Data protection

This section looks at the data-protection issues that schools need to be aware of when collecting and processing personal data about learners and other individuals.

For information on sharing data with other bodies, see the section on Privacy Notices (formerly Fair Processing Notice FPN).

Under the Data Protection Act 1998 all schools processing personal data must comply with the eight enforceable principles of good practice. Data must be:

fairly and lawfully processed
processed for limited purposes
adequate, relevant and not excessive
accurate
not kept longer than necessary
processed in accordance with the data subject's rights
secure
not transferred to other countries without adequate protection.

To comply with these principles every school processing personal data must notify under the Act. Failure to notify is a criminal offence. You can find out more about your school's need to notify from the Information Commissioner's website.

The Data Protection Act 1998 has replaced the 1984 Act. If your governing body and headteacher have each registered under the 1984 Act, the two register entries will probably expire at different times. You are required to notify at the time the first of these register entries expires. The second register entry will need to be removed at the same time. You will be sent the appropriate forms by the Information Commissioner before the first of the register entries expires.

An application for notification can be made either via the Information Commisioner's website, or by telephoning the Notification Department on 08456 30 60 60 or on 01625 54 57 40.

Either method will enable you to ask for a standard notification template, which has been designed to cover your specific activities. If you choose to use one of the available notification templates, the details provided should still be checked, and any amendments made as necessary. Your LA may be able to assist with this.

The following headings in the forms need particular care:

data controller's name — provide the name of the school not the name of the headteacher
security statement — most schools should answer no regarding the use of BS7799
exempt processing — ensure the template describes all of your processing of personal data. Your LA may be able to help you with this.

Further guidance on all these issues is available from the Information Commissioner's website.

_{______________________________}
^{Page created 15 October 2009}