# DfE tells schools to offer human review of automated decisions

> A new checklist tells schools in England how to meet the Data (Use and Access) Act. It says people must be told about automated decisions and be able to challenge them.

The Yoink Report (CodeYoink) | UK | Schools | News of 14 October 2026 | Published 6 November 2026

The Department for Education added a checklist to [its data protection guidance for schools](https://www.gov.uk/guidance/data-protection-in-schools) on 14 October 2026, including steps on automated decisions and AI.

[The checklist](https://www.gov.uk/guidance/data-protection-in-schools/data-use-and-access-act-2025-duaa-compliance-checklist-for-schools) reminds schools that the requirements of the Data (Use and Access) Act 2025 are in force. It says the Act allows wider use of automated decision-making if safeguards are in place. An automated decision is one made by a computer system without a person. Schools are told to find any systems that do this and make sure a person can review and change the outcome.

The checklist also tells schools to carry out data protection impact assessments where required, particularly for higher-risk use of AI tools, EdTech and monitoring technology. It says privacy information for children should use clear, age-appropriate language.

[The Information Commissioner's Office](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/), the UK's data regulator, says the Act opens up more lawful reasons for making significant automated decisions, as long as safeguards apply. It also says organisations must acknowledge complaints within 30 days. The department's checklist repeats this for schools.

For parents and pupils, the checklist says people must be told when an automated decision is made. They must be able to challenge it and ask for a human review. People should normally complain to the school before going to the regulator.

Schools can now pause the one-month limit on a request for personal data if they need clarification. They need only make reasonable and proportionate searches.

The checklist gives no examples of which school systems count as automated decision-making. It sets no date for finishing the review. It does not say how many schools use such systems.

## Sources

- Department for Education (GOV.UK): [Data (Use and Access) Act 2025: compliance checklist for schools](https://www.gov.uk/guidance/data-protection-in-schools/data-use-and-access-act-2025-duaa-compliance-checklist-for-schools)
- Department for Education (GOV.UK): [Data protection in schools](https://www.gov.uk/guidance/data-protection-in-schools)
- Information Commissioner's Office: [The Data (Use and Access) Act 2025: what does it mean for organisations](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/)

Picture: rrafson, CC BY-SA 3.0, https://commons.wikimedia.org/wiki/File:File_Cabinet.jpg

Web page: https://codeyoink.com/news/dfe-schools-automated-decisions-checklist