achievements while discussing challenges linked to a disability or health condition.
Because the information is sensitive, explicit consent helps ensure the individual understands and agrees to how that information will be used.
A Simple Consent Checklist
Before reaching for a consent form, consider:
- Is there a genuine choice?
- Could the individual refuse without disadvantage?
- Can consent be withdrawn?
- Is consent the most honest and transparent basis for the processing?
If the answer to any of these questions is unclear, it may be worth considering whether another lawful basis is more appropriate.
One of the most useful lessons data protection offers educators is that good practice is not about collecting the greatest number of consent forms.
Rather, it is about understanding why information is being used, being transparent about that use, and ensuring individuals’ rights are respected.
Consent remains an important part of the data protection toolkit, but it is only one tool among many. Sometimes the most responsible approach is not to ask for consent, but to identify the lawful basis that genuinely reflects why the processing is taking place.
As with good teaching, success often comes from asking the right question in the first place. In data protection, that question is not simply:
“Do we have consent?”
but rather:
“Is consent the right basis for what we’re doing?”
That’s where meaningful compliance begins.
