'Cheat sheet' for data protection officersThere's lots of new information to absorb now that you've taken on the role of data protection officer (DPO). Print our 'cheat sheet' to help you remember the key UK GDPR principles, deadlines and definitions.
Data protection impact assessmentsFind out what data protection impact assessments (DPIAs) are, when they must be done, and who should be involved. Download and adapt our DPIA template to save you time.
DPO's report to governors: templateUse our template to make sure you're giving your governors all the information they need to know about data protection and your school's compliance with the GDPR.
Email security: sending personal dataAny personal data you send by email must be kept secure. Use our tips to help you keep personal data safe in emails to ensure you’re doing everything you can in line with the UK GDPR to avoid a data breach.
Freedom of information: responding to requestsKnow what to do if you receive a request for information under the Freedom of Information Act, including when you can charge for a response or refuse the request. Use our template letters to help you respond to requests.
GDPR mythbusterAvoid the scaremongering around the GDPR and use our mythbuster to separate the fact from the fiction when it comes to visitor books, photo archives, fines, consent and more.
GDPR: seeking consent for processing personal dataUse our process to help you work out whether you need to seek consent for processing personal data under the GDPR. If you do, download our template consent forms, or use our checklist to make sure your own forms meet the requirements.
GDPR: using technology to deliver remote learningUnderstand how to stay GDPR-compliant if you're using a digital education platform, recording live lessons or accessing YouTube. Get information on seeking consent and storing records, and use our template letter to help you notify parents about the data you're processing.
How to respond to subject access requests in the summer holidaysSchools must respond to SARs within 1 month, which could be more difficult over the summer. 42% of the DPOs we polled don't know how they'll manage this yet, so we've got you covered with practical solutions and a template letter to extend the deadline for 'complex' requests.
International data transfers under the UK GDPRUse this step-by-step guide to determine whether your school can lawfully share personal data with countries outside the UK. This includes sending it directly to an international organisation or to be kept on a server abroad.
Role of the data protection officer (DPO)Understand the DPO's responsibilities, what experience they should have and training they may need. Plus, find out what to consider when determining how much time your DPO needs for their role.
'Special category' data under the UK GDPRThe UK GDPR classifies some data as 'special category', meaning it's sensitive and needs more protection. Read on to find out what kind of data is defined this way in schools, and the conditions you can use to justify processing it.
Subject access requests: guidance and template formsIndividuals have the right to request access to the information your school holds about them, under the UK GDPR. Use this guidance and our template forms to help you comply with subject access requests and know when you can refuse them.
Taking and displaying pupil photos and informationThere are no hard and fast rules under the GDPR specifically on displaying pupil photos or other information, but you must have a 'lawful basis' for using personal data, and seek consent where necessary. Use our practical examples to help you work out how to stay compliant in your specific circumstances.
Taking documents home: securing personal dataPersonal data accessed by staff at home must be kept secure. With more staff than ever working remotely, take these steps to keep documents containing personal data safe, avoid a data breach and stay compliant with the UK GDPR.
The UK GDPRRead our one-page summary of the UK General Data Protection Regulation (UK GDPR) and download a copy to share with your colleagues.
The UK GDPR: summaryThe UK General Data Protection Regulation (UK GDPR) determines how you must process and store personal data - understand what you have to do and how the data laws have changed since Brexit.
UK GDPR: at what age can pupils give consent?There's no statutory age at which pupils can give consent for data processing under the UK GDPR. Learn what age is usually appropriate, and how to manage issues around seeking pupils' consent.
UK GDPR auditCarry out a data protection audit to make sure your processes comply with the UK GDPR and meet best practice. Check your records management practices and find out if you’re storing physical and electronic copies of personal data securely.
UK GDPR: ensuring your suppliers are compliantYou must make sure that any third parties that process personal data on your behalf will do so in line with the UK GDPR’s requirements. See the steps you'll need to take, and download our checklist to make sure you include the right details in your provider contracts.
UK GDPR: personal data breach procedureUpdatedDownload our model procedure and use it in the event of a data breach at your school. If you have any data breaches, use our template to record the details.
UK GDPR: sharing safeguarding informationBe confident in how you share safeguarding information under the UK GDPR. Know the principles to follow, your legal basis for sharing data and your responsibilities for information sharing.
UK GDPR: staff briefingGive staff a 10-minute overview of the key principles and requirements of the UK GDPR with our adaptable presentation and facilitator notes.
UK GDPR: staff posters and handoutDownload our data protection cheat sheet for staff, and display these posters around your school to help everyone remember how to keep personal data safe day-to-day.
UK GDPR: using apps and online services with pupilsIf you're using educational apps or other online services with pupils, such as assessment platforms or homework portals, make sure you stay compliant with data protection law. Work through these questions before setting up a new app or service to figure out your responsibilities, then check your next steps.