The General Data Protection Regulation (GDPR) is a European law which came into effect on 25th May 2018.
All schools handle a large amount of personal data. This includes information on pupils such as grades, medical information, images and much more including data on staff, governors, volunteers and job applicants.
What is Personal data?
This data is already governed by existing DPA (Data Protection Act) regulations which ensure personal data is handled lawfully. However, the GDPR has gone further and requires organisations (including schools) to document how & why they process all personal data.
What is GDPR exactly?
The GDPR is Europe’s new framework for data protection laws – it replaces the previous 1995 data protection directive, which current UK law is based upon. The EU’s GDPR website says the legislation is designed to ‘harmonise’ data privacy laws across Europe as well as give greater protection to individuals.
The categories of pupil information that we collect, hold and share include:
Why we collect and use this information
The lawful basis on which we use this information
We collect and use pupil information under Article 6 and Article 9, which ensures that we as a school can carry out our official functions and tasks which are in the public interest. The principles for this are set out in our Data Protection Policy. This sets out the rules for good data handling and includes the principle that all data shall be processed fairly and lawfully.
Collecting pupil information
Whilst the majority of pupil information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain pupil information to us or if you have a choice in this.
Storing pupil data
We hold pupil data for the duration of a pupil’s attendance at school. However, pupil information regarding SEN (Special Educational Needs) and medical can be help for up to 25 years.
Who we share pupil information with
We routinely share pupil information with:
- Schools that the pupils attend after leaving us
- Our Local Authority
- The Department for Education (DfE)
- With other members of our MAT
- School Nurse
- Educational Psychologist
Why we share pupil information
We do not share information about our pupils with anyone without consent unless the law and our policies allow us to do so.
We share pupils’ data with the Department for Education (DfE) on a statutory basis. This data sharing underpins school funding and educational attainment policy and monitoring.
We are required to share information about our pupils with the (DfE) under regulation 5 of The Education (Information About Individual Pupils) (England) Regulations 2013.
Data collection requirements:
To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go to https://www.gov.uk/education/data-collection-and-censuses-for-schools
For further information regarding GDPR, please visit the Information Commissioner’s Office (ICO)
Data Protection Officer
The Data Protection Officer is responsible for overseeing data protection within the School so if you do have any questions in this regard, please do contact them on the information below: –
Data Protection Officer: Judicium Consulting Limited
Address: 72 Cannon Street, London, EC4N 6AE Email: dataservices@judicium.com
Web: www.judiciumeducation.co.uk
Telephone: 0203 326 9174
Lead Contact: Craig Stilwell
