Privacy notice for an online course provider

An online course business collects data before the sale (the lead magnet, the webinar registration, the funnel), during the course (progress, assessments, forum posts, support tickets) and after it (certificates, testimonials, the next course), across a learning platform, a payment processor, an email tool and a community forum that each hold part of it. The privacy notice has to describe the whole journey, state the right basis for each stage, deal with children where a course might reach them, and set the retention for the records that prove a learner completed. The pack (privacy notice, cookie notice and consent guidance) is drafted for the business for £595, fixed, in five working days.

Who this is for

Course creators, e-learning businesses, training providers moving online, coaches selling programmes and membership communities in England and Wales selling to consumers or businesses.

What matters in an online course privacy notice

Learners, their progress and the platform that records it

Article 13 of the UK GDPR requires the business, as controller, to tell learners what it collects: account and contact details, payment data handled by the processor, course enrolments, progress, assessment results, forum posts and comments, support correspondence, video viewing data and the device and usage data the platform logs; the learning platform (a hosted course platform or a learning management system) holds most of it as the provider's processor under Article 28, often outside the United Kingdom under the safeguards Article 46 requires, and the notice should describe the platform, what it records, and whether the platform uses the data for its own purposes (some hosted platforms do, as controllers, under their own notices).

The lawful basis for teaching, assessing and certifying

The course purchase is a contract, so the processing the course requires (enrolment, access, progress tracking, assessment, certificates, support) rests on Article 6(1)(b) of the UK GDPR, the provider's own improvement of the course and its analytics on legitimate interests under Article 6(1)(f), and legal obligation under Article 6(1)(c) for the payment records tax law requires and, for accredited or funded courses, the records the awarding body or the funder requires; the notice should state the bases and should reserve consent for the optional (marketing, testimonials, the community where it is optional), because a learner who is told their progress data is processed on consent can withdraw it and ask for the record of their completion to be deleted.

Children, parents and courses that minors may buy

Where a course is aimed at or likely to be used by children, the Information Commissioner's age appropriate design code under section 123 of the Data Protection Act 2018 applies to the platform with its standards on defaults, profiling and language, consent for the service is valid only from thirteen under section 9 of that Act (below which the parent consents), the purchase is usually the parent's contract, and the notice should say whether the course is for children, how age is handled, who exercises the child's rights and what the parent may see; a course for adults should say so and should not collect data suggesting otherwise.

Marketing, funnels and the data a course business collects before the sale

The lead magnet, the webinar registration, the free trial and the email sequence collect data from people who have bought nothing, and the soft opt-in apart, regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 requires consent for electronic marketing to individuals (which covers a person who registered for a free course or webinar as negotiations for a sale, where they were given the chance to refuse at registration and in every message); the notice should state the basis for the sequence, the sign-up should implement it (an unticked box or a clear statement at the point of registration), every email should carry an unsubscribe, and the tracking pixels in the emails and the advertising pixels on the funnel pages need the consent mechanism under regulation 6 of those Regulations.

Communities, testimonials and the data learners share with each other

A course community (a forum, a group, a live cohort) discloses learners' names, posts and sometimes their progress to each other, and the notice should say what is visible to whom, how a learner controls their profile, the rules on recording live sessions and who may see the recordings, the provider's moderation and retention of posts, and the position when a learner leaves (their posts remain unless removed); testimonials, case studies and results shared in marketing need the learner's consent, revocable, with the content removed when it is withdrawn, and the notice should say so, because a learner's transformation story used in an advertisement after they asked for it to come down is the complaint.

Retention, certificates and the records that prove completion

The notice should state the retention: account and progress data while the account is active and for a stated period after, completion and certificate records for a longer period so that the provider can verify a certificate when an employer asks (which is a legitimate interest the notice should state), payment records for the period tax law requires, marketing data until consent is withdrawn, and community content as the community rules provide; it should cover the rights of access, rectification, erasure, restriction, portability and objection, the means of exercising them, the one-month response period, and the complaint route to the Information Commissioner's Office, and the notice should give the registration number the business holds with the Information Commissioner's Office under the Data Protection (Charges and Information) Regulations 2018.

What it costs

Website privacy and cookies pack, £595. Privacy notice, cookie notice and consent guidance. Five working days.

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Buying online forms the engagement on payment. The scope is what the data protection agreements and privacy terms page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

Can we email people who downloaded our free guide?

Under the soft opt-in, where the download was in the course of negotiations for a sale and they could refuse at registration and in every message, or with consent. The notice states the basis and the sign-up implements it.

Our course community is on a third-party platform. Who is the controller?

The provider, for the community it runs, with the platform as processor or, where the platform uses the data for itself, as a controller too. The notice says what is visible to whom and what happens when a learner leaves.

How long do we keep completion records?

Longer than the account: for the period the provider needs to verify certificates when employers ask, which the notice states as a legitimate interest. Payment records follow tax law.

Related guidance and services

• Data protection agreements and privacy terms, £595, the service this page describes
• Terms and conditions drafting, £995
• SaaS and technology contracts, £995
• Terms and conditions for an online course
• Privacy notice for a newsletter

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.