Why do we collect and use pupil information?
We collect and use pupil information under Article 6.1c, and Article 9 2d of the GDPR (Article 6 1a - processing is necessary for compliance with a legal obligation; Article 9 2d - processing is carried out in the course of its legitimate activities).
We use the pupil data:
The categories of pupil information that we collect, hold and share include:
Collecting pupil information
Pupil data is essential for the schools’ operational use. Whilst the majority of pupil information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the data protection regulations, we will inform you, at the point of collection, whether you are required to provide certain pupil information to us or if you have a choice in this. Where we are processing personal data with your consent, you have the right to withdraw that consent. If you change your mind, or you are unhappy with our use of your personal data, please let us know by contacting the Business Manager of the school.
Storing pupil data
We hold the basic pupil record for 25 years from the pupil’s date of birth. Other data listed above will be held for varying amounts of time but no longer than the basic pupil record. For a breakdown of the individual categories, please ask to see a copy of the data retention schedule.
Who do we share pupil information with?
We routinely share pupil information with:
Within school we will use software to help us manage the different aspects of a pupil’s education. The companies that manage this software will have technical support staff that, on request, will be able to access this information. This is only done with the permission of school and all third party software providers have been checked for compliance with GDPR. In the course of our school improvement work we utilise the experience of other schools, external consultants and other educational professionals to support us; in certain circumstances this may involve sharing of pupil level data. Any individual or company external to the school with access to such information is subject to GDPR compliance checks and will only be granted access on satisfactory completion of these checks.
Why we share pupil information
We collect and use pupil information, for the following purposes:
We do not share information about our pupils with anyone without consent unless the law and our policies allow us to do so.
We share pupils’ data with the Department for Education (DfE) on a statutory basis. This data sharing underpins school funding and educational attainment policy and monitoring. We share data with the Local Authority where we have bought back service level agreements and the sharing of data is essential for the provision of that service. We will also share data, when requested, to assist in any legal investigations undertaken by the Local Authority.
We are required to share information about our pupils with the (DfE) under regulation 5 of The Education (Information About Individual Pupils) (England) Regulations 2013.
Data collection requirements
To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.
Department for Education
The Department for Education (DfE) collects personal data from educational settings and local authorities via various statutory data collections. We are required to share information about our pupils with the Department for Education (DfE) either directly or via our local authority for the purpose of those data collections, under regulation 5 of The Education (Information about Individual Pupils) (England) Regulations 2013.
To find out more about the pupil information we share with the department, for the purpose of data collections, go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.
All data is transferred securely and held by DfE under a combination of software and hardware controls, which meet the current government security policy framework.
For more information, please see ‘How Government uses your data’ section.
How Government uses your data
The department may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:
The Department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:
To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.
For more information about the department’s data sharing process, please visit:
For information about which organisations the department has provided pupil information, (and for which project), please visit the following website:
To contact the DfE: https://www.gov.uk/contact-dfe
Requesting access to your personal data
Under GDPR, you are entitled to access to information held about your child. You must make this request in writing, either to the main school address or electronically to firstname.lastname@example.org. We may need to ask for identification and proof that you are legally entitled to receive this information. On verification of your identity we will provide the information requested within one month.
You also have the right to:
•to ask us for access to information about you that we hold
•to have your personal data rectified, if it is inaccurate or incomplete
•to request the deletion or removal of personal data where there is no compelling reason for its continued processing
•to restrict our processing of your personal data (i.e. permitting its storage but no further processing)
•to object to direct marketing (including profiling) and processing for the purposes of scientific/historical research and statistics
•not to be subject to decisions based purely on automated processing where it produces a legal or similarly significant effect on you
If you have a concern or complaint about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner’s Office at https://ico.org.uk/concerns/
For further information on how to request access to personal information held centrally by DfE, please see the ‘How Government uses your data’ section of this notice.
We may need to update this privacy notice periodically so we recommend that you revisit this information from time to time. This version was last updated on 10th May 2019.
If you would like to discuss anything in this privacy notice, please contact the Business Manager for the school.