Privacy Notice – Parent/Carer
Author / Owner
Privacy Notice (How we use pupil information)
Under Data Protection law, individuals have a right to be informed about how the school uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ to individuals where we are processing their data.
This privacy notice explains how we collect, store and use personal data about pupils.
We, Winchelsea School, Guernsey Road, Poole, Dorset, BH12 4LL, are the ‘data controller’ for the purpose of data protection law.
The categories of pupil information that we collect, hold and share include:
- Personal information (such as name, unique pupil number and address)
- Contact information, contact preferences, date of birth, identification documents
- Characteristics (such as ethnicity, language, nationality, country of birth and free school meal eligibility)
- Special educational needs information (EHCP, IEP and PEP)
- Pupil and curricular records
- Assessment and attainment records
- Details of any medical conditions, including physical and mental health
- Medical and administration (such as doctors’ information, child health, dental health, allergies, medication and dietary requirements)
- attendance (such as sessions attended, number of absences, absence reasons and any previous schools attended)
- behavioural information (such as exclusions and any relevant alternative provision put in place)
- Safeguarding information
- Photographs, CCTV images
Why we collect and use this information
We use the pupil data:
- to support pupil learning
- to monitor and report on pupil progress
- to provide appropriate pastoral care
- to assess the quality of our services
- to keep children safe (food allergies, or emergency contact details)
- to meet the statutory duties placed upon us by the Department for Education (DfE)
- to comply with the law regarding data sharing
The lawful basis on which we use this information
We only collect and use pupil information when the law allows us to. Under the UK General Data Protection Regulation (GDPR) which came into effect on 1 January 2021, the legal basis / bases we rely on for processing personal information for general purposes are most commonly where:-
- We need to comply with a legal obligation
- We need to perform an official task in the public interest
Less commonly, we may also process pupils’ personal data in situations where:
- We have obtained consent to use it in a certain way
- We need to protect the individual’s vital interest (or someone else’s interests)
Where we have obtained consent to use pupils’ personal data, this consent can be withdrawn at any time.
Collecting pupil information
Pupil data is essential for the school’s operational use. Whilst the majority of pupil information you provide to us is mandatory, some of it requested on a voluntary basis. In order to comply with the data protection legislation, we will inform you at the point of collection, whether you are required to provide certain pupil information to us or if you have a choice in this and we will tell you what you need to do if you do not want to share this information with us.
Our most common means of collecting pupil data is via registration forms or secure file transfer from the previous school.
Storing pupil data
We keep personal information about pupils while they are attending our school. We may also keep it beyond their attendance at our school if this is necessary in order to comply with our legal obligations. The Information and Records Management Society’s toolkit for schools sets out how long we keep information about pupils.
Who we share pupil information with
We routinely share pupil information with:
- Schools that pupils attend after leaving us
- our Local Authority (LA)*
- the DfE
- Youth Support Services (pupils aged 13 plus)
- Pupil’s family and representatives
- Educators and examining bodies
- Our regulator – OFSTED
- Health authorities
- Health and social welfare organisations
- Professional advisors and consultants
*for the purposes of this document, the term Local Authority will be considered to cover not only, Bournemouth, Christchurch and Poole Council but also any Local Authority on whose behalf a pupil attends Winchelsea School.
Why we share pupil information
We do not share information about our pupils with anyone without consent unless the law and our policies allow us to do so.
We share pupils’ data with the DfE on a statutory basis. This data sharing underpins school funding and educational attainment policy and monitoring.
We are required to share information about our pupils with our LA and the DfE under section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013.
Youth Support Services
Pupils aged 13 plus
Once our pupils reach the age of 13, we also pass pupil information (on a secure basis) to our LA and / or provider of youth support services as they have responsibilities in relation to the education or training of 13-19 year olds under section 507B of the Education Act 1996.
This enables them to provide services as follows:
- youth support services
- careers advisers
A parent or guardian can request that only their child’s name, address and date of birth is passed to their local authority or provider of youth support services by informing us. This right is transferred to the child / pupil once he/she reaches the age 16.
Pupils aged 16 plus
We will also share certain information (on a secure basis) about pupils aged 16 plus with our local authority and / or provider of youth support services as they have responsibilities in relation to the education or training of 13-19 year olds under section 507B of the Education Act 1996.
This enables them to provide services as follows:
- post-16 education and training providers
- youth support services
- careers advisers
For more information about services for young people, please visit our LA website: https://www.bcpcouncil.gov.uk/News/News-Features/COVID-19/Help-advice-and-support/Families-and-Young-People.aspx
Department for Education
The DfE collects personal data from educational settings and local authorities via various statutory data collections. We are required to share information about our pupils with the Department for Education (DfE) either directly or via our LA for the purpose of those data collections, under Section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013.
All data is transferred securely and held by DfE under a combination of software and hardware controls, which meet the current Government security policy framework.
For more information, please see ‘How Government uses your data’ section.
We may be required to share information about our pupils with the LA to ensure that they can conduct their statutory duties under the Schools Admission Code, including conducting Fair Access Panels.
Requesting access to your personal data
Under data protection legislation, parents and pupils have the right to request access to information about them that we hold. To make a request for your personal information, or be given access to your child’s educational record, contact Mr S Coates, Data Protection Officer: email@example.com
You also have the right to:
- object to processing of personal data that is likely to cause, or is causing, damage or distress
- prevent processing for the purpose of direct marketing
- object to decisions being taken by automated means
- in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
- a right to seek redress, either through the Information Commissioner’s Office (ICO) or the courts and claim compensation for damages caused by a breach of the Data Protection regulations.
If you have a concern about the way we are collecting or using your personal data or wish to withdraw your consent, we ask that you raise your concern with us in the first instance. Alternatively, you can contact the ICO at https://ico.org.uk/concerns/
If you would like to discuss anything in this privacy notice, please contact:
Mr S Coates, Data Protection Officer – firstname.lastname@example.org
We may need to update this privacy notice periodically as legislation is amended so we recommend that you revisit this information from time to time. This notice will be reviewed as a minimum on a triennial basis. This version was last updated on 1 March 2021.
How Government uses your data
The pupil data that we lawfully share with the DfE through data collections:
- underpins school funding, which is calculated based upon the numbers of children and their characteristics in each school.
- informs ‘short term’ education policy monitoring and school accountability and intervention (for example, school GCSE
- results or Pupil Progress measures).
- supports ‘longer term’ research and monitoring of educational policy (for example how certain subject choices go on to affect education or earnings beyond school)
Data collection requirements
To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go to https://www.gov.uk/education/data-collection-and-censuses-for-schools
The National Pupil Database (NPD)
The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.
We are required by law, to provide information about our pupils to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013.
To find out more about the NPD, go to:
The department may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:
- conducting research or analysis
- producing statistics
- providing information, advice or guidance
The Department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data.
Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:
- who is requesting the data
- the purpose for which it is required
- the level and sensitivity of data requested: and
- the arrangements in place to store and handle the data
To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.
For more information about the department’s data sharing process, please visit:
Organisations fighting or identifying crime may use their legal powers to contact DfE to request access to individual level information relevant to detecting that crime. Whilst numbers fluctuate slightly over time, DfE typically supplies data on around 600 pupils per year to the Home Office and roughly 1 per year to the Police.
For information about which organisations the Department has provided pupil information, (and for which project) or to access a monthly breakdown of data share volumes with Home Office and the Police please visit the following website: https://www.gov.uk/government/publications/dfe-external-data-shares
How to find out what personal information DfE hold about you
Under the terms of the Data Protection Act 2018, you are entitled to ask the Department:
- if they are processing your personal data
- for a description of the data they hold about you
- the reasons they’re holding it and any recipient it may be disclosed to
- for a copy of your personal data and any details of its source
If you want to see the personal data held about you by the Department, you should make a ‘subject access request’. Further information on how to do this can be found within the Department’s personal information charter that is published at the address below:
To contact DfE: https://www.gov.uk/contact-dfe