Every member of staff in a school needs to know four things about GDPR: what counts as personal data, when you’re allowed to use or share it, what a data breach looks like, and who to tell when something goes wrong (your data protection officer). Build any staff session around those. If you’re here for slides to run one, we have free introduction to data protection slides you can download and use.
Where can I find free GDPR training slides for staff?
The free slides above will do for a staff meeting or an INSET slot. If you’d rather staff worked through it themselves, with scenarios and a short assessment, that’s what our introduction to data protection course is for. Before you present anything, get two things in hand: the name of your school’s data protection officer (DPO) and a copy of your data protection policy. Staff will ask “so who do I tell?”, and the answer has to be your school’s, not a generic one.
Who is the session for? Everyone. DfE guidance on data protection in schools covers anyone who creates or stores data, enters it into software, decides whether to use it, or handles paper documents. In a school that’s the office, the classroom, the kitchen and the site team.
What counts as personal data in a school?
Personal data is information about an identified or identifiable living person. An email address counts. So does an uncaptioned photo of a pupil on the website, because they can be recognised. An exam score that’s been properly anonymised doesn’t, as long as nobody can work out whose it is.
You’ll also hear the word “processing”. It covers anything you do with personal data: recording it, keeping it, changing it, using it and deleting it. So data protection isn’t only about whether you collect something in the first place. It’s also about how long you keep it and what you do with it in the meantime.
What are the seven data protection principles?
UK GDPR sets out seven principles that sit behind every decision. Six of them say personal data should be:
- processed lawfully, fairly and transparently
- used for a specific purpose
- adequate, relevant and limited to what you need
- accurate and kept up to date
- kept no longer than necessary
- kept securely
The seventh is accountability: the school takes responsibility for what it does with personal data and can show how it meets the other six.
The third one is easiest to remember as the Goldilocks principle. Collect enough for your purpose, but no more. If you’re collecting data to close achievement gaps, gathering things that have nothing to do with that purpose isn’t allowed, however handy it might be later. “We might use it one day” isn’t a purpose.
What’s special category data?
Some personal data is far more sensitive than the rest. A pupil’s address being seen by the wrong person is a very different thing from their safeguarding file being seen. UK GDPR calls the most sensitive kinds special category data: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and biometric data (a fingerprint used for the canteen, say), health, and sex life or sexual orientation.
DfE guidance adds that schools should treat these as special category data too, as best practice: safeguarding information, pupil premium eligibility, SEND, children in need and looked-after children. DBS check results are criminal offence data and need the same care, even when the check comes back clear.
Using special category data needs a lawful basis plus an extra condition. Much of what schools hold fits under substantial public interest, which includes safeguarding children and supporting people with a disability or medical condition. If you’re unsure about a particular case, ask your DPO.
Do schools need consent to use pupil data?
Often not, and this is the misconception that trips people up most. Consent is only one of six lawful bases in UK GDPR. The others are contract, legal obligation, vital interests (protecting someone’s life), public task, and legitimate interests. You need at least one, and you should choose the one that fits best. Most of a school’s day-to-day work rests on public task, legal obligation or contract.
Photos show how this works in practice. Schools usually ask for consent before using pupils’ photos for things like social media, a prospectus or the local paper, so check what your school’s own policy says. And consent is for a stated purpose, so a parent who agreed to the website hasn’t agreed to Instagram.
Publishing exam results in the local paper is different. It’s a separate decision, so ask your DPO which lawful basis applies. You still need to tell parents and pupils it’s happening and give them a chance to opt out.
When can I share pupil data with another school or organisation?
Before you share, check you actually need to. Who needs the data? What exactly do they need, and what will they use it for? Can you send it securely? Take a joint trip with another school, where they need allergy and medical details. That’s a good reason to share, but only the details that keep children safe on the day, sent securely, after a word with your DPO.
Safeguarding is the big exception to asking first. Sometimes information has to go to another school or to children’s social care without consent, because asking would put a child at risk. Those decisions belong to your designated safeguarding lead, not to individual staff. Data protection law isn’t a reason to hold back a safeguarding concern: pass it to your DSL through your school’s procedures, as you always would. There’s more on that side of things in our safeguarding courses and resources.
What counts as a data breach, and what should I do?
A data breach is wider than losing a laptop. It’s any security incident where personal data is lost, stolen, destroyed or changed without permission, or seen by someone who shouldn’t see it. An email with a pupil list sent to the wrong parent is a breach. So is a class list left on a bus.
If you spot one, tell your DPO straight away, following your school’s policy. Don’t try to sort it out quietly or wait to see if anyone notices. The DPO assesses how serious it is and decides whether it needs reporting to the Information Commissioner’s Office (ICO) and to the people affected.
Most breaches are prevented by small habits:
- Keep a clear desk and lock away paper records.
- Share a link to a file rather than emailing an attachment, so you can take access away later.
- If you must send an attachment, password protect it and send the password separately.
- Don’t share passwords with colleagues.
- Check what’s on screen before you share it on a video call.
- Lock your computer when you walk away (Windows key + L on a PC).
- Have conversations about individual pupils somewhere private.
What if a parent asks to see or delete their child’s data?
People, children included, have rights over the data a school holds about them. They can ask to see it (a subject access request), to correct it, to have it deleted, or to limit or stop how it’s used. There’s no set format. A request might arrive as a quick email, a comment at the gate, a message on social media or a solicitor’s letter, and it’s still a request.
Schools usually have one calendar month to respond, and the clock starts when the request reaches anyone in the school, not just the office. If one comes to you, pass it straight on through the route in your data protection policy.
Our An Introduction to Data Protection course takes all of this further, with school scenarios to practise on: choosing a lawful basis, spotting special category data, and deciding what you can share. It’s written for any member of school or college staff, takes UK GDPR one plain-English step at a time, and comes with a PowerPoint so you can run the session for colleagues yourself.