Guidance

General Data Protection Regulation: learning records service (LRS)

Updated 15 September 2021

Applies to England, Northern Ireland and Wales

漏 Crown copyright 2021

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: [email protected].

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at /government/publications/lrs-help-and-support/general-data-protection-regulation-learning-records-service-lrs

The Education and Skills Funding Agency (ESFA) closed on 31 March 2025. All activity has moved to the Department for Education (DfE). You should continue to follow this guidance.

1. General Data Protection Regulation (GDPR)

The General Data Protection Regulation (GDPR) comes into force on the 25th May 2018. It regulates the processing of personal data inside the EU and EU residents. GDPR replaces the Data Protection Act 1998 in the UK.

In order to incorporate recent changes in data protection regulation, as well as our commitment to transparency, we have updated our privacy notice.

The revised privacy notice clearly communicates to individuals the lawful basis for processing their personal data, summarising the information held on record about them, why it鈥檚 held and the third parties the data is shared with.

2. Implications of GDPR changes

To meet the requirements of GDPR, local authorities, schools, academies, Further Education institutes and Higher Education (referred to as Learner Registration Bodies (LRB) by the learning records service (LRS)) continue to be responsible for issuing a copy of the privacy notice to learners and/or parents/guardians.

For the purposes of relevant data protection legislation permitted organisations registered with LRS do not require consent from learners/citizens to issue a ULN or share their personal learning record (PLR). Going forward learner/citizens won鈥檛 have the option to opt out of sharing their PLR.

Historically, where a learner/citizen has opted out of sharing their PLR, the flag will remain in place. Post 25th May, where an LRB needs access to an individual鈥檚 PLR, the organisation is responsible for informing the learner/citizen in accordance with the revised agreement that it will access the PLR and the basis for accessing the data by providing a copy of the latest privacy notice. Only at that point does the LRB have the right to overwrite the consent status that allows them to view the record.

3. Important Information

  • LRB鈥檚 must provide a copy of the Privacy Notice to the learner.

  • By default, the PLR is available to permitted organisations where the Privacy Notice is provided.

  • Learner鈥檚 cannot opt out of sharing their PLR.

4. Further Changes

There are further changes required over the next 12-months:

  • System changes to the LRS Organisation Portal. (No immediate change to web service operations. These will continue to be backward compatible).

  • Amendment to all agreements including Provider and Awarding Organisation.

  • Amendment to user-guides.

  • Publish new web service operations versions.

5. Question

How do I comply?

LRB鈥檚 currently send the consent status to LRS containing one of three values:

  1. Privacy notice not seen 鈥� unable to share.
  2. Privacy notice seen and able to share.
  3. Privacy notice seen and unable to share (learner has opted out). Under the new consent model, this option no longer applies.

For the immediate time, please only use option 1 or 2.

Further comms to follow confirming portal changes to reflect the new consent model.

Back to top