UK: ICO statement on ‘Edtech examined’ report

The UK Information Commissioner’s Office published "EdTech examined", a report summarising consensual audits of 28 edtech providers used in primary and secondary schools (2024–2025). The ICO found generally positive information security practices but identified compliance gaps—such as unclear controller/processor roles, insufficient contracts, incomplete data-flow mapping, weak data minimisation and storage limitation, outdated privacy information, and gaps in DPIAs—and reports that providers accepted 98% of 596 recommendations, with follow-up work ongoing for 12 providers.