What UK GDPR and ICO guidance means for social media trainers handling learner data?

What to take away

Who is controller and who is processor when a trainer handles learner data

A social media training provider running its own open courses decides why and how learner data is used. That makes it the controller for bookings, attendance records, assessment results and certificates.

The UK GDPR guidance and resources published by the ICO set out those core obligations, including the accountability principle and the need to document decisions.

The picture changes on in-house contracts. When an employer hires a trainer to deliver a course to its own staff, the employer usually sets the purpose and the trainer processes data on its behalf. The trainer is then a processor, and Article 28 of UK GDPR requires a written contract before any personal data changes hands.

Many trainers do both in the same week. A freelancer might sell places on a public workshop on Monday and deliver a private session for a housing association on Tuesday. The role depends on the engagement, not on the size of the business.

Getting this wrong has practical consequences. A processor that starts using learner contact details for its own marketing has stepped outside its instructions and may become a controller for that use, with its own lawful basis to find.

A useful test is to ask who answers a learner complaint. If the learner complains to the trainer about how their data was used, and the trainer decides the response, the trainer is probably the controller for that processing.

Why the distinction matters in practice

Controllers carry the main compliance duties: lawful basis, privacy information, handling subject access requests and breach reporting. Processors must follow instructions, keep records, help the controller respond to requests, and tell the controller about breaches without undue delay.

For employers buying training, the contract should state the subject matter, duration, nature and purpose of processing, the types of personal data, and the categories of learner. It should also cover sub-processors, security, deletion on exit and audit rights.

Trainers who subcontract associate facilitators need to pass those terms down. A missing clause at the second level is a common gap found after an incident, when the employer asks who else held the learner list.

A role split holds together better when each duty is mapped role first and the rule attached afterwards, rather than starting from a template policy.

Regional and sector variation

Delivery patterns vary across the UK. Providers in Greater London often run short central London workshops for agencies, while trainers in North West England and Yorkshire and the Humber deliver more on-site sessions for manufacturing and logistics employers.

Scottish providers may work with Skills Development Scotland funded programmes, and Welsh or Northern Irish employers may combine internal training with funded adult skills provision.

Funding adds a data-sharing layer. Where a course is part-funded through Department for Education adult skills funding or a devolved equivalent, the funder may require enrolment and outcome data. The trainer needs a clear lawful basis for that sharing and should tell learners who receives what.

Professional bodies matter too. Trainers delivering Chartered Institute of Marketing or Chartered Institute of Public Relations accredited content often collect membership numbers or continuing professional development records. Those records are personal data and fall inside the same rules.

Choosing a lawful basis for learner records and marketing lists

There is no single correct basis for all learner data. The ICO's A guide to lawful basis requires trainers to identify a basis for each purpose before processing starts, and to document it. Choosing late and working backwards is where most small providers come unstuck.

Course administration usually rests on contract or legitimate interests. If a learner buys a place, processing their name, payment details and attendance record is necessary to perform that contract. Legitimate interests can cover related uses such as fraud prevention or improving course materials, provided a balancing test is recorded.

Marketing is different. Sending a newsletter about future social media training to past learners is electronic marketing, and PECR applies on top of UK GDPR. Consent is the safest basis for individuals, and it must be specific, informed and easy to withdraw.

Special category data needs more care. Trainers sometimes collect accessibility requirements or health information to arrange adjustments. That is special category data and needs an Article 9 condition as well as a lawful basis, such as explicit consent or the provision of health care.

Consent and the soft opt-in

For business-to-business marketing to corporate email addresses, PECR still applies where the recipient is a sole trader or partnership. Many trainers assume B2B is exempt; it is not.

The soft opt-in can cover existing customers. If a learner bought a course, the provider may email similar courses, provided the address was collected in that sale, the learner was told about marketing and given a chance to refuse, and every message offers an easy opt-out.

Consent records need to stand up later. Keep the wording shown, the date, the source and the method. A checkbox buried in terms and conditions rarely counts as valid consent.

Building a lawful basis register

A simple register works better than a long policy. List each processing purpose, the data involved, the lawful basis, the retention period and the owner. Review it when a new course, platform or funding stream starts.

Trainers selling through a marketplace or platform should check who is the controller for the booking data. The platform may be an independent controller for its own purposes, which needs to appear in the privacy information.

Where a trainer also advises clients on compliance, the same register can become a teaching aid. It shows learners how purpose and basis connect, which is more useful than a slide listing the six bases.

Consent, cookies and PECR rules for course websites

Course websites collect more data than most trainers realise. Enquiry forms, chat widgets, embedded videos, payment pages and analytics all set or read information on a learner's device, and the Guide to Privacy and Electronic Communications Regulations | ICO explains the rules that follow.

PECR requires consent for non-essential cookies and similar technologies. Analytics cookies that measure how visitors use the site are not strictly necessary, so they need consent before they run. The same applies to advertising pixels and most embedded media players.

Consent must be freely given, specific and informed. A banner that only offers accept, or that continues tracking after a user ignores it, does not meet the standard. Rejecting should be as easy as accepting, and consent should be refreshed when purposes change.

Cookie banners and consent records are also a governance question, not just a web design one. Trainers who treat pecr run as a separate gate from UK GDPR tend to keep cleaner consent logs than those who fold everything into one privacy notice.

Email, SMS and phone marketing

Electronic marketing to individuals needs consent, or the narrow soft opt-in. That covers email, SMS, and automated calls. Live calls to numbers not on the corporate opt-out list follow different rules, but the safe approach for a small provider is to rely on consent.

Every marketing message needs a valid sender identity and a working opt-out. Unsubscribe requests must be honoured promptly, and a suppression list should be kept so removed contacts are not re-added at the next list clean.

Buying a list is almost never compliant. The people on it have not consented to hear from the trainer, and the seller's consent may not transfer. This is one of the most common sources of ICO complaints against training businesses.

Website checks trainers can run

Data retention, subject access requests and erasure for learner records

Retention is where trainers most often drift. Records pile up in learning platforms, inboxes and spreadsheets long after the course ends. UK GDPR requires data to be kept no longer than necessary, so each category needs a stated period and a deletion route.

A practical schedule might keep booking and payment records for six years to meet tax and accounting needs, assessment records for three years to support certificate verification, and marketing consent until it is withdrawn. Anything without a purpose should go.

Deletion must reach backups and third-party platforms. If learner data sits in a learning management system, a payment processor and an email tool, all three need a retention setting or an annual clean.

Learners can ask what is held about them. The Subject access requests (also known as SARs or right of access) | ICO guidance explains that a request can be made verbally or in writing, does not need a specific form, and should normally be answered within one month.

Handling a subject access request from a learner

If the request is complex, the one-month clock can be extended by a further two months, but the learner must be told why within the first month. There is normally no fee.

Erasure and other rights

The right to erasure is not absolute. A learner cannot delete a payment record the provider must keep for tax purposes, and an employer may need assessment records to defend a competence decision. Trainers should explain the limits rather than refuse outright.

Other rights follow the same pattern. Learners can ask for inaccurate records to be corrected, object to processing based on legitimate interests, and ask for data portability where processing is based on consent or contract and carried out by automated means.

A worked example makes this concrete. A Manchester agency books four staff onto a social media training course. One learner asks for a copy of everything held about them. The trainer checks the booking system, the assessment platform, the finance records and the trainer's inbox, redacts the other three learners' details, and replies within three weeks.

The finance record stays for the tax retention period; the marketing consent is honoured when the learner withdraws it.

Breach reporting duties under the Data Protection Act 2018

The Data Protection Act 2018 sits alongside UK GDPR and sets the framework the ICO enforces. It also creates offences for some unlawful acts, including knowingly or recklessly obtaining, disclosing or procuring personal data without consent.

Any security incident that causes personal data to be destroyed, lost, altered, disclosed without permission, or accessed by accident or unlawfully is a personal data breach. It is not limited to hacking. Sending a learner list to the wrong recipient is a breach.

Where a breach is likely to result in a risk to people's rights and freedoms, the controller must report it to the ICO within 72 hours of becoming aware of it. The UK GDPR data breach reporting (DPA 2018) | ICO page sets out the assessment and the reporting route.

High risk breaches also need telling the affected learners without undue delay. That includes breaches involving special category data, or where a learner list with contact details has gone to someone who should not have it.

What a report needs

The report should describe the nature of the breach, the categories and approximate number of people affected, the likely consequences, and the measures taken or proposed. Trainers rarely have every detail within 72 hours, and that is acceptable: report what is known and update later.

Processors must tell controllers without undue delay, which is why the contract clause matters. A training platform that spots an unauthorised login should not sit on it while it investigates alone.

Keeping a breach log

Every breach should be logged, even those not reported, with the facts, the decision and the reasoning. The ICO can ask to see the log, and a documented decision not to report is evidence of accountability.

Trainers should rehearse the process before they need it. A one-page plan naming who decides, who reports and who contacts learners turns a panic into a checklist. Employers sharing learner data with a provider should agree the same plan in the contract, covering notification times and points of contact.

Practical steps for trainers and employers sharing learner information

Most problems between trainers and employers come from unwritten assumptions. The employer assumes the trainer will delete the learner list on request; the trainer assumes it can keep the list for future marketing. Both assumptions need a contract.

Start by mapping the data. List every system that touches learner data, from booking forms to certificates, and note who controls each. This is the same exercise as checking a training vendor's identity, data flows and exit terms before purchase, and it belongs in the procurement file.

Then agree the split of duties. Who answers a subject access request from an employee who attended the course? Who reports a breach to the ICO? Who tells the learner about the privacy notice? Put answers in writing.

Retention and exit terms come next. State how long each party keeps learner records, what happens to shared platforms at the end of the contract, and how data is returned or deleted. A provider that cannot delete on exit is a risk to the employer's own retention schedule.

A short checklist for the contracting stage

Where UK rules bite differently

UK rules differ from US practice in ways that catch trainers out. PECR governs electronic marketing and cookies, so a US-style newsletter signup with pre-ticked boxes will not do. The ICO can fine organisations, and it publishes enforcement action, so reputation risk is real even for small providers.

Ofqual recognition matters for qualifications, not for data protection, but it affects what records a provider must keep. Awarding bodies often set their own retention rules for assessment evidence, which sit alongside UK GDPR requirements rather than replacing them.

Tax rules also shape retention. HM Revenue and Customs expects business records to be kept for at least six years from the end of the relevant accounting period, which usually sets the floor for finance-related learner records.

Trainers should also watch the marketing claims they make about compliance. The Advertising Standards Authority expects evidence for claims, so a course promising that learners will be fully compliant after one day needs qualification. The same honesty applies to privacy notices: describe what actually happens to learner data, not what a template says.

Making it routine

Compliance works when it is boring. Add a data protection line to the course booking process, review the lawful basis register each quarter, and run one breach rehearsal a year. Small habits beat long policies.

Trainers who teach social media should expect scrutiny of their own practice. A learner who sees a non-compliant cookie banner on the course website will question the rest of the content. Getting the basics right is part of the product.

Common questions

Do I need consent to hold learner records?

No, not usually. Course administration is normally covered by contract or legitimate interests. Consent is better reserved for marketing and for anything optional, because it can be withdrawn at any time.

Can I email past learners about new courses?

Only with consent or under the soft opt-in. The soft opt-in requires that the address came from a previous sale, that marketing was mentioned at the time, and that every message offers a clear opt-out.

How long can I keep learner assessment records?

As long as you need them for a stated purpose. Many providers keep assessment evidence for three years to support certificate verification, while finance records usually stay for six years for tax reasons.

What happens if a learner asks for all their data?

You must respond within one month, providing a copy of the personal data and an explanation of the processing. Search every system, redact other people's data, and extend only if the request is genuinely complex.

Who reports a breach when an employer and trainer are involved?

The controller reports to the ICO. If the trainer is a processor, it must tell the controller without undue delay, and the controller then decides whether the 72-hour reporting duty applies.

Does PECR apply to business email addresses?

Sometimes. Sole traders and partnerships count as individuals, so consent rules apply. Corporate subscribers are treated differently, but many trainers rely on consent for all marketing to keep the position simple.