Privacy Notice for Students and Parents

September 8, 2015

1 Introduction

1.1 This notice explains how [● name of school / charity / school group] (the School) uses your personal information. In this document “we” “us” “our” means the School.
1.2 In this document, “the School” means [list schools].
1.3 We aim to comply with the Data Protection Act (the DPA) when handling your personal information. The purpose of the DPA is to safeguard information about people (referred to in the DPA as Personal Data) and covers issues such as data security, individuals’ rights to access information about them held by the School and the use and disclosure of Personal Data.
1.4 This document is commonly known as a “privacy notice”.
1.5 For the purposes of the DPA we are the Data Controller of Personal Data about students and their parents and/or guardians. This means that we are responsible for compliance with the DPA.
1.6 This notice also applies to prospective students and their parents and / or guardians.
1.7 The School has appointed the [Bursar] as our Data Protection Officer (DPO). Any questions you have in relation to this policy should be sent to the DPO.

2 How we acquire Personal Data

3.1 We commonly use Personal Data for:

    3.1.1 ensuring that we provide a safe and secure environment;
    3.1.2 providing pastoral care;
    3.1.3 providing education and learning for students;
    3.1.4 enabling students to take part in exams and assessments and to monitor students’ progress and educational needs;
    3.1.5 providing additional activities for students and parents, for example, activity clubs;
    3.1.6 protecting and promoting our interests and objectives – this includes fundraising;
    3.1.7 legal and management purposes and to enable the School to meet its legal obligations as an employer, for example to pay staff, and to monitor their performance;
    3.1.8 safeguarding and promoting the welfare of students; and
    3.1.9 fulfilling our contractual and other legal obligations.

3.2 Personal Data processed by us includes contact details, medical/health information, disciplinary, admissions and attendance records, information relating to special educational needs and images of students engaging in School activities (and in relation to parents and/or guardians, may include financial information).

3.3 We may also process Sensitive Personal Data such as information about parents’ and/or students’ ethnic group, religious beliefs and relevant medical information.

3.4 We may share Personal Data with third parties where doing so complies with the DPA. For example, we may:

    3.4.1 disclose parent / student information to the relevant statutory agencies and Government departments (such as the Department for Education and UK Visas and Immigration). For example, we may need to share information in order to comply with our reporting obligations or for safeguarding reasons;
    3.4.2 disclose details of a student’s medical condition where it is in the student’s interests to do so, for example for medical advice, insurance purposes or to organisers of school trips;
    3.4.4 share parent contact details and financial information with debt recovery organisations;
    3.4.5 disclose information to fraud prevention or credit reference agencies; and
    3.4.6 share information about parents and students with our solicitors or other professional advisors (for example in order to obtain legal advice).

3.5 We may share information about a student with their parents where permitted by the DPA, for example, information about the student’s academic attainment, behaviour and progress.

3.6 We may use Personal Data for other purposes where the DPA allows and where providing an explanation would not be appropriate – this includes for the prevention and investigation of crime and the prosecution of offenders.

3.7 Our aims are:

    3.7.1 to record sufficient information for the purpose, but not unnecessary information;
    3.7.2 to record Personal Data accurately and to keep it up-to-date;
    3.7.3 not to use Personal Data in ways which are incompatible with the purpose for which it was originally recorded;
    3.7.4 not to transfer Personal Data outside the European Economic Area unless we have the permission of the individual, or have made appropriate arrangements with the recipient to ensure that the individual’s privacy rights are protected; and
    3.7.5 to have appropriate security arrangements in place to help prevent any unauthorised use of, or accidental loss or damage to, Personal Data. This includes using encryption and other technologies where appropriate.
    3.7.6 to dispose of Personal Data appropriately after it is no longer needed. This includes: shredding papers where appropriate; and
 permanently deleting information from computers and memory devices before they are disposed of.
          3.7.7 to be fair to the subject of the information and to whoever provides it (if that is someone else).

3.8 The School will retain student files in accordance with the DPA. On occasion we may need to keep certain records for a long period of time (even indefinitely). For example, we may need to keep records for longer if there are safeguarding concerns or if you threaten to bring a claim against the School.

3.9 [We may share information between the schools where doing so complies with the DPA. For example, we may share information between the schools where a student has applied to join the senior school.]

3.10 We may continue to use Personal Data of students after those students have left the School where doing so is allowed by the DPA. For example, marketing photos of students who have since left the School may still be used to promote the school.

4 Data protection compliance: specific examples


4.1 We use CCTV recordings for the purposes of crime prevention and investigation and also in connection with our obligation to safeguard the welfare of students, staff and visitors to our site.

CCTV recordings may be disclosed to third parties such as the police but only where such disclosure is in accordance with the DPA.

Photographs and publicity

4.2 We may use photographs and other media of students for marketing and promotion purposes, including School publications social media and the School website. We may also allow external publication of media where appropriate (for example, in a local newspaper).

4.3 We will usually seek permission where there are greater privacy concerns. For example:

4.3.1 [To be completed]

4.4 If permission is required then it will be sought as follows:

          4.4.1 where the student is in Year 7 or below, permission will be sought from a parent or guardian;
          4.4.2 where the student is in Year 8, 9, 10 or 11 then permission will be sought from both the student and the parent / guardian; and
          4.4.3 if the student is in Year 12 or 13 then only the student’s permission will be sought

4.5 Occasionally parents may ask us to keep information about their child confidential. For example, they may ask us to not use photographs of their child in promotional material or ask us to keep the fact that their child is on the School roll confidential. If parents would like information about their child to be kept confidential they must immediately contact the [• Principal] in writing, requesting an acknowledgment of their letter.

Our website

4.6 [We publish information about [School sports fixtures] on our website. This makes it easier for parents and students to find out about upcoming [sports events] and other information. The information published includes the full name of the students taking part as well as information about the students’ availability to take part in [sports events]. The information is available to anyone who accesses our website.]


4.7 We may make enquiries of students’ previous schools for confirmation that all sums due and owing to such schools have been paid. We may also inform other schools or educational establishments to which students are to be transferred if any of our fees are unpaid.

Fundraising, Clubs and Alumni Associations

4.8 We may use information about parents, former students, and others in connection with fundraising and promoting the interests of the School. For example, we may contact individuals who we consider might be interested in supporting the School in connection with a specific fundraising activity.


4.9 We may share the Personal Data of students and parents with other educational establishments for the purpose of providing a reference

Exam results and student achievement

4.10 We publish exam results [please describe how exam results are published, for example in the local paper, school website etc, what information is published and how it is done (for example alphabetical or grade order)]. We may also publish information about student achievement, for example [please give examples].

5 Your rights under the DPA

5.1 Subject Access Request: Subject to a number of exemptions contained in the DPA, parents and students have a statutory right to know if we hold any Personal Data about them, and to know what it is, its source, how we use it, the logic we use in any automatic decisions, and who we disclose it to. Parents or Students who wish to access this information will need to make a Subject Access Request. This can be done by submitting a request in writing and paying the appropriate fee (usually £10). We will respond to a request within 40 days from when we receive the request in writing, any further information reasonably requested by us and (if we ask for it) the fee.

5.2 Automatic decisions: Parents and students have a statutory right to ask us not to make decisions automatically (using Personal Data) if such automatic decisions would affect them to a significant degree.

5.3 Corrections: Parents and students have a statutory right to ask for incorrect Personal Data to be corrected or annotated.

5.4 Use of Personal Data: Parents and students have a statutory right to ask us not to use their Personal Data in a way that is likely to cause them unwarranted and substantial damage or distress.

6 Further Information

6.1 ICO website: Further details of the Personal Data that we hold, and how we use it, can be found in our register entry on the Information Commissioner’s website at under registration number [number]. This website also contains further information about data protection.

6.2 The purpose of this notice is to explain how we use Personal Data about students and parents. It does not, and is not intended to, place any obligation on us greater than that set out in the DPA.

6.3 Contact: If you would like any further information about anything within this notice then please contact […].

Authorised by The Principal
Date September 2015
Effective date of the policy September 2015
Circulation Teaching staff / all staff / parents / Students on request
Review date September 2016