Data (Use and Access) Act 2025: What this means for schools and academies – Recognised Legitimate Interests

New “recognised legitimate interests” may apply when schools share information to police and safeguarding authorities.

Data protection law has experienced a quiet change with the introduction of changes in the Data (Use and Access) Act 2025, much of which came into force in February.

Whilst the changes are generally small tweaks to the UK GDPR and other data protection law rather than complete overhaul, schools and academy trusts should still take note.

A new basis for processing: recognised legitimate interests

Certain processing activities will now be able to be undertaken under a new lawful basis of ‘recognised legitimate interests’.

Recognised legitimate interests are a limited set of legitimate interests which permit processing without requiring a balancing of the rights of the data subjects (as would be required with ordinary ‘legitimate interests’).

This means that, provided processing of personal data is necessary for the purposes of a recognised legitimate interest, personal data can be processed without needing to balance the data subject’s interests.

What are the recognised legitimate interests?

The new regime covers necessary processing under the following five recognised legitimate interests:

• Public task disclosure response condition – the sharing of personal data where it is requested for the performance of a public task or official function of another organisation;

• National security, public security and defence – processing to safeguard national security, protect public security or for defence purposes;

• Emergencies – processing when responding to an emergency situation

• Crime – processing preventing, detecting and investigating crimes (including the apprehension of offenders);

• Safeguarding – processing which safeguards a vulnerable individual (under 18 or over 18 and at risk).

There is extensive ICO guidance on each recognised legitimate interest here, as well as a short form guide here.

Availability for schools and academies

Recognised legitimate interests, like legitimate interests which have been around for several years, are not available to schools and academies when performing tasks as a public authority, however they are available for specific processing operations schools and academies may undertake outside of their statutory functions (such processing would instead be undertaken under the lawful basis of “performance of a public task”).

This means that, where schools are undertaking processing of personal data (including the sharing of personal data) which is not part of their core role as an educational establishment, recognised legitimate interests may be available to them.

This will include requests from police which fall outside of the public task a school undertakes.

What this might mean for schools and academies

The new recognised legitimate interests have limited but potentially significant impacts for schools and academies when sharing information on safeguarding (outside of the school’s statutory safeguarding responsibilities) or criminal investigations.

For example, recognised legitimate interests will assist schools and academies when sharing records or CCTV footage where it is necessary in the course of a police investigation.

Schools and academies can often feel that data protection law restricts them when trying to do ‘the right thing’ in respect of police requests and safeguarding issues – standard legitimate interests can feel unfamiliar to schools and academies and the ‘balancing’ exercise is often difficult to undertake successfully where sensitive information needs to be shared.

Recognised legitimate interests give schools and academies a more reliable mechanism for sharing information with investigating authorities in the discrete situations where schools are asked to do so. It will give schools the reassurance that they are sharing information outside of their core function where it is needed for safeguarding or policing purposes.

Where personal data is being shared for the purpose of a recognised legitimate interest, the only test which needs to be applied is that the processing is necessary for the recognised legitimate interest being pursued.

What this means in practice

The introduction of recognised legitimate interests does not fundamentally change how schools and academies handle personal data, but it does provide a clearer legal basis for sharing information in limited situations.

When asked to share information outside a school or academy’s core educational role to police or safeguarding authorities, recognised legitimate interests now provide a clearer route for doing so.

If you would like to discuss any aspect of this article further, please contact our Education team on 0113 244 6100.

You can also keep up to date by following Wrigleys Solicitors on LinkedIn.

The information in this article is necessarily of a general nature. The law stated is correct at the date (stated above) this article was first posted to our website.

Specific advice should be sought for specific situations. If you have any queries or need any legal advice, please feel free to contact Wrigleys Solicitors.