UK GDPR requires institutions to take reasonable steps to keep personal data accurate for its purpose and to demonstrate compliance. For education leaders, a practical response is a proportionate process for checking important records, investigating concerns and retaining evidence of action.
What does the accuracy principle require?
Article 5(1)(d) requires accurate personal data, updates where necessary and prompt correction or erasure of inaccurate information. The appropriate checking effort depends on how the data is used and the consequences of getting it wrong.
An old address retained as a clearly identified historical record is different from an old address presented as current. Define what a field means and what decision it supports before deciding whether it needs updating.
Read next: ICO guidance on the accuracy principle
How do accuracy and accountability differ?
Accuracy concerns the quality of the information. Accountability concerns your ability to demonstrate how you meet your responsibilities. Article 5(2) establishes accountability; Article 24 requires proportionate measures and review.
A policy can describe the process, while dated checks, assigned findings and review decisions show how it operates. A software dashboard contributes evidence, but cannot by itself establish that every relevant legal duty has been met.
What should an institution retain as evidence?
Retain enough evidence to explain the checking process and resulting action without spreading unnecessary personal information. Your DPO and responsible teams should agree appropriate access, retention and handling for the evidence.
- The purpose, source and scope of the check.
- The data version or assessment date and any unavailable fields.
- The finding, responsible owner and review decision.
- The source correction or justified exception.
- The later evidence used to verify the outcome.
For example, a school may investigate a missing contact link, assign the record for review and confirm its presence after a later import. A summary report can show that progression without distributing the family’s telephone details to every reader.
What does an accuracy check leave unresolved?
An accuracy check does not settle lawful basis, transparency, security, retention or all other data protection questions. Scope each source before connecting it and maintain the institution’s wider governance process.
When extending to spreadsheets, APIs or document stores, agree the purpose and authorised audience for each source. More searchable information creates more responsibility for permissions and review; it is not automatically better assurance.
Read next: Education Host data protection discussion
How can Education Insight Manager help evidence follow-up?
Education Insight Manager can organise supported checks, findings and source-correction tasks, then retain later-import evidence of progress. Use it to make the agreed process visible to the staff who act on findings and the leaders reviewing assurance.
Ask a demonstration to show a finding that remains unassessed because data is unavailable, as well as a successful resolution. Clear limits are part of useful evidence. Official guidance should be checked for updates when setting or reviewing institutional policy.
