Data protection in schools

The policies and processes schools and multi-academy trusts need to protect personal data and respond effectively to a personal data breach.

• What data protection means for schools

  Data protection legislation, and who and what it’s intended to protect.

• Data processing a school is permitted to do

  The lawful grounds for accessing, collecting, storing and using personal, special category and criminal offence data.

• Responsibilities

  Who is responsible for making sure data is processed securely in a school.

• Role of data protection officers

  How data protection officers can help make sure schools are compliant with data protection laws.

• Data protection policies and procedures

  How to comply and document compliance with UK GDPR and the Data Protection Act 2018.

• Sharing personal data

  Who you can share personal data with and what consent you need to get – for example, when publishing exam results and taking photos in school.

• Information rights requests relating to personal data

  How to recognise and handle information rights requests relating to personal data in your school, including subject access requests.

• Data retention

  Explains how to carry out an audit to check what personal data your school holds. You can use a data retention schedule to document how long you'll keep different types of data for.

• Managing breaches of data

  Good practice for preventing personal data breaches in your school. It explains how to recognise and respond effectively to a personal data breach.