Sensitive pupil data is ‘travelling home unprotected with teachers every night’, report says
Devices used by teachers lack encryption, and schools have inadequate safety measures in place to keep personal information secure
Teachers and schools have inadequate protections in place for the sensitivity of the data held
Only a quarter of UK teachers encrypt sensitive pupil data on their devices, according to new research, and a fifth don’t know what protections their school has in place.
Most schools could not lock or wipe a staff laptop if it were lost or stolen, even though teachers routinely carry pupil data home, the survey found.
The research, carried out by YouGov for the technology company ASUS, surveyed 1,013 UK teachers.
Fewer than three in ten - 28% - of school staff said their school could remotely wipe a device and a similar number, 29%, said the school could lock one.
This is despite more than eight in ten teachers regularly holding pupil information on a school device, or staying logged in to systems that hold it.
Nearly 60% take a device home in the evenings and at weekends – equating to around half a million teachers.
More than half of respondents said they hold pupil assessment data and almost 40% keep emails containing pupils’ names.
Around a third keep behaviour logs, safeguarding or child protection records, or information on pupils with special educational needs. One in five admitted they have pulled files from their school’s management information system and saved them straight onto their device.
A child protection issue
Teachers are often the least aware of what protects them. Senior leaders were more likely than classroom teachers to know whether their school could remotely lock a lost device, 39% compared with 24%. Fewer than half, 49%, said their school had clear guidance on who to contact first if a device went missing.
The research was published as rules have tightened around sensitivity of information in the UK. Keeping Children Safe in Education, the statutory guidance every school in England must follow, now directs schools to the Department for Education’s (DfE0 cyber security standards.
Schools have until 2030 to meet them, and the standards require them to lock, wipe and account for every device. On the DfE’s own figures, just 18% of secondary schools and 21% of primaries meet all six.
Lost and mislaid devices are a recognised route to a breach. In its September 2025 analysis of insider data breaches in schools, the Information Commissioner’s Office found that one in five involved staff sending data to personal devices.
A lost laptop with a child’s safeguarding record on it, the new ASUS report – Keeping Control, Protecting Data– argues, is a child protection matter as much as a technical one.
The report found that training was also patchy. Fewer than half of teachers, 46%, had any device security training in the past year.
Security gaps
Nick Mitchinson, commercial marketing lead at ASUS Education, said: “Teachers work the way every profession with a laptop works. They take devices home, and they keep up in the evenings.
“In most sectors, if a device goes missing, it is encrypted and can be wiped within minutes. In too many schools, it can’t.
“That is not a failing on teachers’ part. It is a gap in what schools have been able to put around them.
“The question a school needs to answer is a simple one. If a device went missing today, would anyone know what was on it, or be able to do anything about it?”.
Claire Archibald, legal director in the education team at law firm Browne Jacobson, added: “The findings should prompt senior leaders to think about how their students’ data is being handled. Even a small number of teachers leaving devices signed-in, or allowing others to use their school-issued device, exposes every pupil to risk.
“These statistics point to a serious communication gap between what data protection training says and what is happening in classrooms every day.”
