Posts

“It’s Just Exams” – Until It Isn’t: Mental Health, Exam Stress and What GDPR Really Says About Sharing Student Data

It’s that time of year again.

The corridors are quieter. The library’s full. Revision guides multiply like gremlins. Students are hunched over past papers, and you’ve lost count of how many times you’ve said, “Just do your best.” Exam season: the annual rite of stress, snacks, and sharp-tipped pencils.

We know the drill. We also know that for some students, it’s more than just pressure. It’s panic. Fear. Sleepless nights. And in some cases, a quiet, growing despair that’s not always easy to spot.

So what happens when one of your students hits a breaking point?

Let’s say you’re a form tutor. One morning, during a routine check-in, a Year 11 student makes an offhand comment that stops you cold: “I’m not sure there’s any point in trying anymore. None of this matters anyway.” They brush it off with a shrug, but something in their tone makes your gut twist.

You’ve got safeguarding training. You know the signs. But now you’re also thinking about what you can and can’t say. What happens if you need to tell someone else? What if they’ve asked you not to? How does GDPR come into play?

Let’s be absolutely clear here: UK GDPR does not prevent you from protecting a student’s wellbeing. The law might sound like it’s all about red tape and locked filing cabinets, but when it comes to emergencies, particularly involving someone’s health or life, it’s surprisingly human.

The key phrase in the legislation is “vital interests.” If a person’s life, health, or safety is at serious risk, you can share their personal information without consent. In fact, in those moments, you’re not just allowed to, you’re expected to act.

So in our example, yes, you absolutely can and should inform your Designated Safeguarding Lead. You might also need to involve mental health services, the student’s parents or carers, or in rare cases, emergency services. You don’t need the student’s permission if you’re worried about their immediate safety. You just need to make a professional, proportionate judgment and record your decision clearly.

That might feel uncomfortable. Students often confide in us because they trust us. It’s natural to want to protect that trust. But safeguarding isn’t about keeping secrets, it’s about keeping people safe. And there’s a way to do both. You can tell the student, calmly and compassionately, that you’re concerned and that you’ll be speaking to someone who can help. It’s not a betrayal. It’s part of the responsibility they trust you to carry.

Let’s take another scenario. An exam invigilator notices a student sobbing quietly during a paper. After the exam, the student says they haven’t eaten in two days because of anxiety. They also beg you not to tell anyone, claiming they’ll be fine. Do you stay silent?

Again, the answer is no. Even if the student appears to be “functioning,” extreme stress, particularly if it’s affecting basic wellbeing like eating and sleeping, can quickly spiral into something more serious. Sharing this concern with your safeguarding lead or school counsellor is entirely appropriate under data protection law. The student’s welfare outweighs their request for secrecy when real harm is at stake.

Of course, not every case is black and white. There will be moments of hesitation. But that’s why having a clear understanding of your school’s safeguarding policy and how it works alongside GDPR is crucial. It helps you act with confidence and compassion.

And let’s not forget the pressure educators are under too. These conversations are emotionally exhausting. You’re juggling exam timetables, parents chasing grades, and students in various states of meltdown. But knowing that the law supports you in putting a student’s mental health first can take one worry off your shoulders.

It’s worth remembering that the Information Commissioner’s Office (ICO) has been vocal on this: data protection is not a barrier to sharing information where someone’s safety is at risk. The myth that “GDPR says no” in these scenarios is not just unhelpful, it’s dangerous.

At the heart of all this is a simple principle: if you’re genuinely worried about a student’s wellbeing, you must act, and the law supports you in doing so. Share what’s necessary, with those who need to know, and keep a clear, factual record of what you’ve done and why.

So as exam season stretches on and stress levels rise, keep your eyes open, your ears tuned, and your instincts sharp. You might be the person a student trusts most. And in a moment of crisis, that trust can be life-changing so long as you’re willing to act on it.

Because sometimes, “just exams” are anything but.

/by

Wall Displays and Data Delays: Preparing for Inspection Without Breaching GDPR

There’s something unmistakable in the air when an inspection is on the horizon. You can feel the hum of preparation in every corridor; policies being printed, classroom displays getting a refresh, and colleagues exchanging knowing glances over the photocopier. It’s all hands-on deck, and every detail matters.

But as walls are re-pinned and cupboards reorganised, another question often arises quietly in the background: Are we still within the bounds of data protection law?

The answer isn’t always as straightforward as we’d like. In fact, GDPR considerations often become most visible in the very things we proudly display on classroom walls, in shared corridors, or on digital screens. And during inspection season, those questions only feel more urgent.

Let’s consider a familiar example: a colourful “Star of the Week” board, complete with names, photos, and personal achievements. It’s a lovely way to celebrate success but what if one of those pupils has a parent who didn’t give consent for photos? Or a safeguarding concern that makes public identification risky? Even the most well-intentioned display can inadvertently stray into problematic territory.

The same applies to medical or allergy information. Many schools use posters or visual aids to make staff aware of pupil needs, particularly in lunch halls or near staff kitchens. But if that information includes photos, names, and medical conditions in areas accessed by other pupils or visitors, it crosses into “special category data” under UK GDPR. That kind of information requires extra care.

Digital spaces are no less important. In the rush to prepare documents, it’s easy to leave a screen open or a shared drive exposed. But if personal pupil data is left visible or accessible to those without a legitimate reason to view it, the school could find itself facing not only a privacy concern, but potentially a reportable data breach.

None of this means schools must remove every trace of student celebration or wrap the walls in plain paper. GDPR doesn’t ask us to stop recognising achievement, it asks us to think critically about how we do it.

One school I worked with ran what they called a “privacy walk” in the days leading up to an inspection. Staff took ten minutes to walk through shared spaces with fresh eyes, asking themselves: Can visitors see anything they shouldn’t? Are personal details on show unnecessarily? Are we being mindful with how we display medical or safeguarding information? It was a quick, simple exercise that made a measurable difference to their overall compliance, and their confidence, on inspection day.

Similarly, one teacher I spoke to found an elegant solution to a parent’s concern over public displays of progress. Instead of using names on her reward chart, she assigned each child an animal symbol; “Team Owl,” “Team Fox,” and so on. It respected privacy, kept parents satisfied, and the pupils embraced it wholeheartedly.

What matters most is that schools are able to demonstrate thoughtful, proportionate decision-making. Inspectors don’t expect perfection, but they do expect to see that staff understand the principles of data protection and have taken reasonable steps to comply.

If you’re unsure about a display, a chart, or a staffroom noticeboard, ask yourself: Is it necessary? Is it proportionate? And have we obtained the right consent, where needed? If you’re still unsure, speak to your data protection lead or DPO. Getting the answer right before inspection day is far easier than addressing concerns after the fact.

Ultimately, compliance isn’t about red tape, it’s about respect. Respecting pupils’ rights, respecting families’ expectations, and respecting the trust placed in schools to safeguard not only children, but their information.

So as inspection season gathers pace, take a moment to review the little things. The name tags, the photo walls, the charts with more detail than needed. Because when the inspector walks in and the questions start, you’ll be glad you did.

/by

Data Protection vs. Information Security in Schools — Why Both Matter, and How to Get Them Right

Let’s face it, school leaders today wear a lot of hats.

One minute, you’re supporting staff wellbeing; the next, you’re signing off on an EdTech contract, responding to a Subject Access Request, or checking if the new Wi-Fi rollout has encryption (whatever that means, right?).

In today’s increasingly digital world, two terms often crop up: Information Management (or data protection) and Information Security.

They sound similar, and they are closely connected, but they’re not the same. Both are essential in keeping your school’s data safe, legal, and well-managed. Understanding the difference can help you ask the right questions, delegate responsibilities wisely, and build a strong culture of trust and compliance across your school.

Let’s unpack what each one means, and why both matter equally.

What’s the Difference?

Information Management (Data Protection)

This is about how personal data is collected, used, stored, shared and deleted in line with laws like the UK GDPR and the Data Protection Act 2018. It’s focused on the rights of individuals (like pupils, parents and staff) and ensuring their personal data is treated fairly and lawfully.

Think of it as the “legal and ethical brain” behind how information flows through your school.

Examples:

  • Making sure parental consent is collected for use of a pupil’s photo
  • Responding to Subject Access Requests within the required timeframe
  • Having a clear retention schedule (so you’re not holding on to pupil data for 25 years “just in case”)
  • Ensuring only authorised staff can access safeguarding notes or health records

Lead roles: Usually the Data Protection Officer (DPO) or a senior leader with compliance responsibilities.

Information Security

Information security is about the technical and organisational measures you take to protect information from loss, damage, unauthorised access, or theft, whether it’s stored on paper, a laptop, or in the cloud.

It’s the “digital and physical shield” that keeps your systems and data safe.

Examples:

  • Encrypting devices and backing up files
  • Using strong passwords and locking screens
  • Preventing ransomware attacks
  • Ensuring staff don’t email personal data to the wrong recipient

Lead roles: Typically your IT manager, network team, or a designated security officer, often working closely with the DPO.

Aren’t They Completely Separate?

Not quite.

While information management and information security are distinct disciplines with different focuses, they are both key components of compliance under the UK GDPR.

In fact, the UK GDPR specifically requires organisations (including schools) to:

  • Process personal data lawfully, fairly and transparently (that’s information management)
  • Implement appropriate technical and organisational measures to keep data secure (that’s information security)
  • Be able to demonstrate accountability across both areas

So while they each require different expertise, they’re two sides of the same coin when it comes to protecting personal data.

If you have a great privacy policy but your systems are wide open to cyber threats you’re not GDPR compliant. And vice versa: even bulletproof IT security can’t cover for poor practices around data sharing, consent, or retention.

Why You Need Both

Let’s say that your school introduces a new wellbeing platform for pupils.

  • You’ve reviewed its privacy notice
  • You’ve completed a DPIA
  • You’ve told parents how the data will be used

But…

  • Staff are accessing it using shared logins
  • The password is “admin123”
  • You haven’t enabled two-factor authentication

You’ve done your information management well but failed on information security. That could still result in a data breach.

On the flip side, imagine the platform is highly secure; encrypted, password protected, hosted in the UK, but the school didn’t check the legal basis for processing or review the contract terms.

Now you’ve got a data protection problem.

Bottom line?
You need both working together to meet your responsibilities, legally and ethically.

 

So What Does Good Practice Look Like in a School?

Here’s a blended checklist of best practices to help keep your school safe, compliant and prepared:

Do Regular Data Audits

  • Know what personal data you hold, where it’s stored, why you need it, and how long you’re keeping it.
  • Review systems, spreadsheets, email lists, and apps, not just paper records.

Train Staff in Both Areas

  • Teach all staff the basics of data protection and information security, from recognising phishing emails to understanding how to respond to a Subject Access Request.
  • Tailor training for higher-risk roles (e.g. safeguarding, admin, SEND).

Lock It Down

  • Use strong passwords, screen locks, and encrypted devices.
  • Remove access for staff who no longer need it (or have left the school).
  • Consider multi-factor authentication for sensitive systems like MIS or safeguarding platforms.

Review and Share Clear Policies

  • Acceptable use, email and internet use, breach reporting, retention and disposal policies, these shouldn’t be buried on your intranet.
  • Keep them short, practical, and jargon-free.

Don’t Keep Data “Just in Case”

  • Apply your retention schedule and securely delete or archive data once it’s no longer needed.
  • Shred paper records and securely wipe devices.

Be Breach-Aware

  • Know what a breach is (It’s not just data hacking, sending data to the wrong person counts too!)
  • Have a simple breach reporting process that all staff understand
  • Keep a breach log and review it regularly with SLT and your DPO

Shared Responsibility

Data protection isn’t just the DPO’s job. And security isn’t just for the IT team.

Every member of staff has a part to play, from the headteacher to the lunchtime supervisor. By making these two areas part of your everyday school culture, you create a safer environment for your staff, your students, and your wider community.

If you’re not sure where your school stands on data protection or security, you’re not alone. Many schools benefit from a joint review with their DPO, IT team, and SLT, looking at risks, roles, and readiness.

If you’re looking to strengthen both areas, consider:

  • Running a joint INSET session on “Data Protection + Cyber Hygiene”
  • Reviewing your breach log together with IT and DPO staff

Booking an external audit of your information governance and security setup

/by

SARs vs School Records: Subject Access or Education Regulations?

If you’ve ever opened your inbox and seen a message from a parent asking for “all the information you hold on my child,” your first thought was probably:

“Subject Access Request!”

But hold on — not every request for pupil information automatically falls under the UK GDPR. Sometimes, it’s actually a request under education regulations, depending on what’s being asked — and the type of school you are.

Understanding the difference is key. Not only does it help you respond lawfully and efficiently, but it also helps manage expectations and avoid unnecessary workload.

There are two main legal routes parents (or pupils themselves) might use to request access to information:

  1. Subject Access Request (SAR) – under the UK GDPR / Data Protection Act 2018

This allows an individual, including a pupil depending on their age and capacity, to request their own personal data.

  1. Request for the Educational Record – under the Education (Pupil Information) (England) Regulations 2005

This allows parents to request a copy of their child’s educational record, but only if the child attends a maintained school.

Let’s look at each in a little more detail.

Subject Access Requests (SARs) – GDPR territory

This is all about personal data.

Anyone can ask for a copy of the data you hold about them, including pupils (depending on their age and maturity), staff, or parents asking for their own data.

When it comes to parents asking for their child’s data, you’ll need to check whether the child is old enough and mature enough to understand what’s being asked. If they are, they should normally be the one making the request or at least give permission for the parent to do it on their behalf.

If they’re younger or not able to understand, the parent can usually make the request.

What does a SAR cover?

Any personal data you hold about that person. That might include:

  • Behaviour notes
  • Emails mentioning the pupil
  • Health or SEN info
  • Safeguarding logs (with care!)
  • CCTV footage (if the pupil is clearly visible)

When it comes to Subject Access Requests, any type of school may receive a request, including maintained, academies, free schools, and independents and you have 1 calendar month to respond.

Request for the Educational Record – Pupil Regulations

This one is specifically for parents of children at maintained schools (i.e. those run by local authorities). It gives them the right to see their child’s educational record, which is basically anything to do with their progress, learning, and life in school.

What counts as an educational record?

Think stuff like:

  • School reports
  • Attendance records
  • SEN plans
  • Notes from parent-teacher meetings
  • Behaviour points
  • Targets or interventions

It doesn’t include:

  • Child protection files
  • Teacher’s personal notes
  • Information that could seriously harm the child or someone else

Under these regulations, you have 15 school days to respond. You can also apply a charge to cover printing or postage, though most schools just send it electronically for free these days.

For academies and free schools, the right to the educational record doesn’t apply. But many still choose to share records in a similar way, just to be helpful and consistent. It is the same deal with Independent schools, there is no right to the educational record. Parents need to go down the SAR route if they want information about their child, and only if the child isn’t old enough to make the request themselves.

While SARs and education record requests are different, there’s a bit of crossover. Some information might be shared under both, and that’s OK. The key is understanding which law applies and making sure you’re not accidentally oversharing or withholding something you shouldn’t.

When in doubt, take a breath, talk to your DPO, and go from there.

/by

“It’s Not the End of an Era Without a Hoodie”: School Leavers, Traditions and the Truth About GDPR

It’s that time of year again.

The weather’s warming up (at least in theory), the final exam papers are piling up in the staffroom, and the Year 11s, full of nervous energy, optimism, and just a hint of mischief, are preparing to say their goodbyes. It’s the season of leavers’ assemblies, nostalgic slide shows, and of course, the all-important question: “Can we get hoodies with all our names on them?”

Cue the GDPR panic.

Every year, in schools up and down the country, a familiar scenario plays out. A well-meaning teacher or member of the PTA offers to organise personalised hoodies or put together a yearbook featuring class photos and messages. And then, someone asks the question that stops the printer in its tracks: “Wait… is this even allowed under GDPR?”

Let’s unravel this together, because despite what some may believe, GDPR isn’t the fun police. It doesn’t mean you have to cancel prom or produce an anonymised yearbook with stick figures instead of class photos.

The truth is, most of these cherished school traditions can go ahead, so long as they’re handled with care, clarity, and a bit of common sense.

Take the humble leavers’ hoodie. It’s one of those rites of passage that students will cling to years after they’ve grown out of it. Names printed on the back, sometimes nicknames, sometimes surnames, sometimes the dreaded full first-middle-last-name combo. From a data protection point of view, names are indeed personal data. But does that mean you can’t print them?

Absolutely not. You just need a lawful basis to do it—and in most cases, that’s as simple as getting consent.

Whether it’s for hoodies, a yearbook, or a slideshow featuring baby photos, if you’re collecting and sharing personal data outside of core educational purposes, it’s best practice to ask students (or their parents, depending on age) for permission. A simple form will do the trick. The key is to be clear about what data you’re using, where it will appear, and who will see it. No tricks, no fine print in size six font.

And yes, you can still include photos. There’s no secret clause in the UK GDPR that says a picture of Year 11 on the school field at lunchtime is forbidden. If it’s for a yearbook, prom night collage, or school website tribute, the same principle applies; be transparent, get the appropriate permissions, and store images securely. That’s it.

There’s a myth that GDPR somehow outlawed all joy in schools, but the reality is it just asked us to stop being sloppy with data. It’s about respect, not restriction.

Then there’s the classic signing shirts. The ink-stained rite of passage, where uniforms are transformed into messy tributes of inside jokes and hastily scrawled farewells. A few educators have raised their eyebrows at this tradition, worrying it could constitute “uncontrolled data sharing.”

Realistically, if a student voluntarily hands their shirt to a friend and says, “write something embarrassing on my back,” this isn’t a data protection issue, it’s a social one. GDPR doesn’t govern private, student-to-student interactions unless the school is actively collecting and publishing that content. So, you don’t need to enforce a shirt-signing ban (and if you tried, good luck…).

Now, about prom. Some schools host their own; others let parents or external companies run the show. Either way, collecting names for tickets, dietary needs, or emergency contact details is fine, just make sure you’re only collecting what you actually need, and that the data isn’t floating around on someone’s USB stick or unprotected spreadsheet. The golden rule? If you wouldn’t want your own teen’s info handled that way, don’t do it to someone else’s.

So here’s the bottom line: don’t let GDPR myths steal the spotlight from your leavers’ celebrations. Data protection doesn’t mean you can’t celebrate your students. It just asks that you do it with intention.

After all, what better way to send off the next generation than by teaching them that privacy and parties can coexist?

Let them have their yearbooks. Let them wear hoodies emblazoned with names they’ll cringe at later. Let them dance the awkward final dance at prom. And let them remember that their school cared enough to protect their memories without over-policing their goodbyes.

/by

FOI Requests in Schools: Navigating Transparency and Avoiding Misuse of Exemptions

As public bodies, UK schools are increasingly in the spotlight when it comes to transparency. Freedom of Information (FOI) requests are a key legal mechanism for parents, campaigners, and the media to access information about how schools operate but they’re also on the rise, especially around exams, assessments, and decision-making processes.

For school administrators and data protection leads (DPLs), responding to FOI requests isn’t just a legal duty under the Freedom of Information Act 2000, it’s also an opportunity to build public trust through transparency. Therefore, it’s crucial to understand your responsibilities, and the risks, when responding to these requests, especially as scrutiny intensifies.

Why Are FOI Requests Increasing in Schools?

Since the pandemic, there’s been a noticeable uptick in FOI activity directed at schools and trusts. Some of the key drivers include:

  • Concerns about exam grading during teacher-assessed years
  • Requests for exam board correspondence and internal moderation policies
  • Transparency around assessment algorithms or standardisation approaches
  • Access to emails or records related to grade appeals
  • Inquiries about pupil exclusions during exam periods

Schools across the UK have reported a surge in FOI requests during May–July, often clustered around GCSE and A-Level periods. These are not always straightforward, and many come from organised campaigns or media investigations.

What Is Covered by FOI in Schools?

Under the Freedom of Information Act 2000, anyone can request recorded, non-personal information. This includes:

  • Curriculum and assessment policies
  • Staff guidance or marking frameworks
  • Internal minutes or email chains (if recorded)
  • Communication with exam boards or local authorities

It does not cover:

  • Personal data about students or staff (that’s handled under UK GDPR)
  • Opinions that weren’t formally recorded

The Right Way to Respond

Every request must be handled lawfully, objectively, and in good faith. The basic process:

  1. Acknowledge: Respond within 20 working days
  2. Clarify if the request is vague or excessive
  3. Assess whether you hold the data and how much effort is required
  4. Apply exemptions only where legally justified
  5. Provide the information, or explain your reasons for refusal

Maintain a full audit trail of your decisions, especially if you’re applying an exemption.

Use of Exemptions: Don’t Overreach

The FOI Act includes several exemptions but misusing them can damage your reputation and trigger ICO scrutiny. Common (and often misapplied) exemptions in schools include:

  • Section 36 (prejudice to effective conduct of public affairs): Often used to withhold internal discussions but must be supported by recorded reasoning from a qualified person (e.g. Headteacher)
  • Section 40 (personal data): Use only where releasing the info would breach data protection law
  • Section 22 (future publication): You must have a clear intention to publish the info soon

Exemptions serve a purpose, but overusing or misapplying them risks eroding public confidence and triggering ICO complaints. As stewards of public funds and student welfare, UK schools should aim to default to openness, using the FOI framework as a tool to engage, not to evade.

Real-world caution:

A secondary school used Section 36 to refuse a request for internal marking guidance during a teacher-assessed grading period. The requester complained to the ICO, who found that the school had not sufficiently evidenced how disclosure would “prejudice the conduct of public affairs.” The school had to release the material.

Best Practices for UK Schools

  • Have a written FOI policy and publish it on your website
  • Train front-office and SLT staff on identifying and escalating FOI requests
  • Work with your DPO or local authority when applying exemptions
  • Log every request, decision, and rationale
  • Avoid redacting out of caution: Redact only what is necessary under the Act
  • Be proactive: Publishing certain information online (e.g. assessment policies, appeals processes) can reduce the volume of individual FOIs

When FOI Meets Exams: Be Prepared

To reduce stress and ensure legal compliance during exam season:

  • Review your assessment policy and have a version ready to share
  • Document all grade moderation discussions formally
  • Keep communications with exam boards organised and accessible
  • Clarify what can and cannot be disclosed under FOI vs. Subject Access Rights

Final Thought: Transparency Is a Strength, Not a Risk

It’s tempting to view FOI requests as administrative burdens or reputation threats. But when handled lawfully and openly, they demonstrate professionalism, fairness, and accountability. Use exemptions sparingly and transparently, and never to avoid embarrassment or scrutiny.

/by

“We’re Getting Fingerprint Scanners!” – Wait… Did Anyone Do a DPIA?

There’s a certain kind of email that arrives in a school inbox that immediately raises eyebrows. It starts with something like:

“Exciting news! We’re trialling new biometric scanners in the canteen to speed up lunch queues!”

It’s followed by promises of efficiency, reduced lunch line chaos, and fewer forgotten PINs. On the surface, it sounds brilliant. Who wouldn’t want a futuristic solution to an age-old problem?

But here’s the thing: before you ask a group of eleven-year-olds to hand over their fingerprints for a chicken nugget, you need to stop and ask a bigger question… Have we done a Data Protection Impact Assessment (DPIA)?

You may wonder why it is so important. A DPIA isn’t just some bureaucratic hoop to jump through. It’s a vital safeguard designed to help schools understand how a new system or process might affect people’s privacy, especially when you’re dealing with sensitive or high-risk data.

In schools, we hold data about children who are arguably some of the most vulnerable individuals in society. Introducing new tech that collects biometric data (like fingerprints or facial recognition) raises serious privacy concerns. Biometric data is classed as “special category data” under the UK GDPR, which means it requires extra care and justification.

A DPIA helps you figure out: What data is being collected, why you need it, what risks it poses to individuals and, how to mitigate those risks. Even more crucially, it helps you decide whether the shiny new system is really necessary in the first place.

Let’s return to that canteen scanner idea. The supplier promises that fingerprinting pupils will slash queue times and reduce cash handling. Sounds efficient, right?

But have we asked:

  • Do we really need biometric data for this?
  • Could a swipe card or QR code achieve the same result with less risk?
  • What happens if a student refuses to give their fingerprint?
  • How securely will this data be stored and, who can access it?

Without a DPIA, these questions may never even surface.

Or take another example: your school is rolling out a new online safeguarding tool that uses artificial intelligence to flag potential risks based on student writing. Impressive? Maybe. Intrusive? Potentially. A DPIA would help you assess whether the tool’s benefits outweigh the privacy implications, and what safeguards should be in place.

Remember… behind every “data point” is a real child. Their birthday. Their behaviour record. Their image. Their fingerprint.

A DPIA isn’t about red tape. It’s about respecting the trust families place in us. It’s about making thoughtful, informed choices, not just because it’s the law, but because it’s the right thing to do.

And honestly, it’s also about protecting your school. If things go wrong, if a data breach happens, or parents push back, a completed DPIA shows you took privacy seriously. It shows you were proactive, not reactive.

A Culture Shift, Not a Paper Exercise

The best schools aren’t just doing DPIAs to tick a box. They’re building a culture where people ask early on:

“Could this new system affect how we handle personal data?”

“Do we need to speak to the Data Protection Officer before we go ahead?”

“Have we thought this through, not just for us, but for our students?”

That’s where real digital responsibility begins. Not in a policy document, but in everyday conversations.

So next time someone suggests a new app, platform, or process… pause. Before you roll it out, before the training sessions and the excited emails, check whether a DPIA is needed.

Because in a world where data is power, doing a DPIA is how we wield that power wisely. Not to impress with tech, not to dazzle with dashboards but, to protect, to consider, and to educate with integrity.

/by

Curtain Up, Camera Out: Navigating Photos, Videos and GDPR at the School Play

It’s opening night. The school hall smells faintly of paint and paper mâché. There’s a Year 5 pupil with a cardboard crown that’s just a little too large for their head, nervously adjusting their costume backstage. Parents are streaming in, phones at the ready, clinging to the best seats like it’s Glastonbury. You’ve made it to the school play and so has the annual data protection dilemma.

Because as predictable as last-minute prop malfunctions and forgotten lines, come the whispered queries: “Can I film this?” “What if someone else’s child is in the shot?” “Are we even allowed to take photos anymore?”

Ah yes, welcome to the wonderfully confusing world of data protection and school performances. Where nativity scenes meet nuanced legislation, and Mary’s not the only one cradling something precious.

Let’s start with the basics. Parents taking photos or videos for personal use? Absolutely fine. UK GDPR isn’t interested in mums and dads snapping a picture of their little star as the third shepherd from the left. That’s considered a “purely personal or household activity,” and data protection laws don’t apply. Parents can cheer, film, and Instagram away, within reason.

But let’s say a parent asks for a copy of the school’s official video of the play. Now we’ve stepped into a different category. If the school is recording or photographing the event, it’s processing personal data. That means GDPR applies. The school must be clear about what it’s capturing, why, and how that footage will be used or shared.

It’s here that things can get thorny.

For instance, imagine you’ve got a pupil in Year 4 whose parent has specifically requested their child not be photographed, perhaps due to safeguarding concerns. If that child ends up in the wide-angle shot of the final scene, and the video is later shared on the school’s website, that’s not just a mistake, it’s a potential data breach.

So schools have to tread carefully. It means thinking ahead. It means letting parents know in advance what will be filmed, how long the footage will be kept, and getting clear consent for public use, especially if the content might be shared beyond the school community.

Then there’s the grey area of social media. Suppose a proud grandparent posts a clip of the school play on Facebook, featuring multiple children in the background. No malice, no agenda, just pride. Still, if that video ends up widely circulated or accessible to people outside the immediate circle, concerns can start to surface. And suddenly, the school may get complaints from parents who hadn’t realised their child might appear in someone else’s family montage.

Educators often find themselves caught between celebrating achievements and navigating consent. You want to showcase the joy, the creativity, the culmination of weeks of rehearsal. But you also don’t want to inadvertently violate someone’s privacy or their trust.

So what can be done?

Communication, as always, is your best friend. Set expectations early. Let families know what the school’s policy is on filming and photography. Provide opportunities for opt-outs and be clear that personal recordings must not be posted publicly without consent from all those featured.

And if you’re recording the event as a school, make sure your privacy notices are up to date, your consents are meaningful, and your editing software is ready just in case someone needs to be cropped or blurred.

One school I worked with handled it beautifully: before the play, the headteacher gave a warm, informal announcement. “We know you’ll want to remember tonight,” she said. “Feel free to take photos of your own child, but please be mindful of others. Let’s celebrate the magic without forgetting that we all have different comfort levels.”

The audience appreciated the reminder. Phones were out, but respectfully so. And not a single complaint followed.

Ultimately, the aim isn’t to dampen the occasion, it’s to protect the people in it. Children deserve to shine on stage without worrying about where that footage might end up. And parents deserve clarity about how their children’s images are being used.

So as the lights dim and the narrator clears their throat, take a breath. You’ve got the play under control. And with a little forethought, you’ve got the data protection side covered too.

Break a leg, and maybe set your camera to “portrait mode.”

/by

“Can I Share That?”: Why Regular GDPR Training Matters in Schools

It’s a typical Tuesday morning in the staffroom. Someone’s burnt their toast, the last tea bag has mysteriously vanished, and your inbox flashes up with a reminder: “Mandatory GDPR Refresher – 20 minutes.” There’s a quiet groan. Not because anyone doubts its importance but because, for many, data protection training sits firmly in the category of necessary but dry.

And yet, in schools, the relevance of GDPR couldn’t be more real. Far from being a background compliance exercise, it’s something woven into nearly every task we undertake whether we realise it or not. It’s in the way we send emails to parents, the way we store SEN reports, or how we display pupil names on classroom walls.

The truth is, GDPR awareness isn’t a one-off event. It’s a practice. And like all good practice, it requires routine reflection, updated understanding, and yes, refreshers.

Take, for example, a school that proudly circulated a birthday list to families in a class newsletter. A small act of celebration, warmly intended. But one child on the list was under a court order that required their identity to be protected. The result wasn’t malicious, but it did amount to a serious lapse in data handling, one that could have been avoided with more regular, scenario-based reminders.

Every member of staff in a school; teachers, support staff, lunchtime supervisors, even volunteers, comes into contact with personal data. That might be in the form of a safeguarding note, an attendance register, or a photo taken during a school trip. It’s not the presence of data that’s the issue, but how thoughtfully and lawfully it is used.

Regular GDPR training and awareness sessions provide the confidence and clarity staff need to navigate this landscape. They help reinforce the day-to-day decisions like locking screens, avoiding personal email use, or checking consent for photographs, that protect children’s rights and safeguard the school from reputational and legal risk.

Some schools are rethinking the format of these refreshers. One primary school incorporated short GDPR tips into their weekly staff briefings: “This week’s reminder is about using BCC in group emails.” It was informal, quick, and incredibly effective at keeping privacy principles front of mind without overwhelming staff.

Others have taken a more reflective approach, using anonymised real-life incidents from within the school to frame learning: “Remember when a report was accidentally emailed to the wrong parent?” These moments serve as powerful learning tools. They aren’t theoretical, they’re rooted in the real and immediate experience of the staff team.

In a world of competing priorities, it’s easy for GDPR to feel like a tick-box activity. But when an incident happens, be it a data breach, a complaint, or a safeguarding issue, it instantly becomes urgent and central. At that point, it’s not just about compliance. It’s about trust.

GDPR, at its core, is about respecting people, their privacy, their safety, their dignity. Educators are entrusted with not only children’s learning, but their stories, their vulnerabilities, and their personal details. That trust deserves care and vigilance, not just once a year, but as part of our professional mindset.

So, the next time a GDPR refresher request lands in your inbox, perhaps see it for what it is, a professional check-in that helps you protect your pupils, your school, and yourself. It’s not about ticking a box, it’s about reinforcing a culture of thoughtful, respectful data handling.

Because good data protection practice in schools isn’t about fear. It’s about professionalism, empathy, and safeguarding, both online and offline.

/by

Careless Talk Causes Breaches

…(and can be costly too!)

 

GDPR is not normally associated with parties, but recently I heard the end of a conversation about an office Christmas party and it set me thinking about the impact that a misplaced sentence can have. Friendships and working relationships can be badly damaged, in some cases, irreparable.

If I choose to pass on my unvarnished opinion about a colleague during the Christmas bash, then I can find myself in a lot of trouble. If on the other hand, I whisper information that has come from the data controller then not only am I in hot water, but I’ve also given the extra present of a data breach.

Paragraph 4, Article 32 of the GDPR says:

“The controller and processor shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law.”

Put more simply, you must ensure that people are given clear guidance about what they can and can’t do with personal data and you must ensure they stick to those rules.

Bear in mind that it doesn’t matter how information is disclosed for it to be a breach. Whether you’ve been hacked, sent an email to the wrong person, lost a paper file or repeated information to someone who shouldn’t know it, a breach has occurred.

With verbal disclosure the situation is often made worse by the fact that our natural desire is to share more ‘interesting’ information, which is also usually more confidential and leads to greater upset.

We’ve seen examples where incidents have been dealt with from a disciplinary standpoint but have gone unrecognised as a data breach. Obviously, if you need to report the breach to the ICO, you’ll have to explain why you missed the 72-hour deadline for reporting. It is difficult to say that you have a sound regime for data protection but missed this high-profile target.

What steps should you take to avoid these issues:

Training
  • All your staff need to know about the risks of verbal disclosure. Include it in your normal GDPR training but you may need to provide a special briefing. As well as knowing that they need to notify your DPO or GDPR lead, it’s a great time to remind people of the perils of letting information slip.
Easy reporting
  • Take away any barriers that prevent staff from alerting you to an issue. Have an email address just for staff to alert you of issues or consider an online form.
A response procedure
  • If people do report issues then you need to have a well-established procedure to deal with them. Get it recorded and you can even practice to make sure the 72-hour deadline can be met.
Joined up processes
  • Issues which trigger disciplinary procedures may relate to data protection issues and vice-versa. Make sure that there is a section in the guidance for both areas that highlights the risks and include this in your general training and particularly induction training.

So, as you contemplate the upcoming festivities, it may be worth a timely reminder to everyone that we have to consider what we’re saying just as much a what goes into an email.

/by