Data Protection and GDPR

What is GDPR?

The General Data Protection Regulation (GDPR) is a new piece of EU legislation designed to update data protection law and offers a greater level of protection and rights for individuals.

Gloucestershire County Council (the data processor) processes data on behalf of schools (the data controller) to deliver a range of services, and therefore has responsibility to ensure compliance with a number of obligations under GDPR. We are registered as a data controller in our own right with the Information Commissioner’s Office (Registration Code: Z7334901).

What measures are we taking as an organisation to prepare for GDPR?

Technical and physical security measures

The council protects the privacy and security of all data that we control and process. This protection includes:

Controlled staff pass access to buildings
Servers based within the United Kingdom
Our network is Cyber Essentials Plus and Public Services Network (PSN) accredited
Regular patching and updating of systems to maintain the security and integrity of the council networkWe have also reviewed the systems that we own to ensure they comply with the new law. Our ICT partners, Sopra Steria, extended their contract inclusive of the GDPR Addendum and have been made aware of their responsibilities under the new Regulation.

Policies and procedures

The council also ensures that its policies and procedures reflect good practice for data protection and that staff are aware of these. This includes:

Review and acceptance of Data Protection, Internet Acceptable Use, Email Acceptable Use and Information Security policies by all staff – completion is monitored and recorded electronically
Online Data Protection training for all new staff – completion is monitored and recorded electronically
Automatic locking of PCs when not in use
A clear procedure for reporting and dealing with suspected breaches of data protection.

The council is reviewing these in line with the new law and is updating polices and practices where necessary. Progress is monitored quarterly by a director-led board and policies are subject to change upon further guidance being released.

Our commitment to schools

We will be transparent about what data we process on behalf of our schools, why we process this data, who we share it with, and the legal basis for doing this.

Please find the information below about how each service processes your data:

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your School Admissions provider. This information will include, but is not limited to: Personal data Name Date of Birth Address Contact details (Email, Telephone Number etc.) Special category data Religious Belief Health Data
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Child Parents Guardians Siblings Care and education professionals
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Processing of Applications and assessing Criteria’s To obtain supporting documentation for the verification of applications Assessing allocations and making relevant recommendations Accessing records about the child and situation if applicable to the application process (e.g. Care records, nursery, SEN requirements and case files) Nature The information is collected via the citizen online portal. Any Paper records are held in secure storage until transferred upon completion to the Records centre and adhere to the corporate retention. The Information may be shared with other local authorities as well as internal service areas. It may also be used for the wider purpose of providing statistical data used to assist with monitoring provisions and/or determining areas of need in order to target future provision.
Legal basis for processing	This must be determined by the relevant controller from th list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your School Admissions provider. This information will include, but is not limited to: Personal data Name Date of Birth Address Contact details (Email, Telephone Number etc.) Special category data Religious Belief Health Data
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Child Parents Guardians Siblings Care and education professionals
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Processing of Applications and assessing Criteria’s To obtain supporting documentation for the verification of applications Assessing allocations and making relevant recommendations Accessing records about the child and situation if applicable to the application process (e.g. Care records, nursery, SEN requirements and case files) Nature The information is collected via the citizen online portal. Any Paper records are held in secure storage until transferred upon completion to the Records centre and adhere to the corporate retention. The Information may be shared with other local authorities as well as internal service areas. It may also be used for the wider purpose of providing statistical data used to assist with monitoring provisions and/or determining areas of need in order to target future provision.
Legal basis for processing	This must be determined by the relevant controller from th list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your Advisory Teaching provider. This information will include, but is not limited to: Personal data Name and address Contact details Date of birth Special category data Sex Physical and mental health
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Students Parents Staff Health, social care, education and other Professionals
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Our Statutory or non statutory obligations Support interventions Conducting and managing Consultations Assessing and delivering Training requirements Input to individuals Care plans and assessments Nature Information to support the service is requested from other council areas and independent professionals where applicable. All Paper files held within secure storage until returned to the relevant services area. Details are recorded on the Capita One system with access control and our ICT security measures in place. Reports are stored within our electronical file management system and adhere to the Corporate Retention schedule.
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your Advisory Teaching provider. This information will include, but is not limited to: Personal data Name and address Contact details Date of birth Special category data Sex Physical and mental health
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Students Parents Staff Health, social care, education and other Professionals
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Our Statutory or non statutory obligations Support interventions Conducting and managing Consultations Assessing and delivering Training requirements Input to individuals Care plans and assessments Nature Information to support the service is requested from other council areas and independent professionals where applicable. All Paper files held within secure storage until returned to the relevant services area. Details are recorded on the Capita One system with access control and our ICT security measures in place. Reports are stored within our electronical file management system and adhere to the Corporate Retention schedule.
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your area finance office. This information will include, but is not limited to: Personal data Name Salary (grades and hours per week) Length of service Special category data No special category data processed
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Pupils Staff
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: To assess eligibility for pupil premium To project budget forecasts (income/expenditure) To make adjustments to personnel information in SIMS To produce staffing costs spreadsheets To respond to budget and finance queries from schools Nature Data is collected from schools on an encrypted memory stick. It is then imported into FMS using VM Ware. Data is manipulated within the Council. Data is deleted from the memory stick. School visit sheets, sometimes including names of staff, are sent via a secure email link, with a copy kept on Council servers Visit sheets, staff cost spreadsheets, and budgets may also be stored on encrypted memory pens for the purposes of transporting data between school and Council premises, and only for as long as needed Remote access to schools for responding to queries Information is retained in line with the Council’s corporate retention schedule
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your area finance office. This information will include, but is not limited to: Personal data Name Salary (grades and hours per week) Length of service Special category data No special category data processed
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Pupils Staff
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: To assess eligibility for pupil premium To project budget forecasts (income/expenditure) To make adjustments to personnel information in SIMS To produce staffing costs spreadsheets To respond to budget and finance queries from schools Nature Data is collected from schools on an encrypted memory stick. It is then imported into FMS using VM Ware. Data is manipulated within the Council. Data is deleted from the memory stick. School visit sheets, sometimes including names of staff, are sent via a secure email link, with a copy kept on Council servers Visit sheets, staff cost spreadsheets, and budgets may also be stored on encrypted memory pens for the purposes of transporting data between school and Council premises, and only for as long as needed Remote access to schools for responding to queries Information is retained in line with the Council’s corporate retention schedule
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your catering provider. This information will include, but is not limited to: Personal data Staff names Emergency contact phone numbers DBS numbers Special category data No special category data processed
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Staff and contractors
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: To ensure that individuals are safe to work on school sites For out of hours contact in an emergency Nature DBS names / numbers are verified against ID and then handed over to the BSC Contracted and GCC staff contact details are stored on a site/personal file on a shared drive. Only limited staff can access this drive
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your catering provider. This information will include, but is not limited to: Personal data Staff names Emergency contact phone numbers DBS numbers Special category data No special category data processed
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Staff and contractors
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: To ensure that individuals are safe to work on school sites For out of hours contact in an emergency Nature DBS names / numbers are verified against ID and then handed over to the BSC Contracted and GCC staff contact details are stored on a site/personal file on a shared drive. Only limited staff can access this drive
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your cleaning / caretaking provider. This information will include, but is not limited to: Personal data Staff names Emergency contact phone numbers DBS numbers Special category data No special category data processed
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Staff and contractors
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: To ensure that individuals are safe to work on school sites For out of hours contact in an emergency Nature DBS names / numbers are verified against ID and handed over to the BSC Contracted and GCC staff contact details are stored on a site/personal file on a shared drive. Only limited staff can access this drive
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your cleaning / caretaking provider. This information will include, but is not limited to: Personal data Staff names Emergency contact phone numbers DBS numbers Special category data No special category data processed
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Staff and contractors
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: To ensure that individuals are safe to work on school sites For out of hours contact in an emergency Nature DBS names / numbers are verified against ID and handed over to the BSC Contracted and GCC staff contact details are stored on a site/personal file on a shared drive. Only limited staff can access this drive
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your CLEAPSS provider. This information will include, but is not limited to: Personal data Number of children on roll as at the January census A list of the specific science contacts at schools where we provide the service Special category data No special category data processed
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Pupil numbers as at the January census Specific science contacts at schools
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Pupil numbers used to calculate the annual subscription figure Science contacts to be able to advise on health and safety Nature Figures taken from January census are held on an excel spreadsheet
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your CLEAPSS provider. This information will include, but is not limited to: Personal data Number of children on roll as at the January census A list of the specific science contacts at schools where we provide the service Special category data No special category data processed
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Pupil numbers as at the January census Specific science contacts at schools
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Pupil numbers used to calculate the annual subscription figure Science contacts to be able to advise on health and safety Nature Figures taken from January census are held on an excel spreadsheet
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your Communications Service provider. This information will include, but is not limited to: Personal data Name, job title, email address, phone number, date of birth Special category data No special category data processed
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Pupils (past and present) teachers (past and present) school governors (past and present)
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Media advice and guidance; crisis management Public relations; promotion of school achievements/Ofsted reports Social media; advice and guidance Nature Details are stored in our media database, Vuelio. Members of the Communications Team have access to this database via personalised log in details Details may be shared with colleagues within the team and, if appropriate, with colleagues across the organisation via email or in person
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your Communications Service provider. This information will include, but is not limited to: Personal data Name, job title, email address, phone number, date of birth Special category data No special category data processed
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Pupils (past and present) teachers (past and present) school governors (past and present)
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Media advice and guidance; crisis management Public relations; promotion of school achievements/Ofsted reports Social media; advice and guidance Nature Details are stored in our media database, Vuelio. Members of the Communications Team have access to this database via personalised log in details Details may be shared with colleagues within the team and, if appropriate, with colleagues across the organisation via email or in person
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your Educational Psychology provider. This information will include, but is not limited to: Personal data Name and address Contact details Date of birth Special category data Sex Physical and mental health
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Students Parents Staff Health, social care, education and other Professionals
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Our Statutory or non statutory obligations Therapeutic intervention Conducting and managing Consultations Assessing and delivering Training requirements Input to individuals Care plans and assessments Nature Information to support the service is requested from other council areas and independent professionals where applicable. All Paper files held within secure storage until returned to the relevant services area. Details are recorded on the Capita One system with access control and our ICT security measures in place. Reports are stored within our electronical file management system and adhere to the Corporate Retention schedule.
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your Educational Psychology provider. This information will include, but is not limited to: Personal data Name and address Contact details Date of birth Special category data Sex Physical and mental health
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Students Parents Staff Health, social care, education and other Professionals
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Our Statutory or non statutory obligations Therapeutic intervention Conducting and managing Consultations Assessing and delivering Training requirements Input to individuals Care plans and assessments Nature Information to support the service is requested from other council areas and independent professionals where applicable. All Paper files held within secure storage until returned to the relevant services area. Details are recorded on the Capita One system with access control and our ICT security measures in place. Reports are stored within our electronical file management system and adhere to the Corporate Retention schedule.
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your Free School Meals provider. This information will include, but is not limited to: Personal data Name Date of Birth Address Contact details(Telephone, email etc) National Insurance Financial data Special category data No Special Category Data Processed
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Child Parents Legal Guardian
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Processing and authorising Applications Obtaining Verification from the department of work & Pensions DWP Completion of eligibility Assessment To obtain records of an individuals Benefits statements and other financial records To inform the school of who is eligible for the scheme Nature The information is collected via the Citizen online portal and will be stored for no longer than is stated in the corporate retention schedule. Information may be supplied to other government departments to assist in the processing of the applications. It may also be used for the wider purpose of providing statistical data used to assist with monitoring provisions and/or determining areas of need in order to target future provision.
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your Free School Meals provider. This information will include, but is not limited to: Personal data Name Date of Birth Address Contact details(Telephone, email etc) National Insurance Financial data Special category data No Special Category Data Processed
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Child Parents Legal Guardian
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Processing and authorising Applications Obtaining Verification from the department of work & Pensions DWP Completion of eligibility Assessment To obtain records of an individuals Benefits statements and other financial records To inform the school of who is eligible for the scheme Nature The information is collected via the Citizen online portal and will be stored for no longer than is stated in the corporate retention schedule. Information may be supplied to other government departments to assist in the processing of the applications. It may also be used for the wider purpose of providing statistical data used to assist with monitoring provisions and/or determining areas of need in order to target future provision.
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your Free School Meals provider. This information will include, but is not limited to: Personal data Name Address Email Phone number Special category data No Special Category Data Processed
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: School governors Clerk to governors
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Processing training bookings and updating the database of LA school governors. Nature Information collected from clerk to governors and directly from governors. Information is maintained and stored in a database. Information is not shared outside GCC.
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your Free School Meals provider. This information will include, but is not limited to: Personal data Name Address Email Phone number Special category data No Special Category Data Processed
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: School governors Clerk to governors
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Processing training bookings and updating the database of LA school governors. Nature Information collected from clerk to governors and directly from governors. Information is maintained and stored in a database. Information is not shared outside GCC.
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your grounds maintenance provider. This information will include, but is not limited to: Personal data Staff names Emergency contact phone numbers DBS numbers Special category data No special category data processed
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Staff and contractors
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: To ensure that individuals are safe to work on school sites For out of hours contact in an emergency Nature DBS names / numbers are verified against ID and handed over to the BSC Contracted and GCC staff contact details are stored on a site/personal file on a shared drive. Only limited staff can access this drive
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your grounds maintenance provider. This information will include, but is not limited to: Personal data Staff names Emergency contact phone numbers DBS numbers Special category data No special category data processed
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Staff and contractors
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: To ensure that individuals are safe to work on school sites For out of hours contact in an emergency Nature DBS names / numbers are verified against ID and handed over to the BSC Contracted and GCC staff contact details are stored on a site/personal file on a shared drive. Only limited staff can access this drive
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your Safety, Health & Environment provider. This information will include, but is not limited to: Personal data Names, address, date of birth, telephone number, health/ injury information Special category data None
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Pupils Staff Members of the public
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Accident reporting and investigation plus data analysis School off-site trips review of notifications Delegates on training courses Nature Information is input on two databases (SHE assure and Gloucestershire Ego) by schools using hosted websites and populating specified fields or uploading documents.
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your Safety, Health & Environment provider. This information will include, but is not limited to: Personal data Names, address, date of birth, telephone number, health/ injury information Special category data None
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Pupils Staff Members of the public
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Accident reporting and investigation plus data analysis School off-site trips review of notifications Delegates on training courses Nature Information is input on two databases (SHE assure and Gloucestershire Ego) by schools using hosted websites and populating specified fields or uploading documents.
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your Human Resources provider. This information will include, but is not limited to: Personal data Name Contact information Employee number Employee record Special category data Race Ethnic origin Politics Religion Trade union membership Health Sex life Sexual orientation
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Staff Pupils Parents / guardians Volunteers
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Investigating employment related disputes Providing management guidance and support in all people management issues Nature All data is only accessible to the relevant individuals within the council, and only shared as specified below Personal data is retained in line with the corporate retention schedule Information may be shared with an individual’s nominated legal or trade union representative Information is otherwise only shared where there is a statutory obligation or legal obligation to do so, including for the preparation of legal proceedings
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your Human Resources provider. This information will include, but is not limited to: Personal data Name Contact information Employee number Employee record Special category data Race Ethnic origin Politics Religion Trade union membership Health Sex life Sexual orientation
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Staff Pupils Parents / guardians Volunteers
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Investigating employment related disputes Providing management guidance and support in all people management issues Nature All data is only accessible to the relevant individuals within the council, and only shared as specified below Personal data is retained in line with the corporate retention schedule Information may be shared with an individual’s nominated legal or trade union representative Information is otherwise only shared where there is a statutory obligation or legal obligation to do so, including for the preparation of legal proceedings
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your ICT support provider. This information will include, but is not limited to: Personal data Names Contact details (work telephone and email address) IP addresses Special category data No special category data processed
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Staff Educational professionals
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: To resolve customer issues and system issues via remote access or over the phone To provide coaching to school staff in regards to ICT via remote access or over the phone To provide training courses to school staff Nature The information listed above may be collected when a member of staff logs a request for ICT support or signs up for training. This is inputted to Freshdesk. The information collected is retained in line with the Council’s corporate retention schedule.
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your ICT support provider. This information will include, but is not limited to: Personal data Names Contact details (work telephone and email address) IP addresses Special category data No special category data processed
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Staff Educational professionals
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: To resolve customer issues and system issues via remote access or over the phone To provide coaching to school staff in regards to ICT via remote access or over the phone To provide training courses to school staff Nature The information listed above may be collected when a member of staff logs a request for ICT support or signs up for training. This is inputted to Freshdesk. The information collected is retained in line with the Council’s corporate retention schedule.
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your legal provider. This information will include, but is not limited to: Personal data Names DOB Contact details (addresses / phone numbers) Family circumstances Special category data Religion Political views Health Race / ethnic origin Sexual orientation
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Pupils Staff (teaching / non-teaching) Parents / Legal guardians Guardians Neighbours of the school Third parties / contractors
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: To access social media, health files and police records to assist in the investigation of issues To provide advice to schools to most expediently resolve an issue To contact parents/guardians for recovery of debt To review and clarify circumstances in order to resolve an issue To prepare for employment tribunals and other legal action Nature Conversations are recorded onto file notes, along with the personal information identified above, where relevant to the case. File notes and personal information are uploaded onto an electronic file and stored on the Civica CMS system. Each school is allocated one file per financial year. Information is kept in line with the Council’s corporate retention schedule. Information is shared within the Council and may be disclosed with other organisations such as the Police where there is a legal obligation to do so.
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your legal provider. This information will include, but is not limited to: Personal data Names DOB Contact details (addresses / phone numbers) Family circumstances Special category data Religion Political views Health Race / ethnic origin Sexual orientation
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Pupils Staff (teaching / non-teaching) Parents / Legal guardians Guardians Neighbours of the school Third parties / contractors
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: To access social media, health files and police records to assist in the investigation of issues To provide advice to schools to most expediently resolve an issue To contact parents/guardians for recovery of debt To review and clarify circumstances in order to resolve an issue To prepare for employment tribunals and other legal action Nature Conversations are recorded onto file notes, along with the personal information identified above, where relevant to the case. File notes and personal information are uploaded onto an electronic file and stored on the Civica CMS system. Each school is allocated one file per financial year. Information is kept in line with the Council’s corporate retention schedule. Information is shared within the Council and may be disclosed with other organisations such as the Police where there is a legal obligation to do so.
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your Newly Qualified Teachers service provider. This information will include, but is not limited to: Personal data Name Date of Birth Contact Details Teachers Reference number National Insurance number Special category data No Special Category Data Processed
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Staff (teachers) Educational Professionals
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Managing Applications and Registration for Newly Qualified teachers induction and assessment Completion of continuous assessment and monitoring results and recommendations Assessing Training Requirements and training development Nature The information is collected via forms and paper records and stored Electronically on the NQT Database. Any paper copies are held in secure storage until transferred the records centre for archiving. All information is held for the period specified within the corporate retention schedule. The information is shared with schools and the relevant Statutory bodies.
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your Newly Qualified Teachers service provider. This information will include, but is not limited to: Personal data Name Date of Birth Contact Details Teachers Reference number National Insurance number Special category data No Special Category Data Processed
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Staff (teachers) Educational Professionals
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Managing Applications and Registration for Newly Qualified teachers induction and assessment Completion of continuous assessment and monitoring results and recommendations Assessing Training Requirements and training development Nature The information is collected via forms and paper records and stored Electronically on the NQT Database. Any paper copies are held in secure storage until transferred the records centre for archiving. All information is held for the period specified within the corporate retention schedule. The information is shared with schools and the relevant Statutory bodies.
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your occupational health provider. This information will include, but is not limited to: Personal data Names Contact details Special category data Health data / clinical information Counselling data, which may include: race ethnic origin politics religion trade union membership health sex life sexual orientation
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Staff
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: To inform pension decisions regarding both in-service and deferred employee retirements To provide health screening To provide management advice, such as employment and pension advice To enable employers to meet their statutory responsibilities, such as Health and Safety and reasonable adjustment obligations Nature Client information is collected and held within electronic folders on Medgate servers Information used for counselling purposes is inputted onto the Cohort system, provided by Medgate Some records are also kept in hard copy Both electronic and hard copy data is kept in line with the Council’s corporate retention schedule
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your occupational health provider. This information will include, but is not limited to: Personal data Names Contact details Special category data Health data / clinical information Counselling data, which may include: race ethnic origin politics religion trade union membership health sex life sexual orientation
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Staff
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: To inform pension decisions regarding both in-service and deferred employee retirements To provide health screening To provide management advice, such as employment and pension advice To enable employers to meet their statutory responsibilities, such as Health and Safety and reasonable adjustment obligations Nature Client information is collected and held within electronic folders on Medgate servers Information used for counselling purposes is inputted onto the Cohort system, provided by Medgate Some records are also kept in hard copy Both electronic and hard copy data is kept in line with the Council’s corporate retention schedule
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your Payroll provider. This information will include, but is not limited to: Personal data Name DOB National Insurance Number Age Nationality Address Marital status Bank details Special category data Emergency contact details Disability Ethnicity
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Staff/employees
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Payroll processing Statutory returns Audit Nature Data is collected in e-forms completed by the school e-form initiator and approved by the school e-form approver. Data is stored securely on SAP Data is scanned and encrypted Data is filed securely.
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your Payroll provider. This information will include, but is not limited to: Personal data Name DOB National Insurance Number Age Nationality Address Marital status Bank details Special category data Emergency contact details Disability Ethnicity
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Staff/employees
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Payroll processing Statutory returns Audit Nature Data is collected in e-forms completed by the school e-form initiator and approved by the school e-form approver. Data is stored securely on SAP Data is scanned and encrypted Data is filed securely.
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract


Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your property care provider. This information will include, but is not limited to: Personal data Name Personnel number(s) Email address NI number Special category data None
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Staff
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Creating new accounts in the mydocuments portal Loading new payslips to the mydocuments portal Nature Email addresses are requested from schools in order to be able to create an online account. This request is sent to schools via an encrypted email. Name, personnel number(s) and email addresses are shared with Canon in order to create new accounts and to load payslips to the correct account in the mydocuments portal.
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract


Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your property care provider. This information will include, but is not limited to: Personal data Name Personnel number(s) Email address NI number Special category data None
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Staff
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Creating new accounts in the mydocuments portal Loading new payslips to the mydocuments portal Nature Email addresses are requested from schools in order to be able to create an online account. This request is sent to schools via an encrypted email. Name, personnel number(s) and email addresses are shared with Canon in order to create new accounts and to load payslips to the correct account in the mydocuments portal.
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your property care provider. This information will include, but is not limited to: Personal data Staff names Emergency contact phone numbers DBS numbers Special category data No special category data processed
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Staff and contractors
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: To ensure that individuals are safe to work on school sites For out of hours contact in an emergency Nature DBS names / numbers are verified against ID and handed over to the BSC Contracted and GCC staff contact details are stored on a site/personal file on a shared drive. Only limited staff can access this drive
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your property care provider. This information will include, but is not limited to: Personal data Staff names Emergency contact phone numbers DBS numbers Special category data No special category data processed
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Staff and contractors
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: To ensure that individuals are safe to work on school sites For out of hours contact in an emergency Nature DBS names / numbers are verified against ID and handed over to the BSC Contracted and GCC staff contact details are stored on a site/personal file on a shared drive. Only limited staff can access this drive
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your Safeguarding provider. This information will include, but is not limited to: Personal data Name Contact details(Email, telephone etc) Addres Special category data No Special category data processe
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Teachers Educational Professionals
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Review, mange and maintain assessment packs The provision of safeguarding training and issuing of certificates Providing advice on safeguarding issues and concerns relating, but not limited to - Single Central record, serious cases, process implementation and organisational practises etc. Conducting Audits of the organisation engaging key stakeholders and provide the remedial actions report Conducting Serious case reviews Nature Foster brown - load seeker system
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your Safeguarding provider. This information will include, but is not limited to: Personal data Name Contact details(Email, telephone etc) Addres Special category data No Special category data processe
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Teachers Educational Professionals
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: Review, mange and maintain assessment packs The provision of safeguarding training and issuing of certificates Providing advice on safeguarding issues and concerns relating, but not limited to - Single Central record, serious cases, process implementation and organisational practises etc. Conducting Audits of the organisation engaging key stakeholders and provide the remedial actions report Conducting Serious case reviews Nature Foster brown - load seeker system
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your SIMS administrator. This information will include, but is not limited to: Personal data Names Contact details (work telephone and email address) IP addresses Special category data No special category data processed
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Staff Educational professionals
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: To resolve customer issues and system issues via remote access or over the phone To provide coaching to school staff in the use of SIMS via remote access or over the phone To provide training courses to school staff Nature The information listed above may be collected when a member of staff logs a request for ICT support or signs up for training. This is inputted to Freshdesk. The information collected is retained in line with the Council’s corporate retention schedule.
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your SIMS administrator. This information will include, but is not limited to: Personal data Names Contact details (work telephone and email address) IP addresses Special category data No special category data processed
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: Staff Educational professionals
Purposes/Nature of processing	Purposes We may use the above information for the completion of the following tasks: To resolve customer issues and system issues via remote access or over the phone To provide coaching to school staff in the use of SIMS via remote access or over the phone To provide training courses to school staff Nature The information listed above may be collected when a member of staff logs a request for ICT support or signs up for training. This is inputted to Freshdesk. The information collected is retained in line with the Council’s corporate retention schedule.
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your CBS VAT service. The information we receive from CBS are reports, invoices & debtor invoices. The information we process relates to VAT (input / output tax). We do not process any other information supplied to us. Personal data Staff names are occasionally contained in invoices. Special category data None
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: School staff VAT (INPUT TAX/ OUTPUT TAX)
Purposes/Nature of processing	Purposes We use the above information for the completion of the following task: Completing the Council’s monthly VAT Return to HMRC Recovering input tax from HMRC Paying over output tax to HMRC Nature Each month CBS send us reports of input tax / output tax, either via email or post. Where VAT amounts are above £100 supporting documentation is sent e.g. invoices or remittance advice The totals of input/output tax for each CBS are entered onto a spreadsheet, the totals of which are journalled into SAP. Reports & invoices are stored in the office, which is access protected. Reports & invoices are sent to the records office where they are securely stored. Records are kept in line with the council’s retention policy and then securely destroyed.
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing	We will process only the information provided to us from you in relation to the fulfilment of our duties as your CBS VAT service. The information we receive from CBS are reports, invoices & debtor invoices. The information we process relates to VAT (input / output tax). We do not process any other information supplied to us. Personal data Staff names are occasionally contained in invoices. Special category data None
Categories of data subjects	The information captured above will pertain to the following categories of data subjects: School staff VAT (INPUT TAX/ OUTPUT TAX)
Purposes/Nature of processing	Purposes We use the above information for the completion of the following task: Completing the Council’s monthly VAT Return to HMRC Recovering input tax from HMRC Paying over output tax to HMRC Nature Each month CBS send us reports of input tax / output tax, either via email or post. Where VAT amounts are above £100 supporting documentation is sent e.g. invoices or remittance advice The totals of input/output tax for each CBS are entered onto a spreadsheet, the totals of which are journalled into SAP. Reports & invoices are stored in the office, which is access protected. Reports & invoices are sent to the records office where they are securely stored. Records are kept in line with the council’s retention policy and then securely destroyed.
Legal basis for processing	This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

.pcg-collapsible.default-mode { display: none !important; } .pcg-collapsible.no-script-mode { display: block !important; }

We are committed to ensuring that the data we control and process is safe and protected. As an organisation, we endeavour to comply with all of our data protection responsibilities under the GDPR. This includes:

We will only act on the written consent of the school
We will not employ a sub-contractor to process the data without the prior written authorisation of the school
Where necessary, we will co-operate fully with supervisory authorities (such as the ICO)
We will ensure that we help schools with any requests from individuals regarding their data rights (e.g. right to access or erasure). This includes notifying any breaches of personal data to the school as soon as possible
We keep a record of our processing activities, including recording the basis for carrying out this processing
We already employ a data protection officer (DPO) due to our obligations as a local council

Contact

Please direct any queries regarding this compliance statement to:

contactus@gloucestershire.gov.uk

01452 425888