Data protection in schools is a must. Schools work with an incredible amount of personal data. This includes information such as pupil names, addresses, medical information, images, and more. Additionally, information related to job applicants, governors, staff and volunteers is often stored within a school database.
The Data Protection Act (DPA) was designed to protect the privacy of individuals. When the DPA was updated to the GDPR in May 2018, the regulations around data protection changed throughout Europe. Subsequently, following Brexit, with effect from the 1st Jan 2021, the UK stopped being part of the EU and hence the ‘EU-GDPR’ ceased to protect the rights and freedoms of UK citizens regarding their personal information. To prevent this from becoming the case, the UK Government published an update to the DPA 2018 called the Data Protection, Privacy and Electronic Communications Regulations, now known as UK GDPR.
Schools handle what the UK GDPR classifies as ‘special category data’, detailing pupil information such as ethnicity, race, biometric data, and trade union membership in some instances. This data is subject to strict controls, and therefore schools need to adhere to UK GDPR guidelines and protect this information efficiently.
This article will provide all the essential information on the Data Protection Act 2018 relating to schools. We’ll discuss what data protection is, the importance of privacy notices in schools, and the fundamental principles and security measures that must be applied by data controllers. We’ll also offer advice concerning what information can be shared, how to carry out an audit, what should be covered in a Data Protection Policy, and what the role of a data protection officer entails.
Data protection refers to safeguarding private and important information from compromise, corruption and loss. Data protection is becoming ever more important in today’s data-driven society, as the amount of information created and stored expands year-on-year.
Since May 2018, data protection in UK schools must adhere to strict guidelines published in the UK GDPR legislation. This particular set of guidelines is more rigorous than previous legislation and carries severe penalties for non-compliance. All UK schools must both comply with the UK GDPR provisions and prove to regulators that they have various data protection protocols in place.
The processing of personal data stored on school websites, paper, servers and databases is all covered by UK GDPR. Critically, schools must undertake stringent data protection impact assessments when they upgrade their software, change IT infrastructure, or introduce new technology that deals with personal data. Note that UK GDPR compliance is a legal obligation, making it illegal if your school fails to produce precise documentation that proves effective management of all information systems. Penalties are delivered on a case-by-case basis, with the maximum fine for non-compliance set at £17.5 million or 4% of the total annual worldwide turnover in the preceding financial year, whichever is higher. If there is an infringement of other provisions, such as administrative requirements of the legislation, the standard maximum amount will apply, which is £8.7 million or 2% of the total annual worldwide turnover in the preceding financial year, whichever is higher.
Folders full of GDPR guidance and legislation" width="1200" height="350" />
Personal information can be defined as anything relating to an individual that identifies them. This applies to both physical and digital records.
Examples of personal information that a school may store include:
With such a myriad of personal information held by schools, the importance of protecting such data is paramount.
When you collect information concerning a parent, child or member of staff, you must offer transparency about how this information will be used. Your school has to explain precisely how you will process the personal information of all staff and pupils. Examples include how to arrange school trips, facilitate education, or store grades and exam results.
To ensure UK GDPR compliance, schools must display clear privacy notices. The purpose of a privacy notice is to present and summarise what information the school requires, why this information is being collected, and which third parties are privy to such data. The individual whom the information relates to must give full consent to your school in order for you to store it. Primary and secondary schools have different data requirements. For this reason, every single school must have its own privacy policy covering the processing activities that are specific to their school.
That said, all school privacy notices need to cover these key areas:
Your school must publish its privacy notice on all enrolment documentation and on forms used to collect any personal information. There should also be a clear privacy notice uploaded onto the school website.
We recommend sending a digital copy of your privacy notice to all students and parents at the beginning of each new school year.
For help curating your school privacy notice, you can visit the official ICO website.
The GDPR (General Data Protection Regulation) and its UK version have been in effect for several years now. Compliance is essential, not only because it helps prevent security incidents but also because it ensures that data processing practices are responsible and efficient. This legislation is even more essential for the education sector, and you should be aware of the seven key UK GDPR principles so that you can comply efficiently.
1. Lawfulness, fairness and transparency
All data must be obtained on a lawful basis, leaving individuals fully informed and complying with UK GDPR legislation in full. Lawfulness means that any processes that your school has in place relating to the personal data of pupils and staff must meet all UK GDPR requirements. This includes data storing, processing and collection. UK GDPR legislation contains directions for each step of your data management policy.
Fairness relates to your actions. Whether you control or process data, your processes must follow procedures described to the data subject. This means that the promises outlined in your school privacy statement must be followed as you collect subject data. Additionally, all data must be used only for pre-stated purposes and time periods.
Transparency refers to your privacy notice. All staff, pupils and parents must be informed of the purposes, means and time period of data processing. You need to let all individuals affected know precisely what will be done with their data and who can gain access to this information.
2. Purpose limitation
When it comes to your privacy notice, it’s paramount that you inform all subjects about the purpose of your school’s data collection. UK GDPR legislation states that this purpose has to be ‘specified, explicit and legitimate’. Therefore, data can be used and collected only for the purposes that have been made accessible to the data subject who has consented.
3. Data minimisation
Only collect the necessary data. The UK GDPR was designed to keep data collection to the bare minimum. Therefore, all personal data collected must be ‘adequate, relevant and limited to what is necessary concerning the purposes for which they are processed’. Under UK GDPR guidelines, all schools must be able to justify the amount of data they collect. Therefore, you must create and publish adequate policy documentation.
4. Accuracy
Any personal data has to be ‘accurate and, where necessary, kept up to date’. Therefore, all old and outdated records, contracts and personal data must be erased as soon as this information is no longer essential.
5. Storage limitations
This principle relates to the process of data minimalisation and clearly states that personal data has to be ‘kept in a form which permits identification of data subjects for no longer than necessary’. When you collect data, you must define a retention period that relates to your specific objectives. As always, the information has to be documented in case of an investigation.
6. Integrity and confidentiality
This principle states that personal data must be handled ‘in a manner [ensuring] appropriate security’, which includes ‘protection against unlawful processing or accidental loss, destruction or damage’. This means that anonymisation and pseudonymisation systems must be applied where necessary to protect the identity of staff and students. Some schools invest in official accreditation such as ISO 27001 to prove their commitment to cybersecurity.
7. Accountability
Finally, all schools are fully responsible for compliance with the principles outlined in the UK GDPR. This legislation requires thorough evidence and documentation of policies related to the processing and collection of data. Each step of your school’s data management policy must be carefully justified and formulated by way of official documentation. These documents must be available to prove compliance should the relevant policies request access.
Once personal information relating to staff, parents and pupils is acquired, it has to be kept secure. Loss of information or unauthorised access can cause severe damage to individuals. Failure to protect this information can lead to severe penalties for a school’s managerial team, not to mention the impact a data breach could have on the school’s reputation. All manual and digital records must be protected with a level of security that directly reflects the potential harm that could come from data loss or misuse. Additionally, robust procedures must be put in place to respond to such security breaches.
Security measures don’t have to be complicated – simple check-in and check-out systems are often sufficient to protect personal data.
Potential security measures for school data protection include:
Small electronic storage devices such as memory sticks and SD cards require serious consideration as they can be easily misplaced. If you must use memory sticks to store personal information, we recommend ensuring that they are fully encrypted and password protected.
Additionally, hard drives must be securely erased if they are being discarded. This should be done by a professional who is technically capable of completely formatting the drive to eliminate all data.
Occasionally, some schools must share personal data with other schools, different departments, local authorities and social services. On these occasions, it may be the case that actions cannot be completed or verified without sharing such data. For example, if a pupil shows signs of physical or mental abuse, this information may need to be passed on to social services. Additionally, if a school trip is being organised in conjunction with another school, data must be shared to confirm attendance and ensure the safety of all participants. Before sharing this data, all legal implications must be considered. You must also have the ability and permission to share the specified data.
Questions you should ask include:
You must also receive consent from any said individual before their personal information is shared. This information should have already been presented in your school privacy notice when the data was initially collected. Note that this even applies to sharing images on the school’s Facebook page, in the school prospectus, or in any other marketing materials both online and offline. Any literature sent from schools to parents requires a printed data protection statement where applicable, including if a reply slip is included requiring personal data related to the pupil or their parents. If your school plans to transfer data to other countries, this information can only be shared if there are equivalent or suitable security measures in place in the recipient’s organisation.
For example, if any personal data relating to staff, pupils or parents require processing outside of the UK, explicit consent is required from all individuals involved. If your school fails to establish a safe data protection system with a foreign country, you should never consider sharing any personal information.
Rules around consent for school include:
For all images of pupils that are published, their names must not be accredited unless this is pertinent and the pupils/their parents have given consent.
To guarantee that all information is vetted for accuracy, stored only for the time that it is relevant, and stored securely, annual audits should be carried out.
To conduct an audit, you should:
If your school holds any personal data for longer than it is required, you will violate the Data Protection Act.
For example, data received relating to pupils’ assessments should never be published on the school’s website. When you determine what kind of information could be deemed excessive, we recommend investigating school forms and outlining which data is critical for the forms’ intended purpose. Any additional information should be marked as excessive and should not be collected.
The purpose of a school Data Protection Policy is to educate all staff on how to process personal information fairly and safely. Your official school policy should provide practical guidance on how data can and cannot be handled, stored or published. All of this information must be regularly shared with employees. All school staff must receive adequate training on the confidentiality of personal information.
Your Data Protection Policy must highlight how individuals can use the school intranet, internet and email for private communications safely and securely. There must also be guidelines covering security issues that are apparent when staff and pupils access the school intranet from outside of the school campus. This could be on a smartphone, tablet, laptop or desktop device.
To ensure data protection in schools, a typical Use Policy should cover:
Do staff or students share personal data, homework or conversations via email? Can this process be completed securely? Is it possible to avoid sending personal data to parents over email? Are all staff implementing BCC to protect the anonymity of parents when sharing bulk emails?
Your school Use Policy should outline the necessary restrictions recommended to use mobile devices safely and securely. You must consider mobile access to the internet within school grounds, access to streaming and entertainment services, and restrictions on video messaging or information-based services.
On school premises, pupils should only be able to access chat rooms if they are related to education and closely monitored. All students should receive e-safety education, outlining the importance of protecting personal data that could identify them or others when using online chat portals.
Your school website must display a detailed privacy statement that explains how the school uses any personal information that is acquired concerning data subjects. It should include information about how data is processed and stored.
Schools must have measures in place to prevent breaches of data through their internet, intranet and email systems. We recommend that your school considers the following:
Evidence of inadequate data protection practices or guidelines includes lack of internet monitoring or filtering, little or no e-safety education in place, and students with no awareness of how to report data-sensitive problems.
Following recent guidelines published in the official UK GDPR Article 39, the responsibilities of a data protection officer (DPO) include:
Data protection officers help schools to:
An efficient DPO must ensure internal compliance throughout the school and alert the relevant authorities about issues of non-compliance. This is the case even if the school could accrue substantial penalties or fines.
The role of a DPO is ever-changing in line with technological innovation and data protection laws. Therefore, an ideal candidate must be savvy and willing to continually train and educate themselves to meet current guidelines or changes in the law.
We hope that this guide has helped you to understand the importance of data protection in schools, the impact that UK GDPR has on your school, and how to improve and implement your school’s Data Protection Policy.
