Posts

“Can I Share That?”: Why Regular GDPR Training Matters in Schools

It’s a typical Tuesday morning in the staffroom. Someone’s burnt their toast, the last tea bag has mysteriously vanished, and your inbox flashes up with a reminder: “Mandatory GDPR Refresher – 20 minutes.” There’s a quiet groan. Not because anyone doubts its importance but because, for many, data protection training sits firmly in the category of necessary but dry.

And yet, in schools, the relevance of GDPR couldn’t be more real. Far from being a background compliance exercise, it’s something woven into nearly every task we undertake whether we realise it or not. It’s in the way we send emails to parents, the way we store SEN reports, or how we display pupil names on classroom walls.

The truth is, GDPR awareness isn’t a one-off event. It’s a practice. And like all good practice, it requires routine reflection, updated understanding, and yes, refreshers.

Take, for example, a school that proudly circulated a birthday list to families in a class newsletter. A small act of celebration, warmly intended. But one child on the list was under a court order that required their identity to be protected. The result wasn’t malicious, but it did amount to a serious lapse in data handling, one that could have been avoided with more regular, scenario-based reminders.

Every member of staff in a school; teachers, support staff, lunchtime supervisors, even volunteers, comes into contact with personal data. That might be in the form of a safeguarding note, an attendance register, or a photo taken during a school trip. It’s not the presence of data that’s the issue, but how thoughtfully and lawfully it is used.

Regular GDPR training and awareness sessions provide the confidence and clarity staff need to navigate this landscape. They help reinforce the day-to-day decisions like locking screens, avoiding personal email use, or checking consent for photographs, that protect children’s rights and safeguard the school from reputational and legal risk.

Some schools are rethinking the format of these refreshers. One primary school incorporated short GDPR tips into their weekly staff briefings: “This week’s reminder is about using BCC in group emails.” It was informal, quick, and incredibly effective at keeping privacy principles front of mind without overwhelming staff.

Others have taken a more reflective approach, using anonymised real-life incidents from within the school to frame learning: “Remember when a report was accidentally emailed to the wrong parent?” These moments serve as powerful learning tools. They aren’t theoretical, they’re rooted in the real and immediate experience of the staff team.

In a world of competing priorities, it’s easy for GDPR to feel like a tick-box activity. But when an incident happens, be it a data breach, a complaint, or a safeguarding issue, it instantly becomes urgent and central. At that point, it’s not just about compliance. It’s about trust.

GDPR, at its core, is about respecting people, their privacy, their safety, their dignity. Educators are entrusted with not only children’s learning, but their stories, their vulnerabilities, and their personal details. That trust deserves care and vigilance, not just once a year, but as part of our professional mindset.

So, the next time a GDPR refresher request lands in your inbox, perhaps see it for what it is, a professional check-in that helps you protect your pupils, your school, and yourself. It’s not about ticking a box, it’s about reinforcing a culture of thoughtful, respectful data handling.

Because good data protection practice in schools isn’t about fear. It’s about professionalism, empathy, and safeguarding, both online and offline.

/by

Careless Talk Causes Breaches

…(and can be costly too!)

 

GDPR is not normally associated with parties, but recently I heard the end of a conversation about an office Christmas party and it set me thinking about the impact that a misplaced sentence can have. Friendships and working relationships can be badly damaged, in some cases, irreparable.

If I choose to pass on my unvarnished opinion about a colleague during the Christmas bash, then I can find myself in a lot of trouble. If on the other hand, I whisper information that has come from the data controller then not only am I in hot water, but I’ve also given the extra present of a data breach.

Paragraph 4, Article 32 of the GDPR says:

“The controller and processor shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law.”

Put more simply, you must ensure that people are given clear guidance about what they can and can’t do with personal data and you must ensure they stick to those rules.

Bear in mind that it doesn’t matter how information is disclosed for it to be a breach. Whether you’ve been hacked, sent an email to the wrong person, lost a paper file or repeated information to someone who shouldn’t know it, a breach has occurred.

With verbal disclosure the situation is often made worse by the fact that our natural desire is to share more ‘interesting’ information, which is also usually more confidential and leads to greater upset.

We’ve seen examples where incidents have been dealt with from a disciplinary standpoint but have gone unrecognised as a data breach. Obviously, if you need to report the breach to the ICO, you’ll have to explain why you missed the 72-hour deadline for reporting. It is difficult to say that you have a sound regime for data protection but missed this high-profile target.

What steps should you take to avoid these issues:

Training
  • All your staff need to know about the risks of verbal disclosure. Include it in your normal GDPR training but you may need to provide a special briefing. As well as knowing that they need to notify your DPO or GDPR lead, it’s a great time to remind people of the perils of letting information slip.
Easy reporting
  • Take away any barriers that prevent staff from alerting you to an issue. Have an email address just for staff to alert you of issues or consider an online form.
A response procedure
  • If people do report issues then you need to have a well-established procedure to deal with them. Get it recorded and you can even practice to make sure the 72-hour deadline can be met.
Joined up processes
  • Issues which trigger disciplinary procedures may relate to data protection issues and vice-versa. Make sure that there is a section in the guidance for both areas that highlights the risks and include this in your general training and particularly induction training.

So, as you contemplate the upcoming festivities, it may be worth a timely reminder to everyone that we have to consider what we’re saying just as much a what goes into an email.

/by

How the Department for Education ran into trouble with the ICO

Being as clear as mud when it comes to Data Protection

A key principle of data protection is transparency. You must be upfront about what you plan to do with personal data.

A failure to be transparent has recently brought the Department for Education into the Information Commissioner’s Office’s sights. Information from the annual census returns was apparently shared with Immigration Officials, without the data subjects being informed. This is the opposite to what you should be doing.

According to an article in the Guardian the ICO position is that:

“Our view is that the DfE is failing to comply fully with its data protection obligations, primarily in the areas of transparency and accountability, where there are far reaching issues, impacting a huge number of individuals in a variety of ways.”

It’s not clear yet what the consequences for the DfE will be from these findings.

Just a few days before the news about the DfE broke, the Information Commissioner felt compelled to ensure that political parties understood their data protection responsibilities as we head towards the election in December.

In addition to telling the parties that they needed to follow the principles of data protection, she also specifically addressed the controversial issue from the Brexit Referendum and subsequent elections – advertising on social media.  You can read the Commissioner’s full statement here.

These concerns are about transparency. How do you know what someone is doing with your personal data and how that usage might affect your rights and freedoms? The GDPR is very clear about the information that should be provided especially when your personal data is being used. It’s not always clear how well individuals understand the information presented to them, if they are given any at all.

The principle of transparency doesn’t just apply to political parties and government departments. It should be the cornerstone of the data protection policies and practices for every organisation.

So, what does Transparency mean for an organisation in the Education sector?

  • You must be clear about why you are processing personal data
  • You must be able to show you’re using the minimum data necessary
  • You must be able to show you have a legal basis for your processing and sharing of data
  • You must take action to inform individuals about how their data is being processed

How can you demonstrate that you’re meeting these requirements?

Your data mapping, providing it follows the model set out by the ICO will address the first three and your privacy notices should address the last item.

Our experience is that many schools and colleges haven’t mapped their use of personal data to the level of detail that the regulation expects, and this could become a problem if a complaint is raised by a data subject.

You may know in detail how data is collected, stored, updated and shared, but the legislation requires that this is documented. Does your documentation fully cover the movement of personal data around the organisation?

Do your privacy notices strike the balance of informing individuals about how their data is used while being accessible and unambiguous.

While you try and figure out the fake news from the real around the election it may be a good time to ensure that you’re being properly open about the way you collect and use personal data.

If you are unsure how you process data, or would like some guidance on how to document this, please contact our GDPR experts on 0113 804 2035 or click here.

/by