diff --git a/app/views/pages/terms_and_conditions.html.erb b/app/views/pages/terms_and_conditions.html.erb
index ed2e2ef4d7..9ffa7f5974 100644
--- a/app/views/pages/terms_and_conditions.html.erb
+++ b/app/views/pages/terms_and_conditions.html.erb
@@ -88,7 +88,7 @@
                 We do not warrant that the material on this site will be error free, that defects will be corrected, or that this site or the server that makes it available are free of viruses or represent the full functionality, accuracy or reliability of the materials.
             </p>
             <p>
-                We expressly reserve the right to remove any user from our Service. The Department is not obligated to sharing its reasoning.
+                We expressly reserve the right to remove any user from our Service. The Department is not obligated to share its reasoning.
             </p>
             <p>
                 We strongly advise against users incurring any expenses. The Department will not reimburse any costs.
@@ -98,7 +98,7 @@
             </p>
                 <ul class="govuk-list govuk-list--bullet">
                     <li>any action you may take as a result of relying on any information or materials provided on the Service or for any loss or damage suffered by you as a result of you taking such action. This includes, but is not limited to, indirect or consequential loss or damage, or any loss or damages whatsoever arising from, or in connection with, the use of the Service </li>
-                    <li>any dealings you have with third parties (for example, other users or advertisers) that take place using or facilitated by the Service.</li>
+                    <li>any dealings you have with third parties (for example, other users or schools) that take place using or facilitated by the Service.</li>
                 </ul>
          <h3 class="govuk-heading-s">Validity of these General Terms</h3>
             <p>
@@ -112,13 +112,13 @@
         <h3 class="govuk-heading-s">Applying for school experience through Get school experience</h3>
             <p>
                 The information you provide in your applications must be truthful, complete and accurate. A declaration is included in the application feature on the Service which, when agreed to on submission of an application, is considered valid and binding.
-                If, following submission of an application, you realise you’ve made an error, you’re responsible for contacting the advertising organisation directly to correct the error.
+                If, following submission of an application, you realise you’ve made an error, you’re responsible for contacting the school directly to correct the error.
             </p>
             <p>
                 By applying for school experience through the Service, you agree that you must not submit an application that contains:
             </p>
                 <ul class="govuk-list govuk-list--bullet">
-                    <li>any material that encourages violence or racial or religious hatred or is false, misleading, defamatory, discriminatory, threatening, offensive, abusive, likely to cause someone anxiety or distress, blasphemous, pornographic, in breach of confidence, in breach of privacy, unlawful, harassing, libelous, harmful, vulgar, obscene, or otherwise objectionable</li>
+                    <li>any material that encourages violence or racial or religious hatred or is false, misleading, defamatory, discriminatory, threatening, offensive, abusive, likely to cause someone anxiety or distress, blasphemous, pornographic, in breach of confidence, in breach of privacy, unlawful, harassing, libellous, harmful, vulgar, obscene, or otherwise objectionable</li>
                     <li>offensive or inappropriate language, including but not limited to profanities or language pejorative of any group, such as racist, sexist or homophobic comments</li>
                     <li>material that infringes any intellectual property rights, such as copyright and trademarks (this means generally that you must own the rights in everything you submit or must obtain permission from the rights owner to submit the material)</li>
                     <li>material that's technically harmful (including, but not limited to, computer viruses, logic bombs, Trojans, worms, harmful components, corrupted data or other malicious software or harmful data)</li>
@@ -128,9 +128,6 @@
             <p>
                 Users must be approved before they're able to publish or manage school profiles and school experience applications for a school.
             </p>
-            <p>
-                If you're the first user who is creating a school profile (referred to as ‘onboarding’), this will be done through DfE support channels.
-            </p>
             <p>
                 Once the first user has been onboarded to a school, this user can add subsequent users to the school account.
             </p>
@@ -141,7 +138,8 @@
                 Users must not allow third parties to publish or manage school experience dates on behalf of their school.
             </p>
             <p>
-                If the Get School Experience team detects, or is alerted to, any usage of an account by third parties that user account will be deleted immediately and the user will no longer have access to publish or manage school experience dates for that school.
+                If the Get school experience team detects, or is alerted to, any usage of an account by third parties,
+                that user account will be deleted immediately and the user will no longer have access to the Service.
             </p>
         <h3 class="govuk-heading-s">Unacceptable use</h3>
             <h4 class="govuk-heading-xs">School experience listings</h4>
@@ -163,7 +161,7 @@
                 By accepting school experience applications through the Service, you agree that:
             </p>
                 <ul class="govuk-list govuk-list--bullet">
-                    <li>once you receive an application from a school experience candidate, it's your responsibility to adhere to General Data Protection Regulation (GDPR) requirements</li>
+                    <li>once you receive an application from a school experience candidate, it's your responsibility to adhere to UK General Data Protection Regulation (UK GDPR) requirements</li>
                     <li>you're responsible for destroying any digital, downloaded, printed or saved copies of a school experience request</li>
                     <li>you must not share requests received through the Service with anyone other than those involved in the school experience process from the school, trust, board or local authority</li>
                     <li>you must ensure that appropriate measures are in place to guarantee the protection of personal data in applications</li>
@@ -171,12 +169,28 @@
             <p>
                 As a school, it's your responsibility to decide if a school experience candidate complies with your DBS and safeguarding policies.
             </p>
-        <h3 class="govuk-heading-s">Data storage, retention and destruction</h3>
+        <h3 class="govuk-heading-s">Data processing, storage, retention and destruction</h3>
+            <p>
+                The Department for Education is the data controller for the Get school experience service.
+            </p>
+
+            <p>
+                As a data processor, you must use this data solely for the purposes of and processes required for the
+                 administering school experience placements.
+            </p>
+            <p>
+                You must store shared data securely in the United Kingdom. Data must not leave the UK without our permission.
+            </p>
             <p>
-                You must store shared data securely and have appropriate safeguards in place to protect data against unlawful or unauthorised processing. Personal data must be kept only as long as needed to carry out activities relating to administering school experience.
+                You must have appropriate technical and organisational safeguards in place to protect data against unlawful or unauthorised processing.
+                You must ensure to ensure that all Personal Data are sufficiently protected against any Personal Data Breach (as defined in Data Protection Legislation) and that the requirements of Article 32 of the UK GDPR are met at all times.
+                Personal data must be kept only as long as needed to carry out activities relating to administering school experience.
             </p>
+            <p> If you become aware of any Personal Data Breach, or unauthorised processing of data obtained through the service,
+                you must inform us by email at <%= link_to 'organise.school-experience@education.gov.uk', 'mailto:organise.school-experience@education.gov.uk' %> immediately.
             <p>
-                You must set an appropriate time limit, in line with GDPR requirements, for retaining data before erasure or review.
+                As a data processor, you must set an appropriate time limit determined by the data controller, in line with UK GDPR requirements, for retaining data before erasure or review.
+                We base this on the needs of the department and the law. We keep data for up to 7 years in this instance.
             </p>
             <p>
                 You should destroy the data when it is no longer needed, or when the retention schedule has expired.
@@ -184,7 +198,18 @@
             <p>
                 You should follow the National Cyber Security Centre (NCSC) guidance for secure sanitisation.
             </p>
-        <h3 class="govuk-heading-s">Access to the Service</h3>
+            <p>
+                You shall maintain complete and accurate records to demonstrate your compliance with these Terms and Data Protection Legislation.
+            </p>
+            <p>
+                For further information see GOV.UK's <%= link_to 'guidance on data protection in schools (opens in a new tab)', 'https://www.gov.uk/guidance/data-protection-in-schools', target: "_blank" %>.
+            </p>
+        <h3 class="govuk-heading-s">Subject Access Requests</h3>
+            <p>
+                As a data processor, if you receive a Subject Access Request in relation to the Get school experience service,
+                you must inform us by email at <%= link_to 'organise.school-experience@education.gov.uk', 'mailto:organise.school-experience@education.gov.uk' %> immediately.
+            </p>
+        <h2 class="govuk-heading-m">Access to the Service</h3>
             <p>
                 We will not be liable if for any reason the Service is unavailable at any time or for any period. From time to time, we may restrict access to all or some parts of the Service to users who have registered with us.
             </p>
@@ -197,18 +222,14 @@
             <p>
                 We retain the right to withdraw, without notice, school experience listings that breach these terms and to withdraw the access of users who breach them.
             </p>
-        <h3 class="govuk-heading-s">Listing data</h3>
-            <p>
-                Data ownership: schools have sole responsibility for maintaining the accuracy and appropriateness of the data contained in their listings.
-            </p>
-        <h3 class="govuk-heading-s">Department for Education (DfE) responsibility</h3>
+        <h2 class="govuk-heading-m">Department for Education (DfE) responsibility</h3>
             <p>
                 The DfE does not make any decisions on individual applications.
             </p>
             <p>
                 The DfE does not investigate complaints about individual applications.
             </p>
-        <h3 class="govuk-heading-s">Other policies</h3>
+        <h2 class="govuk-heading-m">Complaints, feedback and privacy notice</h3>
             <p>
                 You can <%= link_to 'make a complaint', 'https://form.education.gov.uk/service/Contact_the_Department_for_Education' %> or <%= link_to 'give feedback about this service', 'https://schoolexperience.education.gov.uk/candidates/feedbacks/new' %>.
             </p>
@@ -223,7 +244,7 @@
                 If you continue to use our service after the terms and conditions are updated, you agree to any of the changes we’ve made.
             </p>
             <p>
-                This version was last updated on 30 April 2024.
+                This version was last updated on 6 May 2024.
             </p>
     </section>
     </div>
diff --git a/app/views/schools/on_boarding/profiles/onboarding.html.erb b/app/views/schools/on_boarding/profiles/onboarding.html.erb
index 0c26901f73..be6393d8a7 100644
--- a/app/views/schools/on_boarding/profiles/onboarding.html.erb
+++ b/app/views/schools/on_boarding/profiles/onboarding.html.erb
@@ -39,8 +39,9 @@
           <p>
           <ul class="govuk-list govuk-list--bullet">
             <li>the details you’re providing are correct</li>
-            <li>you agree to manage the data you receive in line with current GDPR regulations</li>
+            <li>you agree to manage the data you receive in line with current UK GDPR regulations</li>
             <li>you accept our <a href="/schools_privacy_policy" class="govuk-link">privacy policy</a></li>
+            <li>you accept our <a href="/terms_and_conditions" class="govuk-link">terms and conditions</a></li>
           </ul>
           </p>
         <% end %>