You must have policies and procedures in place
It's a legal requirement that your school has data protection policies and procedures in place. These should be regularly reviewed and updated.
You should also review your other statutory policies and documents with data protection in mind.
This is explained in the DfE's guidance on data protection.
You must also have privacy notices. If you collect biometric information from your pupils, your privacy notices should include information about how this data is processed and stored, including the rights of individuals relating to the processing.
See page 11 of the DfE's guidance on protection of biometric information of children in schools.
From 19 June 2026, you must also have a process for handling data protection complaints to your school or trust. These are new requirements introduced by the Data (Use and Access) Act 2025.