School data

It is the responsibility of the Governors to ensure procedures are in place to ensure that the school complies with the Freedom of Information Act 2000 (FoIA) and the Data Protection Act 1998 (DPA).

Freedom of Information policy template for schoolsOpens new window

ParentPay Security and Data Protection Information for schoolsOpens new window

It might also be helpful to see the information that the council provides on Transparency, data protection and freedom of information on theCouncil website 

Privacy Notices give details of any organisations that a school, the Local Authority or Department for Education share data with.

The detail is contained on their respective websites, with links from the Privacy Notices. You should issue Privacy Notices to all staff and children each year or when there have been significant changes to the data use.

We must inform data subjects on how their data is being used. If a major change is made to how the information is to be used, we have a duty to inform of these changes.

A single, short and easily understandable Privacy Notice must be issued to new learners and staff by the school or LA at the same time as other communications that they issue. For example:

  • A learner might receive the Privacy Notice as part of a school brochure or induction pack, or in a school diary, and it could be posted on the school notice board.
  • For staff, the Privacy Notice might be included as part of a contract, induction pack, and posted on the staff notice board.

Staff, and young people who have the maturity to understand the nature and the implications of the request they are making and who have a general understanding of their rights under the Data Protection Act, can ask to see their own personal information under the Subject Access Provisions (S.7) of the Data Protection Act.

For children under 12, their parents will generally act on their behalf. In every case, it will be for the school, as data controller, to assess whether the child is capable of understanding their rights under the Act, and the implications of their actions and so decide whether the parent needs to make the request on the child's behalf.

To help with this please find a model privacy notice and checklist that you can use. To use the template please replace the red text with your school details. The blue text is applicable only to secondary school age children and can be deleted if not appropriate.

The agency contact sheet refers to a number of agencies that process pupil/carer data. Contact details and website links for each of the organisations mentioned can be found by downloading the document:

See also GCC Privacy Notice informationOpens new window

If parents/carers request a hard copy of the detailed policy you should either direct them to this site or print a hard copy for them.

There is a separate form for staff to be used in connection with the School Workforce Census.


Model Privacy Notice for pupils 

Agency contact sheet

Model Privacy Notice for staff 

Help us improve Schoolsnet

Don’t include personal or financial information like your National Insurance number or credit card details.