Data Protection and GDPR

What is GDPR?

The General Data Protection Regulation (GDPR) is a new piece of EU legislation designed to update data protection law and offers a greater level of protection and rights for individuals.

Gloucestershire County Council (the data processor) processes data on behalf of schools (the data controller) to deliver a range of services, and therefore has responsibility to ensure compliance with a number of obligations under GDPR. We are registered as a data controller in our own right with the Information Commissioner’s Office (Registration Code: Z7334901).

What measures are we taking as an organisation to prepare for GDPR?

Technical and physical security measures

The council protects the privacy and security of all data that we control and process. This protection includes:

  • Controlled staff pass access to buildings
  • Servers based within the United Kingdom
  • Our network is Cyber Essentials Plus and Public Services Network (PSN) accredited
  • Regular patching and updating of systems to maintain the security and integrity of the council networkWe have also reviewed the systems that we own to ensure they comply with the new law. Our ICT partners, Sopra Steria, extended their contract inclusive of the GDPR Addendum and have been made aware of their responsibilities under the new Regulation.

Policies and procedures

The council also ensures that its policies and procedures reflect good practice for data protection and that staff are aware of these. This includes:

  • Review and acceptance of Data Protection, Internet Acceptable Use, Email Acceptable Use and Information Security policies by all staff – completion is monitored and recorded electronically
  • Online Data Protection training for all new staff – completion is monitored and recorded electronically
  • Automatic locking of PCs when not in use
  • A clear procedure for reporting and dealing with suspected breaches of data protection.

The council is reviewing these in line with the new law and is updating polices and practices where necessary. Progress is monitored quarterly by a director-led board and policies are subject to change upon further guidance being released.

Our commitment to schools

We will be transparent about what data we process on behalf of our schools, why we process this data, who we share it with, and the legal basis for doing this.

Please find the information below about how each service processes your data:

Subject matter of processing

We will process only the information provided to us from you in relation to the fulfilment of our duties as your School Admissions provider. This information will include, but is not limited to:

Personal data

  • Name
  • Date of Birth
  • Address
  • Contact details (Email, Telephone Number etc.)

Special category data

  • Religious Belief
  • Health Data

Categories of data subjects

The information captured above will pertain to the following categories of data subjects:

  • Child
  • Parents
  • Guardians
  • Siblings
  • Care and education professionals

 

Purposes/Nature of processing

Purposes

We may use the above information for the completion of the following tasks:

  • Processing of Applications and assessing Criteria’s
  • To obtain supporting documentation for the verification of applications
  • Assessing allocations and making relevant recommendations
  • Accessing records about the child and situation if applicable to the application process(e.g. Care records, nursery, SEN requirements and case files)

 

Nature

The information is collected via the citizen online portal. Any Paper records are held in secure storage until transferred upon completion to the Records centre and adhere to the corporate retention. The Information may be shared with other local authorities as well as internal service areas. It may also be used for the wider purpose of providing statistical data used to assist with monitoring provisions and/or determining areas of need in order to target future provision.

 

Legal basis for processing

This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

 

Subject matter of processing

We will process only the information provided to us from you in relation to the fulfilment of our duties as your Advisory Teaching provider. This information will include, but is not limited to:

Personal data

  • Name and address
  • Contact details
  • Date of birth

Special category data

  • Sex
  • Physical and mental health

Categories of data subjects

The information captured above will pertain to the following categories of data subjects:

  • Students
  • Parents
  • Staff
  • Health, social care, education and other Professionals

 

Purposes/Nature of processing

Purposes

We may use the above information for the completion of the following tasks:

  • Our Statutory or non statutory obligations
  • Support interventions
  • Conducting and managing Consultations
  • Assessing and delivering Training requirements
  • Input to individuals Care plans and assessments

Nature

Information to support the service is requested from other council areas and independent professionals where applicable. All Paper files held within secure storage until returned to the relevant services area. Details are recorded on the Capita One system with access control and our ICT security measures in place. Reports are stored within our electronical file management system and adhere to the Corporate Retention schedule.

Legal basis for processing

This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

 

Subject matter of processing

We will process only the information provided to us from you in relation to the fulfilment of our duties as your area finance office. This information will include, but is not limited to:

Personal data

  • Name
  • Salary (grades and hours per week)
  • Length of service

Special category data

  • No special category data processed

Categories of data subjects

The information captured above will pertain to the following categories of data subjects:

  • Pupils
  • Staff

Purposes/Nature of processing

Purposes

We may use the above information for the completion of the following tasks:

  • To assess eligibility for pupil premium
  • To project budget forecasts (income/expenditure)
  • To make adjustments to personnel information in SIMS
  • To produce staffing costs spreadsheets
  • To respond to budget and finance queries from schools

 

Nature

  • Data is collected from schools on an encrypted memory stick. It is then imported into FMS using VM Ware. Data is manipulated within the Council. Data is deleted from the memory stick.
  • School visit sheets, sometimes including names of staff, are sent via a secure email link, with a copy kept on Council servers
  • Visit sheets, staff cost spreadsheets, and budgets may also be stored on encrypted memory pens for the purposes of transporting data between school and Council premises, and only for as long as needed
  • Remote access to schools for responding to queries
  • Information is retained in line with the Council’s corporate retention schedule

Legal basis for processing

This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

 

Subject matter of processing

We will process only the information provided to us from you in relation to the fulfilment of our duties as your catering provider. This information will include, but is not limited to:

Personal data

  • Staff names
  • Emergency contact phone numbers
  • DBS numbers

 

Special category data

  • No special category data processed

Categories of data subjects

The information captured above will pertain to the following categories of data subjects:

Staff and contractors

Purposes/Nature of processing

Purposes

  • We may use the above information for the completion of the following tasks:
  • To ensure that individuals are safe to work on school sites
  • For out of hours contact in an emergency

 

Nature

  • DBS names / numbers are verified against ID and then handed over to the BSC
  • Contracted and GCC staff contact details are stored on a site/personal file on a shared drive. Only limited staff can access this drive

Legal basis for processing

This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

 

Subject matter of processing

We will process only the information provided to us from you in relation to the fulfilment of our duties as your cleaning / caretaking provider. This information will include, but is not limited to:

Personal data

  • Staff names
  • Emergency contact phone numbers
  • DBS numbers

Special category data

  • No special category data processed

Categories of data subjects

The information captured above will pertain to the following categories of data subjects:

  • Staff and contractors

Purposes/Nature of processing

Purposes

We may use the above information for the completion of the following tasks:

  • To ensure that individuals are safe to work on school sites
  • For out of hours contact in an emergency

Nature

  • DBS names / numbers are verified against ID and handed over to the BSC
  • Contracted and GCC staff contact details are stored on a site/personal file on a shared drive. Only limited staff can access this drive

Legal basis for processing

This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

 

Subject matter of processing

We will process only the information provided to us from you in relation to the fulfilment of our duties as your CLEAPSS provider. This information will include, but is not limited to:

Personal data

  • Number of children on roll as at the January census
  • A list of the specific science contacts at schools where we provide the service

Special category data

  • No special category data processed

Categories of data subjects

The information captured above will pertain to the following categories of data subjects:

  • Pupil numbers as at the January census
  • Specific science contacts at schools

Purposes/Nature of processing

Purposes

We may use the above information for the completion of the following tasks:

  • Pupil numbers used to calculate the annual subscription figure
  • Science contacts to be able to advise on health and safety

Nature

  • Figures taken from January census are held on an excel spreadsheet

Legal basis for processing

This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

Subject matter of processing

We will process only the information provided to us from you in relation to the fulfilment of our duties as your Communications Service provider. This information will include, but is not limited to:

Personal data

  • Name, job title, email address, phone number, date of birth

Special category data

  • No special category data processed

Categories of data subjects

The information captured above will pertain to the following categories of data subjects:

  • Pupils (past and present)
  • teachers (past and present)
  • school governors (past and present)

Purposes/Nature of processing

Purposes

We may use the above information for the completion of the following tasks:

  • Media advice and guidance; crisis management
  • Public relations; promotion of school achievements/Ofsted reports
  • Social media; advice and guidance

Nature

  • Details are stored in our media database, Vuelio. Members of the Communications Team have access to this database via personalised log in details
  • Details may be shared with colleagues within the team and, if appropriate, with colleagues across the organisation via email or in person

 

Legal basis for processing

This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract


Subject matter of processing

We will process only the information provided to us from you in relation to the fulfilment of our duties as your Educational Psychology provider. This information will include, but is not limited to:

Personal data

  • Name and address
  • Contact details
  • Date of birth

Special category data

  • Sex
  • Physical and mental health

Categories of data subjects

The information captured above will pertain to the following categories of data subjects:

  • Students
  • Parents
  • Staff
  • Health, social care, education and other Professionals

Purposes/Nature of processing

Purposes

We may use the above information for the completion of the following tasks:

  • Our Statutory or non statutory obligations
  • Therapeutic intervention
  • Conducting and managing Consultations
  • Assessing and delivering Training requirements
  • Input to individuals Care plans and assessments

Nature

Information to support the service is requested from other council areas and independent professionals where applicable. All Paper files held within secure storage until returned to the relevant services area. Details are recorded on the Capita One system with access control and our ICT security measures in place. Reports are stored within our electronical file management system and adhere to the Corporate Retention schedule.

Legal basis for processing

This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

 

Subject matter of processing

We will process only the information provided to us from you in relation to the fulfilment of our duties as your Free School Meals provider. This information will include, but is not limited to:

Personal data

  • Name
  • Date of Birth
  • Address
  • Contact details(Telephone, email etc)
  • National Insurance
  • Financial data

 

Special category data

No Special Category Data Processed

 

Categories of data subjects

The information captured above will pertain to the following categories of data subjects:

  • Child
  • Parents
  • Legal Guardian

 

Purposes/Nature of processing

Purposes

We may use the above information for the completion of the following tasks:

  • Processing and authorising Applications
  • Obtaining Verification from the department of work & Pensions DWP
  • Completion of eligibility Assessment
  • To obtain records of an individuals Benefits statements and other financial records
  • To inform the school of who is eligible for the scheme

 

Nature

The information is collected via the Citizen online portal and will be stored for no longer than is stated in the corporate retention schedule. Information may be supplied to other government departments to assist in the processing of the applications. It may also be used for the wider purpose of providing statistical data used to assist with monitoring provisions and/or determining areas of need in order to target future provision.

Legal basis for processing

This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

 

Subject matter of processing

We will process only the information provided to us from you in relation to the fulfilment of our duties as your Free School Meals provider. This information will include, but is not limited to:

Personal data

  • Name
  • Address
  • Email
  • Phone number

Special category data

No Special Category Data Processed

 

Categories of data subjects

The information captured above will pertain to the following categories of data subjects:

  • School governors
  • Clerk to governors

 

Purposes/Nature of processing

Purposes

We may use the above information for the completion of the following tasks:

  • Processing training bookings and updating the database of LA school governors.

 

Nature

Information collected from clerk to governors and directly from governors. Information is maintained and stored in a database. Information is not shared outside GCC.

Legal basis for processing

This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

 

Subject matter of processing

We will process only the information provided to us from you in relation to the fulfilment of our duties as your grounds maintenance provider. This information will include, but is not limited to:

Personal data

  • Staff names
  • Emergency contact phone numbers
  • DBS numbers

Special category data

  • No special category data processed

Categories of data subjects

The information captured above will pertain to the following categories of data subjects:

  • Staff and contractors

Purposes/Nature of processing

Purposes

We may use the above information for the completion of the following tasks:

  • To ensure that individuals are safe to work on school sites
  • For out of hours contact in an emergency

 

Nature

  • DBS names / numbers are verified against ID and handed over to the BSC
  • Contracted and GCC staff contact details are stored on a site/personal file on a shared drive. Only limited staff can access this drive

Legal basis for processing

This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

 

 

Subject matter of processing

We will process only the information provided to us from you in relation to the fulfilment of our duties as your Safety, Health & Environment provider. This information will include, but is not limited to:

Personal data

  • Names, address, date of birth, telephone number, health/ injury information

Special category data

  • None

Categories of data subjects

The information captured above will pertain to the following categories of data subjects:

  • Pupils
  • Staff
  • Members of the public

Purposes/Nature of processing

Purposes

We may use the above information for the completion of the following tasks:

  • Accident reporting and investigation plus data analysis
  • School off-site trips review of notifications
  • Delegates on training courses

Nature

Information is input on two databases (SHE assure and Gloucestershire Ego) by schools using hosted websites and populating specified fields or uploading documents.

 

Legal basis for processing

This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

 

Subject matter of processing

We will process only the information provided to us from you in relation to the fulfilment of our duties as your Human Resources provider. This information will include, but is not limited to:

Personal data

  • Name
  • Contact information
  • Employee number
  • Employee record

Special category data

  • Race
  • Ethnic origin
  • Politics
  • Religion
  • Trade union membership
  • Health
  • Sex life
  • Sexual orientation

Categories of data subjects

The information captured above will pertain to the following categories of data subjects:

  • Staff
  • Pupils
  • Parents / guardians
  • Volunteers

Purposes/Nature of processing

Purposes

We may use the above information for the completion of the following tasks:

  • Investigating employment related disputes
  • Providing management guidance and support in all people management issues

 

Nature

  • All data is only accessible to the relevant individuals within the council, and only shared as specified below
  • Personal data is retained in line with the corporate retention schedule
  • Information may be shared with an individual’s nominated legal or trade union representative
  • Information is otherwise only shared where there is a statutory obligation or legal obligation to do so, including for the preparation of legal proceedings

Legal basis for processing

This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

 

Subject matter of processing

We will process only the information provided to us from you in relation to the fulfilment of our duties as your ICT support provider. This information will include, but is not limited to:

Personal data

  • Names
  • Contact details (work telephone and email address)
  • IP addresses

Special category data

  • No special category data processed

Categories of data subjects

The information captured above will pertain to the following categories of data subjects:

  • Staff
  • Educational professionals

Purposes/Nature of processing

Purposes

We may use the above information for the completion of the following tasks:

  • To resolve customer issues and system issues via remote access or over the phone
  • To provide coaching to school staff in regards to ICT via remote access or over the phone
  • To provide training courses to school staff

 

Nature

The information listed above may be collected when a member of staff logs a request for ICT support or signs up for training. This is inputted to Freshdesk. The information collected is retained in line with the Council’s corporate retention schedule.

Legal basis for processing

This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

 

Subject matter of processing

We will process only the information provided to us from you in relation to the fulfilment of our duties as your legal provider. This information will include, but is not limited to:

Personal data

  • Names
  • DOB
  • Contact details (addresses / phone numbers)
  • Family circumstances

Special category data

  • Religion
  • Political views
  • Health
  • Race / ethnic origin
  • Sexual orientation

Categories of data subjects

The information captured above will pertain to the following categories of data subjects:

  • Pupils
  • Staff (teaching / non-teaching)
  • Parents / Legal guardians
  • Guardians
  • Neighbours of the school
  • Third parties / contractors

Purposes/Nature of processing

Purposes

We may use the above information for the completion of the following tasks:

  • To access social media, health files and police records to assist in the investigation of issues
  • To provide advice to schools to most expediently resolve an issue
  • To contact parents/guardians for recovery of debt
  • To review and clarify circumstances in order to resolve an issue
  • To prepare for employment tribunals and other legal action

 

Nature

Conversations are recorded onto file notes, along with the personal information identified above, where relevant to the case. File notes and personal information are uploaded onto an electronic file and stored on the Civica CMS system. Each school is allocated one file per financial year. Information is kept in line with the Council’s corporate retention schedule. Information is shared within the Council and may be disclosed with other organisations such as the Police where there is a legal obligation to do so.

Legal basis for processing

This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

 

Subject matter of processing

We will process only the information provided to us from you in relation to the fulfilment of our duties as your Newly Qualified Teachers service provider. This information will include, but is not limited to:

Personal data

  • Name
  • Date of Birth
  • Contact Details
  • Teachers Reference number
  • National Insurance number

Special category data

  • No Special Category Data Processed

Categories of data subjects

The information captured above will pertain to the following categories of data subjects:

  • Staff (teachers)
  • Educational Professionals

Purposes/Nature of processing

Purposes

We may use the above information for the completion of the following tasks:

  • Managing Applications and Registration for Newly Qualified teachers induction and assessment
  • Completion of continuous assessment and monitoring results and recommendations
  • Assessing Training Requirements and training development

Nature

The information is collected via forms and paper records and stored Electronically on the NQT Database. Any paper copies are held in secure storage until transferred the records centre for archiving. All information is held for the period specified within the corporate retention schedule. The information is shared with schools and the relevant Statutory bodies.

Legal basis for processing

This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

 

Subject matter of processing

We will process only the information provided to us from you in relation to the fulfilment of our duties as your occupational health provider. This information will include, but is not limited to:

Personal data

  • Names
  • Contact details

Special category data

  • Health data / clinical information
  • Counselling data, which may include:
  • race
  • ethnic origin
  • politics
  • religion
  • trade union membership
  • health
  • sex life
  • sexual orientation

Categories of data subjects

The information captured above will pertain to the following categories of data subjects:

  • Staff

Purposes/Nature of processing

Purposes

We may use the above information for the completion of the following tasks:

  • To inform pension decisions regarding both in-service and deferred employee retirements
  • To provide health screening
  • To provide management advice, such as employment and pension advice
  • To enable employers to meet their statutory responsibilities, such as Health and Safety and reasonable adjustment obligations

Nature

  • Client information is collected and held within electronic folders on Medgate servers
  • Information used for counselling purposes is inputted onto the Cohort system, provided by Medgate
  • Some records are also kept in hard copy
  • Both electronic and hard copy data is kept in line with the Council’s corporate retention schedule

Legal basis for processing

This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

 

Subject matter of processing

We will process only the information provided to us from you in relation to the fulfilment of our duties as your Payroll provider. This information will include, but is not limited to:

Personal data

  • Name
  • DOB
  • National Insurance Number
  • Age
  • Nationality
  • Address
  • Marital status
  • Bank details

Special category data

  • Emergency contact details
  • Disability
  • Ethnicity

Categories of data subjects

The information captured above will pertain to the following categories of data subjects:

  • Staff/employees

Purposes/Nature of processing

Purposes

We may use the above information for the completion of the following tasks:

  • Payroll processing
  • Statutory returns
  • Audit

 

Nature

  • Data is collected in e-forms completed by the school e-form initiator and approved by the school e-form approver.
  • Data is stored securely on SAP
  • Data is scanned and encrypted
  • Data is filed securely.

Legal basis for processing

This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

 
 

Subject matter of processing

We will process only the information provided to us from you in relation to the fulfilment of our duties as your property care provider. This information will include, but is not limited to:

Personal data

  • Name
  • Personnel number(s)
  • Email address
  • NI number

Special category data

  • None

Categories of data subjects

The information captured above will pertain to the following categories of data subjects:

  • Staff

Purposes/Nature of processing

Purposes

We may use the above information for the completion of the following tasks:

  • Creating new accounts in the mydocuments portal
  • Loading new payslips to the mydocuments portal

Nature

  • Email addresses are requested from schools in order to be able to create an online account. This request is sent to schools via an encrypted email.
  • Name, personnel number(s) and email addresses are shared with Canon in order to create new accounts and to load payslips to the correct account in the mydocuments portal.

 

Legal basis for processing

This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

 

Subject matter of processing

We will process only the information provided to us from you in relation to the fulfilment of our duties as your property care provider. This information will include, but is not limited to:

Personal data

  • Staff names
  • Emergency contact phone numbers
  • DBS numbers

Special category data

  • No special category data processed

Categories of data subjects

The information captured above will pertain to the following categories of data subjects:

  • Staff and contractors

Purposes/Nature of processing

Purposes

We may use the above information for the completion of the following tasks:

  • To ensure that individuals are safe to work on school sites
  • For out of hours contact in an emergency

 

Nature

  • DBS names / numbers are verified against ID and handed over to the BSC
  • Contracted and GCC staff contact details are stored on a site/personal file on a shared drive. Only limited staff can access this drive

Legal basis for processing

This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

 

Subject matter of processing

We will process only the information provided to us from you in relation to the fulfilment of our duties as your Safeguarding provider. This information will include, but is not limited to:

Personal data

  • Name
  • Contact details(Email, telephone etc)
  • Addres

Special category data

  • No Special category data processe

Categories of data subjects

The information captured above will pertain to the following categories of data subjects:

  • Teachers
  • Educational Professionals

Purposes/Nature of processing

Purposes

We may use the above information for the completion of the following tasks:

  • Review, mange and maintain assessment packs
  • The provision of safeguarding training and issuing of certificates
  • Providing advice on safeguarding issues and concerns relating, but not limited to - Single Central record, serious cases, process implementation and organisational practises etc.
  • Conducting Audits of the organisation engaging key stakeholders and provide the remedial actions report
  • Conducting Serious case reviews

 

Nature

  • Foster brown - load seeker system

Legal basis for processing

This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

 

Subject matter of processing

We will process only the information provided to us from you in relation to the fulfilment of our duties as your SIMS administrator. This information will include, but is not limited to:

Personal data

  • Names
  • Contact details (work telephone and email address)
  • IP addresses

Special category data

  • No special category data processed

Categories of data subjects

The information captured above will pertain to the following categories of data subjects:

  • Staff
  • Educational professionals

Purposes/Nature of processing

Purposes

We may use the above information for the completion of the following tasks:

  • To resolve customer issues and system issues via remote access or over the phone
  • To provide coaching to school staff in the use of SIMS via remote access or over the phone
  • To provide training courses to school staff

 

Nature

The information listed above may be collected when a member of staff logs a request for ICT support or signs up for training. This is inputted to Freshdesk. The information collected is retained in line with the Council’s corporate retention schedule.

Legal basis for processing

This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract

 

Subject matter of processing

We will process only the information provided to us from you in relation to the fulfilment of our duties as your CBS VAT service.

 

The information we receive from CBS are reports, invoices & debtor invoices. The information we process relates to VAT (input / output tax). We do not process any other information supplied to us.

Personal data

  • Staff names are occasionally contained in invoices.

Special category data

  • None

Categories of data subjects

The information captured above will pertain to the following categories of data subjects:

  • School staff
  • VAT (INPUT TAX/ OUTPUT TAX)

Purposes/Nature of processing

Purposes

We use the above information for the completion of the following task:

  • Completing the Council’s monthly VAT Return to HMRC
  • Recovering input tax from HMRC
  • Paying over output tax to HMRC

Nature

  • Each month CBS send us reports of input tax / output tax, either via email or post.
  • Where VAT amounts are above £100 supporting documentation is sent e.g. invoices or remittance advice
  • The totals of input/output tax for each CBS are entered onto a spreadsheet, the totals of which are journalled into SAP.
  • Reports & invoices are stored in the office, which is access protected.
  • Reports & invoices are sent to the records office where they are securely stored.
  • Records are kept in line with the council’s retention policy and then securely destroyed.

Legal basis for processing

This must be determined by the relevant controller from the list in Article 6 GDPR. The controller should include this in the contract



We are committed to ensuring that the data we control and process is safe and protected. As an organisation, we endeavour to comply with all of our data protection responsibilities under the GDPR. This includes:

  1. We will only act on the written consent of the school
  2. We will not employ a sub-contractor to process the data without the prior written authorisation of the school
  3. Where necessary, we will co-operate fully with supervisory authorities (such as the ICO)
  4. We will ensure that we help schools with any requests from individuals regarding their data rights (e.g. right to access or erasure). This includes notifying any breaches of personal data to the school as soon as possible
  5. We keep a record of our processing activities, including recording the basis for carrying out this processing
  6. We already employ a data protection officer (DPO) due to our obligations as a local council

 

Contact

Please direct any queries regarding this compliance statement to:

contactus@gloucestershire.gov.uk

01452 425888

 

Help us improve Schoolsnet

Don’t include personal or financial information like your National Insurance number or credit card details.