Tallybook

Guide · For tutors, centres and groups

Data protection for tutors and groups holding children's details

If you keep records about the children you teach, UK data protection law applies to you, however small you are. For most tutors and groups that means paying a small annual fee to the Information Commissioner's Office, telling families what you hold, and keeping it secure.

Last checked 10 November 2026. This is general information, not legal advice.

Does this really apply to one person with a spreadsheet?

Yes. The law covers sole traders, partnerships, companies and clubs alike. The Information Commissioner's Office (ICO) says a tutor who keeps educational records on students needs to pay the data protection fee. It says the same of an after-school club holding records of the children who attend.

The ICO fee

Most organisations that decide how personal data is used must pay an annual fee. Some small not-for-profit groups can be exempt. The ICO has a short self-assessment that tells you which applies.

Paying the fee does not make you compliant on its own. You still have to follow the rules below.

Six habits that cover most of it

  1. Collect only what you need. Name, date of birth, address, attendance. Not everything you could ask.
  2. Tell families. A short privacy notice: what you hold, why, who might see it, how long you keep it.
  3. Keep it secure. Password, locked drawer, no group chats.
  4. Keep it accurate. Check addresses once a term.
  5. Delete on schedule. Decide a retention period and stick to it.
  6. Let people see their data. Parents can ask what you hold about their child.

Sharing with a council under the new Act

When a law requires you to share information, you do not need the family's consent to do it. Complying with a legal obligation is its own lawful basis.

You should still be open about it. Tell families in advance that you may have to share limited details if a council serves a notice.

And share only what the notice lawfully asks for.

Before the duty is in force

A council request made before the register duty starts is not a legal obligation under that duty. Think more carefully before sharing, and ask the council which power it relies on.

If something goes wrong

If records are lost, stolen or sent to the wrong person, you may need to report it to the ICO within 72 hours. Its helpline for small organisations can tell you whether you do.

Sources