Data protection means safeguarding important information from corruption, compromise or loss. As the amount of data we create and store continues to grow, it’s becoming more important to have the right systems and processes in place.
Data protection in schools, academies, and other educational institutions

You will hold many types of personal information about your staff, pupils, alumni and third parties with whom you engage. Ensuring that you and your staff understand your duties and obligations as guardians of this data is an essential part of any successful education setting. 

The Data Protection Act 1998 has been superseded by the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, which took effect in May 2018. This new regime has revolutionised data protection law and information rights, acting as a catalyst for a new culture of privacy that you must embed within your school, academy, or organisation through effective policies and procedures. 

“The use of data across our sector and beyond has developed significantly in recent years. And so it is right that the law, processes and skill sets associated with being effective guardians of children’s data are brought up to date and fit for the modern era….If our sector is to be entrusted to hold sensitive data about children across the country and exploit the benefits modern data technologies enable us, then they are both to be welcomed.

Neil McIvor, Chief Data Officer, Department for Education

Data protection and information sharing in education

Our team’s understanding of how the new regime impacts the education sector allows us to work closely with schools, academies, and other education providers to help them manage their data protection compliance programmes. We can guide you on data protection and how to handle and share information to ensure compliance with the new regime.

The GDPR states that you must make sure the information you hold is:

  • used fairly, lawfully and transparently
  • used for specified, explicit purposes
  • used in a way that is adequate, relevant and limited to only what is necessary
  • accurate and, where necessary, kept up to date
  • kept for no longer than is necessary
  • handled in a way that ensures appropriate security, including protection against unlawful or unauthorised processing, access, loss, destruction or damage.

There is stronger legal protection for more sensitive information, such as:

  • race
  • ethnicity
  • political opinions
  • religious beliefs
  • trade union membership
  • genetics
  • biometrics (where used for identification)
  • health
  • sex life or orientation

There are additional safeguards for personal data relating to criminal convictions and offences.

Under the new regime, everyone has the right to find out what information you hold about them. These include the right to:

  • know how you use their data
  • access personal data
  • have incorrect data updated
  • have data erased
  • stop or restrict the processing of their data
  • data portability
  • object to how their data is processed in certain circumstances
Data protection advice for schools, academies, and other educational institutions

Our team of experts can help to guide you through this regulatory maze, advising you on the best approach for capturing, handling and sharing information within your organisation so that you don’t fall short of your obligations. We can help you identify risks that could result in data breaches, penalties and reputational damage, and put plans in place to mitigate and manage them if they happen.

We advise schools, academies, and education providers on all areas of data protection and information law compliance, as well as providing guidance on freedom of expression, privacy, reputation and information rights generally. We can help you with the following:

  • Drafting and reviewing data protection compliance documentation - including the data protection policy for schools, academy, or organisationWe support our education clients in drafting and reviewing contracts, data sharing agreements and compliance documents, such as data protection and retention policies, privacy notices and impact assessments.
  • Data breach management - We can provide training, advice and guidance to those who deal with data within their role, to prevent personal data breaches. However, in the event of a breach, our lawyers can assist with and advise on the appropriate course of action to ensure that you not only comply with data protection legislation, but you limit any reputational damage and any punitive action from the Information Commissioner’s Office.
  • Responding to data subject access requests - We can advise on managing subject access requests and how to respond to them.
  • Training and updatesWe offer data protection training to staff (either at your location or our offices), tailored to the needs of your school, academy, college or university, on data protection, privacy, reputation and information rights issues and developments. To receive invitations to our events, as well as information and articles on legal issues and sector developments that are of interest to you, sign up to Newsroom.

For more information about data protection for schools, academies, colleges and universities, please contact Peter Coe.

Anthony Collins Solicitors has supported us through the thorny area of data protection and subject access requests. They've provided excellent support and guidance, reassuring staff and helping us to meet our legal obligations with confidence.
Jo Baker, Head of Operations, Diocese of Coventry Multi Academy Trust.
I've had my eyes opened to a range of data protection situations where I needed to tighten up my procedures. Thank you, it was very helpful.
Training course attendee.
Helping teachers as people

call the service specialist on 0121 212 7450

As a teacher, or a professional working in the education sector, there are multiple issues that you may face. Whilst we do offer advice about educating children from a variety of backgrounds in a safe and caring environment, we also offer advice to you as an individual. We understand that the pressures and numerous challenges facing those in charge are not always classroom based.

Education is one of our core sectors. This allows us to combine our specialist subject knowledge and experiences with our personal approach to individual cases. Our clients tell us that the service they receive from us is unique, and we believe this comes directly from our commitment to the purpose of our firm: 'to improve lives, communities and society’.

To understand more about how we can help you as an individual click here.

Data Protection and Information Team

Clare Paterson Data Protection Consultant

Data protection consultant in the Data Protection & Information Law team.

View Profile
Eeshma Qazi Solicitor

Data protection solicitor who is passionate about helping clients navigate the increasingly complex and ever-evolving data protection landscape.

View Profile
Peter Coe Associate

Associate specialising in privacy, data protection, defamation, free speech and media law.

View Profile
The Data Protection Act 2018, the what and the why
The Data Protection Act 2018, the what and the why

In what has been a veritable deluge of data protection-related developments, we now have in our midst, a brand-new, homegrown iteration of data protection legislation; the Data Protection Act 2018.

Sign up to Newsroom

To receive invitations to our events, as well as information and articles on legal issues and sector developments that are of interest to you, please sign up to Newsroom.