What a UK school should ask a quiz tool about pupil data

Online quiz tools are easy to start using. A teacher can sign up, share a code and have a class playing in the same lesson. Most edtech tools, the Department for Education (DfE) notes, collect and use personal data about pupils, parents and staff. This article gives you the questions to put to a quiz tool's supplier before your pupils use it, with the guidance behind each one. It is not legal advice. Your school's data protection officer (DPO) advises on whether the answers are good enough, and your school's leaders decide.

What the guidance expects before a tool reaches a class

On 9 July 2026 the DfE added a section on buying edtech to its guidance Data protection in schools. It tells schools to consult the DPO "at the very start and throughout the implementation of any tool". The same guidance says all maintained schools and academies must have a designated DPO, so there is someone to ask. Independent schools, it says, may also find the guidance useful.

The ICO, the UK's data protection regulator, has looked at what suppliers do in practice. Its report Edtech examined (24 June 2026) covers audits of 28 edtech providers in 2024 and 2025, and it made 596 recommendations. The foreword explains why the school's choice carries weight:

Questions about what the tool collects

• What personal data does the tool collect from pupils, and why is each item needed?
• Can pupils join a quiz without an account or an email address? If not, what does a pupil account hold?
• Which optional features, such as public sharing or chat, are switched off until the school turns them on?

The DfE tells schools to "ask the supplier to explain why each category of data is necessary". Its own example is a maths practice app that "only requires pupil name, class, and login details". It also describes data protection by design as switching non-core features off by default. The ICO's Children's code sets the same bar for online services that children use. Its standard on data minimisation reads:

Questions about where the data goes

• Where is pupil data stored, and is any of it held or accessed outside the UK?
• Which sub-processors receive pupil data, what does each one receive, and how will you tell us about a new one?
• Do you use pupils' answers, or the material teachers upload, for your own purposes, such as developing your product?

Location matters, and the DfE's cloud solutions standard (29 March 2023) sets the default. Data "should be stored and processed in the UK or EU, unless you have confirmed that any international transfer of your data complies with UK GDPR". For sub-processors, UK GDPR Article 28 says a processor may not engage another processor "without prior specific or general written authorisation of the controller". The ICO found that around half of the providers it audited had not regularly checked that their sub-processors kept the agreed safeguards.

The third question matters more than it looks. Almost 70% of the audited providers were controllers for some of their uses of children's information without recognising it. Developing products was a common example. When a supplier uses pupil data for its own purposes, it acts as a controller for that use. The ICO's edtech guidance says this can bring its service into scope of the Children's code.

Questions about the contract, deletion and breaches

• Will you sign a data processing agreement with the school, and what does it cover?
• How long do you keep pupil data, and how is it deleted or returned when we stop using the tool?
• How does the school ask you to delete or export one pupil's data, and how quickly do you act?
• How quickly will you tell us about a personal data breach, and who will contact us?
• How do you protect the data? Ask about encryption, sign-in, audit logs and independent testing.

UK GDPR Article 28 requires a written contract, or another legal act, between a school and any processor. The ICO found that around 70% of the audited providers had contracts that lacked detail or did not include the Article 28 requirements. The DfE says a contract should cover "security measures, sub-processors, deletion and return of data, breach notification, and staff access control". At the end of a contract, it adds, "The supplier should provide confirmation once deletion has taken place."

Press on deletion. The ICO found that many providers had not set clear retention periods. It adds: "In practice, they often anonymised information instead of deleting it." Requests from families also run to a clock. The DfE says schools must respond to information rights requests within one calendar month, unless there is a valid reason. The supplier has to be able to act within that time.

For breaches, UK GDPR Article 33 says a processor "shall notify the controller without undue delay". The school then has to report a breach to the regulator, the Information Commissioner's Office (ICO), within 72 hours where feasible, unless it is unlikely to result in a risk to people. Ask the supplier how many hours it commits to, and check that the contract says so. For security, the DfE suggests asking about encryption, secure authentication, audit logging and intrusion detection, and whether the supplier is independently audited.

The Children's code and the DPIA question

The ICO's Children's code, formally Age appropriate design: a code of practice for online services, is a statutory code of 15 standards. It came into force on 2 September 2020. Schools are not in scope, because a school is not an "information society service". Edtech suppliers can be. The ICO's edtech guidance (updated 30 May 2023) sets the test. A provider is in scope "if you process personal information beyond the instructions of a school, and determine why and how personal information is processed". The DfE adds that schools "must ensure that they meet the standards within the code". So ask each supplier whether the code applies to its service, and how it meets the standards.

A data protection impact assessment (DPIA) is a tool to identify and manage data protection risks. The DfE says you must complete one when processing is "likely to result in a high risk" to people. It also says schools should consider one for data about children "because of their age". Its cloud solutions standard asks the DPO to carry out a DPIA for any cloud service that stores personal data. Whether a quiz tool needs one is a question for your DPO. Ask the supplier for what feeds it: the DfE notes that suppliers "can provide information to assist in completing the DPIA".

Try it on Monday

1. Before a new tool reaches a class, email your DPO. Name the tool, the year group and what pupils will type into it, for example "Year 9 science: first names and quiz answers only".
2. Look for the answers in the supplier's privacy notice and data processing agreement first. Send the questions they leave open in one email.
3. Check what a pupil needs to join a quiz. If a first name or a nickname will do, do not ask for surnames or email addresses.
4. Give the replies to your DPO, and keep them with the school's DPIA or its record of processing.
5. Look again when the tool changes. The DfE advises reviewing updates, so that new processing of pupil data is not switched on without your knowledge.

To see where a supplier publishes its answers, read Quizrook's privacy notice at quizrook.com/privacy, and put it through the same questions as any other tool.