API Development for UK EdTech — ICO AADC Built In

MIS API Integration Standards

UK EdTech APIs must integrate with school Management Information Systems (MIS). Key MIS systems: SIMS (Capita, ~50% UK market share — requires Capita Developer Programme enrolment), Arbor (REST API, open), Bromcom (REST API, open), SchoolBase (SOAP API). DfE's ambition: a common interoperability framework for EdTech APIs. ClickMasters builds to DfE's published interoperability guidance.

UK GDPR for EdTech API Data Flows

EdTech API data flows must be UK GDPR-compliant. Key considerations: data minimisation (APIs should only return the fields genuinely needed — not full pupil records for a class list query), purpose limitation (pupil data from MIS APIs must only be used for the stated educational purpose), and data processor obligations (the EdTech platform is processing school pupil data as a data processor under Article 28).

GDS API Design for EdTech

EdTech APIs used by schools (which are often public sector bodies) should follow GDS API design guide principles: REST, versioned endpoints, JSON, OpenAPI 3.0 documentation, OAuth 2.0 authentication, and clear deprecation policies. Schools expect the same API quality standards from EdTech suppliers as from government digital services.

Safeguarding Data in EdTech APIs

EdTech APIs handling safeguarding data require elevated security. KCSIE (Keeping Children Safe in Education) data (incidents, referrals, case notes) should: never be returned in bulk API responses, require per-pupil authorisation with DSL (Designated Safeguarding Lead) oversight, maintain comprehensive audit logging, and have data retention policy aligned with local authority statutory guidance (typically 25 years for child protection records).

ICO AADC

UK GDPR

DfE interoperability standards

GDS API design guide

MIS API standards