The ICO has already found widespread failings in how EdTech handles children's data — admissions and proctoring AI raise the stakes further
Admissions-ranking tools, exam-proctoring AI and safeguarding-flagging systems make decisions about children's opportunities and conduct. Following the ICO's audit of 28 EdTech providers, schools, universities and EdTech vendors need a defensible, child-specific assessment of every automated decision point.
The ICO's EdTech audit found the sector unprepared
An ICO audit of 28 education technology providers found that almost 70% had become controllers of children's information without recognising the responsibility, around 70% could not show schools or children had authorised additional data uses, almost 90% had incomplete records of processing, and around 70% could not justify their retention periods — with some providers using children's data to train or test AI functions without addressing the legal basis for doing so.
Admissions-ranking tools that determine which applicants proceed, proctoring systems that flag exam conduct, and safeguarding-alert systems built on behavioural monitoring all involve automated assessment of individuals, frequently including children — triggering both the Article 22A–22D ADM framework and, where the service is likely to be accessed by children, the Children's Code (Age Appropriate Design Code) considerations separately.
A university admissions platform using automated applicant ranking
An admissions platform ranks applicants using an automated scoring model that determines which files receive full committee review. Lower-ranked applicants are auto-declined. No child-specific data protection impact assessment has been completed, and the provider has not established whether it is a controller or processor for the ranking data. Illustrative example — not a real client.
The 70% and 90% figures are real, published ICO audit findings, not part of the illustrative scenario above.
Auto-declined applicants receive no explanation and no review route; controller/processor status is unclear.
The ranking decision is classified as ADM, controller status is resolved, and a child-specific DPIA and safeguard route are documented.
Where to start
- Resolve controller/processor status before assessing anything else — the ICO found most EdTech failures started here.
- Classify admissions-ranking and auto-decline functions against Article 22A, with particular care where applicants are under 18.
- Assess separately whether the Children's Code applies, based on whether the service is likely to be accessed by children — not simply because some users are minors.
- Set defined, justified retention periods for children's data used in ranking, proctoring or safeguarding models.