Click here to download a copy of this policy in PDF format.

Introduction

The following data protection policy is used by the school to show compliance with the Data Protection Act 2018, sometimes referred to as UKGDPR.

The school are the data controller and are ultimately responsible for ensuring that they comply with data protection law. The Data Protection Officer role is carried out by Chapman Data & Information Services LTD, whose role is to advise, assist and instruct the school. 

Chapman Data & Information Services LTD, cannot be held accountable should the school as data controller fail to follow advice that has been given.

The Data Protection Act 2018 (UKGDPR) puts certain responsibilities upon the data controller such as ensuring they have the correct policies in place, data audits have been carried out, school staff have received basic data protection training, and the school has the correct ICO registration in place.

The school, as data, controller will ensure that personal data is kept in accordance with the following key data protection principles:

• Fair, lawful, and transparent processing - Privacy Notice.
• Purpose limitation – Only hold data where required and for its intended purpose.
• Data minimisation – Do not hold data any longer than is necessary. 
• Accuracy – Ensure that data is correct.
• Data retention periods – Aware of legal requirements to keep documents. If a document does not come under a legal requirement, then the data minimisation principal should be followed.
• Data security – All reasonable steps will be taken to protect the data the school holds.
• Accountability – To be able to prove that the school adheres to data protection law.

The school’s privacy notice has been adapted from the model privacy notice provided by the Department of Education (DFE). This is the minimum requirement expected. However, the school can add to this should they wish.

 

Privacy Notice (How we use your information)

The categories of information that we collect, hold and/or share include but are not limited to:

• Personal information (such as names, unique pupil number and address, adult emergency contact information) 
• Special Categories (such as Ethnicity, Language, Nationality, Country of birth & Religion)  
• Characteristics (such as free school meal eligibility, Pupil Premium Information) 
• Safeguarding information (such as court orders and professional involvement)
• Medical and administration (such as doctor information, child health, dental health, allergies, medication, and dietary requirements)
• Attendance information (such as sessions attended, number of absences and absence reasons and any previous schools attended) 
• Assessment information and attainment (such as key stage 1, key stage 2 and phonics results)
• Relevant medical information (Special Category Data) 
• Special Educational Needs information (including needs and ranking)
• Behavioural information (such as exclusions and any relevant alternative provision put in place)
• Financial Information (such as dinner money transactions, trip transactions)

Why we collect and use this information 

We use the pupil data: 

• to support pupil learning 
• to monitor and report on pupil attainment progress 
• to provide appropriate pastoral care 
• to assess the quality of our services 
• to keep children safe (food allergies or emergency contact details)
• to meet the statutory duties placed on us by the Department for Education
• to comply with the law regarding data sharing 
• Financial audits 
• to provide a rewards structure 
• to track how well the school is performing as a whole

The lawful basis on which we use this information 

We collect and use your information under the Data Protection Act 2018 (sometimes referred to as UKGDPR), article 6, and article 9.

Special category data from article 9 is processed under condition (a) the data subject has given explicit consent to the processing of those personal data for one or more specified purpose.

Collecting pupil information 

Pupil data is essential for the school’s operational use. Whilst the majority of pupil information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with Data Protection legislation, we will inform you at the point of collection, whether you are required to provide certain pupil information to us or if you have a choice in this. This will be via the pupil information sheet that you are requested to complete upon your child’s entry to the school. Also, if applicable data will be taken from your previous school using a common transfer file (CTF).

Storing your data 

We hold your data if it is lawful for us to do so in accordance with retention guidance taken from the DFE recommended source which is the IRMS toolkit. Should a document not be listed in this toolkit then the school will keep a record of why this data is being retained and will produce upon request. Where the school does not follow the guidance within this toolkit, the school have their own retention document which can be provided upon request.

Any data that we are no longer required to hold lawfully is deleted/destroyed in accordance with the school’s disposal guidance policy.

Who we share pupil information with 

We routinely share pupil information with: 

• schools that the pupils attend after leaving us
• Our local authority 
• the Department for Education (DfE)  
• Medical information as appropriate/necessary with the NHS 
• If the school is a member of an academy trust, then we may where appropriate share pupil information with the trust.

We also routinely share pupil information with: 

Third Party Companies/Partners who are assisting the school or enhancing a child’s education. A list of such companies/partners can be provided upon request. These are not added to the privacy notice due to their fluid nature.

• Where required the school will ensure that a data processing agreement is in place.
• We will ensure that a Privacy Impact Assessment (PIA) is carried for any new system that the school acquires.
• We will ensure that if any personal data is transferred to a country that the UK deem to not have adequate data protection laws that a Standard Contractual Clause (SCC) is in place.
• We will ensure for any system that is online and directed at children will be compliant with the age-appropriate design code (children’s code)

Why we share your information 

• We do not share information about you with anyone without consent unless the law and our policies allow us to do so. 
• We share data with schools that your child attends after leaving us to assist with the school transition process. 
• We share data with our local authority when it is appropriate to do so to assist in the education of the pupils within our school.
• We share data with third party companies/partners who may require this information to assist the school. 
• We share pupil data with the NHS when appropriate to assist with medical needs of children within the school.

Youth support services

Pupils aged 13+ 

Once our pupils reach the age of 13, we also pass pupil information to our local authority and / or provider of youth support services as they have responsibilities in relation to the education or training of 13-19 year olds under section 507B of the Education Act 1996.

This enables them to provide services as follows:

• youth support services
• careers advisers

The information shared is limited to the child’s name, address and date of birth. However where a parent or guardian provides their consent, other information relevant to the provision of youth support services will be shared. This right is transferred to the child / pupil once they reach the age 16.

Data is securely transferred to the youth support service .

Pupils aged 16+ 

We will also share certain information about pupils aged 16+ with our local authority and / or provider of youth support services as they have responsibilities in relation to the education or training of 13-19 year olds under section 507B of the Education Act 1996.

This enables them to provide services as follows: 

• post-16 education and training providers
• youth support services
• careers advisers

Data is securely transferred to the youth support service.

For more information about services for young people, please visit our local authority website.

Department For Education 

• We share pupils’ data with the Department for Education (DfE) on a statutory basis. This data sharing underpins school funding and educational attainment policy and monitoring.
• We are required to share information about our pupils with our local authority (LA) and the Department for Education (DfE). Maintained school - under section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013. Academies and free schools - under regulation 5 of The Education (Information About Individual Pupils) (England) Regulations 2013. Pupil Referral Units - under regulation 4 of The Education (Information About Individual Pupils) (England) Regulations 2013
• All data is transferred to the DFE securely and held by the DFE under a combination of software and hardware controls which meet the current government security policy framework. government security policy framework.

Data collection requirements: 

To find out more about the data collection requirements placed on us by the Department for Education (for example, via the school census) go to https://www.gov.uk/education/data-collection-and-censuses-for-schools

 Sharing by the Department

The law allows the Department to share pupils’ personal data with certain third parties, including:

• schools
• local authorities
• researchers
• organisations connected with promoting the education or wellbeing of children in England
• other government departments and agencies
• organisations fighting or identifying crime

For more information about the Department’s NPD data sharing process, please visit:

https://www.gov.uk/data-protection-how-we-collect-and-share-research-data

Organisations fighting or identifying crime may use their legal powers to contact DfE to request access to individual level information relevant to detecting that crime. Whilst numbers fluctuate slightly over time, DfE typically supplies data on around 600 pupils per year to the Home Office and roughly 1 per year to the Police.

For information about which organisations the Department has provided pupil information, (and for which project) or to access a monthly breakdown of data share volumes with Home Office and the Police please visit the following website: https://www.gov.uk/government/publications/dfe-external-data-shares

To find out more about the NPD, go to https://www.gov.uk/government/publications/national-pupil-database-user-guide-and-supporting-information