Updated on 10/11/2026.
In this article, I will cover everything you need to know to make a LearnDash-developed course platform compliant with the UK GDPR in 2027.
My name is Wellington Duarte, a LearnDash developer focused on the UK. I hope this article helps. In 2016, the European Union approved the GDPR (General Data Protection Regulation), and in 2018 it came into full effect. The focus of the GDPR is to require companies to handle personal data on the internet responsibly.
All of this became necessary due to scandals involving major companies and data breaches affecting users, both in Europe and in other countries. Just to refresh your memory: Yahoo 2013 – Even though it is an American company, it suffered two major attacks between 2013 and 2014, compromising 3 billion accounts.
As the GDPR was not in force at the time, the fines applied by European data protection authorities were considered insignificant compared to the damage caused. The ICO (Information Commissioner’s Office) issued a fine of £250,000 in 2018 in connection with the 2014 breach, the maximum limit under the previous law. This case was considered one of the most serious incidents in the history of the internet.
Stolen user data can be used for espionage, sold on the dark web, used in email spam campaigns, and for phishing to steal banking information. As many users reused the same password across multiple websites, criminals were able to use leaked “email and password” combinations to access other platforms. You can read more about this scandal here.
Other major breaches occurred before the GDPR was created, such as the TalkTalk case and Ashley Madison in 2015, and Cambridge Analytica, revealed in 2018, shortly before GDPR enforcement. This case was a catalyst for public support for stricter regulation. With all of this happening, a massive effort was needed within the European Union to address these issues.
GDPR in the United Kingdom after Brexit
Between 2020 and 2021, the United Kingdom left the European Union. So what happens to GDPR in this case? The UK decided to largely retain the same law, creating the British version called the UK GDPR. In addition to being an extremely important regulation that inspired similar versions around the world, it was essential to maintain it so that the UK could continue sharing data with European companies. In December 2025, the European Commission renewed its adequacy decisions for the UK, helping personal data continue to flow between the EU and the UK. In the UK, things have remained largely the same, such as:
- Websites must have a lawful basis for using personal data and obtain consent where required.
- Explain how this data will be used.
- Protect this information from breaches.
- Respond to requests to delete personal data, subject to the legal exceptions.
How does the UK GDPR differ from the GDPR?
- UK data protection is overseen by the ICO, independently from EU data protection authorities;
- Creation of the IDTA (International Data Transfer Agreement) for transferring data outside the UK, instead of the EU SCCs;
- Autonomy to decide which countries are considered safe, independently from the EU;
- A DPO (Data Protection Officer) is still required for certain organisations, depending on their data processing activities;
- Some additional exceptions to cookie consent requirements, subject to specific safeguards.
In September 2026, the regulator also transitioned to a new governance structure called the Information Commission, while continuing to use the ICO name. This is why it is very important to understand the evolution of these laws when building a course platform with LearnDash on WordPress, especially when handling data from both UK and EU students. That is why it is important to talk about the DUAA.
What is the Data (Use and Access) Act 2025 (DUAA)?
The Data (Use and Access) Act 2025 (DUAA) is a UK law that updates certain data protection rules, including the use of some “non-intrusive” cookies such as those used solely for statistical purposes. It received Royal Assent in June 2025, and its data protection provisions came into force in stages through June 2026. You can read about the Data (Use and Access) Act (DUAA) on the ICO website. In summary, it represents the UK trying to make data usage rules more practical for businesses, without abandoning user protection, while reducing bureaucracy. It is important to understand that the DUAA does not eliminate the UK GDPR; it updates some of its rules, including the following:
- Certain cookies used solely for statistical purposes may be used without prior consent, provided users are clearly informed and have a simple, free way to object;
- Legitimate interests may support some marketing activities, but promotional emails must still comply with the Privacy and Electronic Communications Regulations (PECR), including consent or a valid “soft opt-in” where applicable;
- Clearer rules for research and certain automated decisions involving personal data, while safeguards continue to apply;
- Some rules have been clarified or simplified for organisations, but privacy documentation and accountability obligations have not disappeared.
To learn more about all the changes introduced by the DUAA, click here.
How should a LearnDash course platform be protected?
It is important to understand that rules for course platforms in the United Kingdom are strict, and a LearnDash developer must be aware and up to date, as non-compliance can result in significant fines.
What data does a LearnDash course collect?
- User’s full name
- Email address
- Course progress
- Grades and performance
- Study time
- Sometimes: location, IP address, and behaviour within the platform
Generally, these are the main data collected. If you expand into a course + community platform (e.g. BuddyBoss), the volume of data increases. This is already considered relevant personal data that requires protection. Learn more about the data that LeanDash collects here.
What the ICO requires for online courses
- A lawful basis, such as a contract, for processing data needed to deliver the course;
- User consent for marketing and promotional emails, unless a valid legal exception applies.
In this case, you may use the user’s email to send course access information, and if they opt in to marketing, you may send promotional content. A limited “soft opt-in” may also apply to marketing similar courses to existing customers if the PECR conditions are met. However, sending spam without a lawful basis is not allowed. You must have a clear Privacy Policy page (no generic templates), explaining:
- What data your course platform collects, why it collects it, how it is used, and with whom it is shared.
User control
- Allow students to request a copy of their data, correct their information, and request deletion where the right applies. The right to deletion is not absolute.
- Provide a clear way for students to make data protection complaints, acknowledge complaints within 30 days, and respond without undue delay, as required since June 2026.
Data security in LearnDash
- You must protect student data using HTTPS, access controls, and breach prevention measures.
Cookies should be controlled, and data collection should be limited to what is truly necessary, such as avoiding collecting addresses unless required (e.g. for VAT calculation). If the LearnDash course platform targets children, the rules are stricter and may require parental consent. You can read more about the Age Appropriate Design Code.
Database organisation
- The ICO expects platforms to store only necessary data, use encryption, access controls, and protection against breaches.
This is why, when developing a LearnDash website, I align protection, design, accessibility, and security. More importantly, it is essential to understand who your students are and what data will be collected.
Mistakes to avoid in your LearnDash course
- Capturing emails and immediately adding them to a marketing list without consent;
- Not having a clear and updated privacy policy;
- Using Google Analytics or other tracking tools before obtaining consent, unless the specific setup qualifies for a legal cookie exception;
- Not providing a way to request account or personal data deletion where applicable;
- Sharing data with tools without informing users.
If you are migrating from another course platform to LearnDash or a custom solution, it is important to understand how the current platform handles student data before migrating, and to inform users about relevant changes. A new consent request is not always necessary if there is already an appropriate lawful basis for the processing and any international transfer requirements are met.
Frequently Asked Questions
What fines can I face if my LearnDash course does not comply with UK GDPR?
Going into 2027, the ICO remains responsible for overseeing compliance, so data protection remains essential. Fines under the UK GDPR vary by severity:
- Level 1 – Administrative infringements: failures in record-keeping, breach notifications, or lack of a DPO where one is required. Fine: up to £8.7 million or 2% of global annual turnover (whichever is higher).
- Level 2 – Serious infringements: violation of core processing principles, lack of legal basis (invalid consent), or failure to respect data subject rights. Fine: up to £17.5 million or 4% of global annual turnover (whichever is higher).
Of course, the ICO does not automatically apply the maximum fine. They assess factors such as the nature and duration of the breach, intent, type of data involved, and other criteria. Under the DUAA, the maximum fines for certain breaches of the PECR, including electronic marketing and cookie rules, have also increased to £17.5 million or 4% of global annual turnover, whichever is higher.
What is the best setup to ensure my LearnDash site complies with UK GDPR?
- Prior cookie blocking: tracking scripts generally require consent, except where a specific legal exception applies;
- Marketing consent where required (no pre-ticked boxes), or a valid soft opt-in;
- Use plugins such as Complianz or CookieYes, configured for UK jurisdiction;
- Configure LearnDash registration forms to collect only essential data;
- Student dashboard with clear data, editing options, and a way to request account deletion where applicable;
- Hosting: UK hosting may simplify some arrangements, but is not mandatory; check the rules for international data transfers when using overseas providers;
- 2FA (two-factor authentication) strongly recommended for admins and instructors;
- Database encryption;
- Custom privacy notice (avoid generic templates);
- DPA: if hiring a marketing agency, ensure a signed agreement detailing data processing;
- ROPA (Record of Processing Activities): maintain a simple record of what data you collect, where it is stored, why it is needed, and when it will be deleted.
These optimisations can help protect your LearnDash course from fines of up to £17.5 million.
