Digital badge governance for regulated issuers

Why do regulated issuers need a different approach to badges?

Because learners, employers and regulators will read your badges in the light of the regulated awards you also make. A badge from an awarding body, university or professional body can easily be mistaken for a qualification, credit or professional status it doesn't represent, and that confusion damages trust in both.

The risks are specific:

• A badge that implies a qualification level, credit value or regulated status it doesn't carry.
• Criteria that drift away from what is actually assessed, so the badge no longer matches the course.
• Badges edited after issue, leaving holders with a record that no longer reflects what they achieved.
• Personal data published on verification pages without a clear basis or the learner's understanding.

None of these is a reason not to issue badges. Many regulated issuers use them well, to recognise short courses, units, CPD and professional development alongside their formal awards. They just need the same discipline the organisation already applies to everything else it certifies.

How should badges relate to regulated qualifications?

Be explicit. If a badge represents a regulated qualification or unit, name it exactly as it is regulated. If it doesn't, avoid any wording that suggests it does. The badge's description should let an outsider tell the difference in one reading.

In England, qualifications are regulated by Ofqual and sit on the Regulated Qualifications Framework. Wales, Northern Ireland and Scotland have their own arrangements. For badges that are not regulated qualifications:

• Don't use "Level 2", "Level 3" or similar on its own, because readers will assume a framework level. If you need to show progression, use your own named levels, such as foundation, practitioner and advanced.
• Don't describe the badge as a qualification, diploma or certificate of competence unless it is one.
• Do say what it is: a record of completing an assessed short course, a unit, a CPD activity or a professional development programme.
• Do link to the relevant course or programme page, where the status of the learning is described in full.

Where a badge does represent a regulated award, keep its title, level and awarding organisation identical to the official record, and make sure your certification processes, not the badge platform, remain the source of truth.

How should universities handle micro-credentials and credit?

Say whether the badge carries academic credit, how much, and at what level, and make sure that statement matches your academic regulations. If a badge does not carry credit, say so. Learners and employers increasingly ask this question, and a clear answer builds trust.

In the UK, the Quality Assurance Agency's characteristics statement on micro-credentials is a useful reference for how short, credit-bearing learning is described. Practical steps:

• Agree with your registry or quality team which badges are credit-bearing and how that is recorded.
• Include credit value and level in the badge description only where your regulations support it.
• Where badges stack into a larger award, describe the stacking rules on a public page and link to it.
• Keep the badge in step with the student record, so a correction in one is reflected in the other.

How should professional bodies use badges for CPD?

Use badges to record CPD that has a clear activity, a clear time commitment and, where relevant, an assessment, and set expiry dates where membership or professional status depends on keeping up to date. Members can then show both what they have done and that it is current.

Good practice for CPD badges:

• State the number of CPD hours or points in the badge description, in the same units your CPD scheme uses.
• Distinguish between attendance-based CPD and assessed CPD, because members and employers value them differently.
• For status badges, such as chartered or accredited membership, set an expiry date tied to renewal, and make sure the badge page shows clearly when status has lapsed.
• Give members a simple way to see all their CPD badges together, so the badges support their CPD record rather than duplicating it.

What does good badge governance look like?

It looks like the governance you already have for other awards, scaled to badges: a named owner, a defined approval route, a register of every badge, and written policies for change, correction and revocation. The aim is that anyone can find out who approved a badge, what it requires, and what happens when something goes wrong.

When should you version, correct or revoke a badge?

Version a badge when its criteria or assessment change significantly. Correct it when a detail is wrong, such as a misspelt name. Revoke it only when it should never have been issued or the holder is no longer entitled to it. Each needs a written policy, because each changes what someone checking the badge will see.

• Versioning. Existing holders keep the version they earned, with the criteria that applied at the time. New learners receive the new version. Never edit the criteria of a badge people already hold, because that changes the record of what they achieved.
• Corrections. For simple errors, correct the credential and keep an internal record of the change. If a correction means reissuing, make sure the original shows as replaced rather than simply disappearing.
• Revocation. Define the grounds, such as issue in error or malpractice, who can decide, and how the holder is told and can appeal. The verification page should show that the badge has been revoked, so anyone checking gets an accurate answer.

How does UK GDPR apply to digital badges?

A digital badge contains personal data, at least the recipient's name and what they achieved, and often an email address and dates. As the issuer, you are usually the controller, so you need a lawful basis for issuing, a clear view of what is public, and a way to handle requests from recipients.

Points to settle with your data protection officer:

• Lawful basis. Many issuers rely on contract, where the badge is part of the service the learner signed up for, or legitimate interests. Consent is not always the right basis, and it is hard to manage if recipients later withdraw it. The ICO's guidance on lawful bases explains the options.
• Transparency. Tell learners before issue that they will receive a badge, what it contains and what will be publicly visible on its verification page. Your privacy notice should cover it.
• Public information. Keep verification pages to what is needed to verify the achievement. Avoid publishing email addresses, dates of birth or assessment scores unless there is a clear reason.
• Requests. Plan for access and erasure requests. Erasure is not always absolute, for example where you need to keep a record of an award, but the public verification page may still need to be taken down. Decide your approach before the first request arrives.
• Retention. Decide how long badge records are kept, and make sure your platform contract supports it.
• Assessment. For large or high-profile programmes, a data protection impact assessment is a sensible step even where it is not strictly required.

How do verifiable badges help against credential fraud?

A verifiable badge links to a page, hosted by or for the issuer, that confirms who earned it, what it represents and whether it is still valid. That makes a forged PDF or an edited image much easier to spot, because anyone can check the original in seconds.

To get the benefit, make verification easy for the people who need it. Publish a short page explaining how employers and other organisations can check your badges and certificates, and train your own staff who handle verification requests to point people to it. The fewer manual verification requests you receive, the better the system is working.

Frequently asked questions

Can a digital badge be a regulated qualification?

A digital badge can represent a regulated qualification or unit, as a verifiable record of an award made through your normal certification process. The badge itself doesn't make the learning regulated. Name the qualification exactly as it is regulated, and keep your certification records as the source of truth.

Should CPD badges expire?

Badges that record a single CPD activity usually shouldn't, because the activity happened. Badges that show current status, such as accredited or chartered membership that depends on annual CPD, should expire in line with renewal, so anyone checking can see whether the status is current.

What happens to a badge if a learner asks for their data to be deleted?

It depends on your lawful basis and on your obligations to keep records of awards. You may need to keep an internal record while taking down the public verification page. Agree the approach with your data protection officer before launch, and explain it in your privacy notice.

Who should own a badge programme in a university or awarding body?

Usually someone with authority over awards or quality, supported by the teams who run the courses and the platform. The owner should have the power to approve, change and retire badges, so the programme stays consistent with the organisation's other awards.