A data litigation wave is hitting schools - here's how to respond

There was a time when data protection litigation involving schools rarely crossed our desks.

However, it has quickly risen up the education legal agenda, and we’re handling at least a couple of cases a month where schools and trust require support.

We expect this trajectory to continue unless schools take a strategic view and implement proactive, preventative steps.

Why is this happening?

There seems to be a mix of reasons behind this.

Firstly, trust in institutions is declining. More people are using their data rights as a tool for complaint or information gathering, and people have a greater willingness to use subject access requests (SARs) to hold organisations to account.

Implemented last week under Section 164A of the Data Protection Act 2018, a new statutory right for individuals to complain directly to schools and trusts regarding how their personal data is handled will further increase public awareness of their rights.

Secondly, the rise in AI means it is easier than ever for complaints to be raised. We have certainly seen many more AI-based complaints and requests made that would previously have been resolved informally, if they had arisen at all.

Leaders have also noted this, with 45 per cent of respondents to our spring 2026 School Leaders Survey observing an increase in complaints that appeared to be AI-generated in the prior 12 months.

Meanwhile, nine in 10 leaders said parents were escalating complaints to formal stages quicker - 59 per cent said this is happening much more quickly.

This all means that informal resolution is being bypassed to involve governors, Ofsted and the Department for Education, or the threat of legal action.

AI as an amplifier

So not only is AI removing the practical barriers that previously meant most of those disputes remained informal; it is also increasing the legal risk.

AI tools generate lengthy, legalistic correspondence, and once the SAR or complaint is in, the grounds for a “letter before claim” (which, if not responded to properly, progresses to a county court) are being generated with the same tools - and the same speed.

As such, an SAR or a data breach that isn’t handled well becomes a letter before claim, and can quickly lead to a costly and time-consuming legal battle.

For academy trusts, those consequences carry a particularly tricky edge.

Settlements relating to data breach or rights requests “distress” claims could constitute “novel, contentious or repercussive (NCR)” expenditure, requiring prior DfE approval under the Academy Trust Handbook.

Failure to obtain DfE approval and being in breach of the handbook could result in a wide range of sanctions against the trust.

Managing data protection litigation claims

So what can schools and trusts do?

The single most important thing is to build an audit trail before it’s needed - not in response to a threat, but as a natural product of doing the work properly in the first place.

When a pre-action letter arrives, an organisation that has documented its previous work carefully can respond to information requested in sufficient detail and with confidence.

The best-case scenario is that a potential claimant stands down, but if a claim does arrive, schools should take the following proactive steps:

• Notify insurers promptly. Delayed notification may affect coverage, so as soon as there is any mention of compensation or legal action, or where there is a reasonable belief that an incident could give rise to a claim, notify.
• Do not respond without thinking. Avoid making settlement offers or admitting liability without legal guidance. For trusts specifically, check the NCR provisions in the Academy Trust Handbook before making any payment, as prior DfE approval will almost certainly be needed. Paying without it may create a far larger problem than the claim itself.
• For settlements involving children, know the additional requirements. Under civil procedure rules, these would require court approval, even if agreed between the parties before proceedings begin. The claimant’s representatives need to issue proceedings seeking approval, and a district judge considers whether the settlement is reasonable and in the child’s best interests. Settlement funds are often held via the Court Funds Office until the child turns 18.
   

Governance and prevention

Finally, schools and trusts that have identified the rising risk surrounding data protection litigation should bring the full picture to governors, covering the reasons and patterns behind complaints and SARs, plus resource costs, to make the case for treating this as an organisational risk that requires a strategic response.

Responsibility should not be quietly delegated downwards and forgotten. The people managing these processes need support, acknowledgement of their workload, and the authority to escalate when the existing approach is not sustainable.

Most of the data protection claims we’re seeing - and the ones we expect to see in far greater numbers over the next 24 months - aren’t the inevitable product of genuinely complex or disputed facts.

They’re the product of processes that weren’t robust enough, documentation that wasn’t comprehensive enough, and responses that weren’t good enough.

This is fixable, and considerably cheaper than defending the claim.

Claire Archibald is legal director and Dai Durbridge is a partner at UK and Ireland law firm Browne Jacobson, specialising in data protection, AI governance and education law