Summary

The policies and processes schools and multi-academy trusts need to protect personal data and respond effectively to a personal data breach.

This toolkit will help school staff, governors and trustees:

• understand how to comply with data protection law
• develop their data policies and processes
• know what staff and pupil data to keep
• follow good practices for preventing personal data breaches

This advice is intended for maintained schools and academies. Independent schools are welcome to use it where appropriate.

Contents

• What data protection means for schools

  Data protection legislation, and who and what it’s intended to protect.

• Updates to the Digital Information and Smart Data Bill

  Changes to the bill and support available from the Department for Education (DfE).

• Data processing a school is permitted to do

  The lawful grounds for accessing, collecting, storing and using personal, special category and criminal offence data.

• Responsibilities

  Who is responsible for making sure data is processed securely in a school.

• Role of data protection officers

  How data protection officers can help make sure schools are compliant with data protection laws.

• Data protection policies and procedures

  How to comply and document compliance with UK GDPR and the Data Protection Act 2018.

• Sharing personal data

  Who you can share personal data with and what consent you need to get – for example, when publishing exam results, taking photos in school and for immunisation programmes.

• Dealing with subject access requests (SARs)

  A subject access request (SAR) is a type of information rights request. A SAR lets people access a copy of the personal data a school holds about them or someone they have parental responsibility for.

• Handling other information rights requests

  How to manage other information rights requests, including changing, deleting or restricting the processing of personal information.

• Record keeping and management

  How to carry out an audit to check what personal data your school holds. You can use a data retention schedule to document how long you'll keep different types of data for.

• Managing breaches of data

  Good practice for preventing personal data breaches in your school. It explains how to recognise and respond effectively to a personal data breach.

• Generative artificial intelligence (AI) and data protection in schools

  How to address potential data protection risks of using generative AI in schools.

• Resources to support data protection in schools

  Download resources to help with data protection in schools, including posters, templates, and learning materials.

Print this page