GDPR & Privacy Notices
At Saughall All Saints C of E Primary School, we are committed to protecting the personal information of our pupils, parents and carers, staff, governors, volunteers and other members of our school community. We recognise that personal information must be handled lawfully, fairly, securely and transparently, and that everyone has the right to understand how their information is collected, used, stored and shared.
Our approach to data protection is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, together with other relevant legislation and guidance, including the Data (Use and Access) Act 2025 where applicable.
What does data protection mean for schools?
Schools collect and use personal information every day to provide education, support pupils’ learning and development, meet statutory responsibilities, safeguard children and manage the school effectively.
Personal information may include names, addresses, contact details, attendance records, assessment results, educational records, photographs, safeguarding information, medical details, special educational needs information and information about family circumstances.
Some information, such as health records, special educational needs information and certain safeguarding records, is classed as special category data or is otherwise subject to additional legal protections. This information requires appropriate safeguards and must only be accessed or shared when there is a lawful and justified reason to do so.
The UK GDPR and Data Protection Act 2018 require schools to protect personal information and demonstrate that they comply with their legal responsibilities. The Department for Education's guidance confirms that schools must maintain appropriate data protection policies, procedures and privacy notices. Department for Education guidance.
Why do we collect and use personal information?
Saughall All Saints C of E Primary School processes personal information for purposes including:
Education and learning: planning teaching, assessing progress, recording attainment and providing appropriate educational support.
Pupil welfare and safeguarding: protecting children from harm, promoting their welfare and working with relevant services when necessary.
Special educational needs and inclusion: identifying and meeting additional needs, implementing support plans and working with families and professionals.
Attendance and behaviour: monitoring attendance, managing absence, supporting positive behaviour and fulfilling statutory reporting requirements.
Health, safety and medical needs: managing medical conditions, allergies, medication, accidents, emergencies and individual healthcare arrangements.
Communication with families: sharing information about learning, attendance, school events, trips, activities and important school arrangements.
School administration: managing admissions, transfers, staffing, finance, governance, complaints and the day-to-day operation of the school.
Legal and statutory duties: meeting requirements relating to education, safeguarding, equality, health and safety, employment and the provision of statutory information.
School improvement and accountability: evaluating educational provision, monitoring outcomes and providing information required by the Department for Education, the local authority and other authorised bodies.
We only collect and use information that is necessary for an identified and lawful purpose. We aim to keep records accurate, relevant and up to date and to retain them only for as long as required.
Our lawful basis for processing information
The school must identify an appropriate lawful basis under Article 6 of the UK GDPR for each purpose for which it processes personal information. Depending on the circumstances, these may include:
Public task: processing necessary for the school to carry out its functions in the public interest or exercise its official authority.
Legal obligation: processing necessary to meet a legal duty.
Consent: processing based on a freely given, specific, informed and unambiguous agreement where consent is an appropriate basis.
Vital interests: processing necessary to protect someone's life.
Contract: processing necessary to fulfil a contract or take steps requested before entering into a contract, where applicable.
Legitimate interests: processing necessary for legitimate interests, where this basis is available and the individual's rights and freedoms do not override those interests.
For special category data, the school must also identify an applicable additional condition under Article 9 of the UK GDPR and, where required, meet the relevant requirements of the Data Protection Act 2018.
The appropriate lawful basis depends on the particular activity. The school does not automatically rely on one basis for every use of information.
Consent is not required for every use of personal data. For example, the school will normally rely on its public task or legal obligations for routine educational, attendance and safeguarding activities. Where consent is the appropriate basis, it must be genuinely voluntary and individuals must be able to withdraw it. Refusing consent must not be used to disadvantage a family where the processing is not dependent on consent.
Read the Department for Education guidance on lawful processing.
Privacy notices: how we keep families informed
A privacy notice explains how the school collects, uses, stores and shares personal information. It helps pupils, parents, carers and staff understand what happens to their information and what rights they have.
Saughall All Saints C of E Primary School makes its relevant privacy notices freely available. These notices are reviewed at least annually and whenever significant changes occur to the school's data processing arrangements.
Our privacy information will explain, as appropriate:
Who is responsible for the information and how to contact the school.
The categories of personal information collected and the purposes for which it is used.
The lawful basis for processing and any additional conditions required for sensitive information.
The organisations or individuals with whom information may be shared and why.
How information is stored, protected and retained.
Whether information is transferred outside the UK and what safeguards apply, where relevant.
The rights individuals have over their information and how they can exercise them.
How to raise a concern with the school or complain to the Information Commissioner's Office (ICO).
Separate or additional privacy notices may apply to pupils and their parents or carers, school workforce members, governors, volunteers, visitors and other groups whose information the school processes.
Privacy notices should be read alongside the school's relevant policies and procedures. The school will inform affected individuals when significant changes are made to the information provided or to the way their personal data is used.
Sharing personal information
The school may share personal information with other organisations where there is a lawful basis and a clear, justified purpose. This may include:
Cheshire West and Chester Council and other relevant local authority services.
The Department for Education and other statutory education bodies.
Schools and educational settings when a pupil transfers.
Health professionals, social care services and safeguarding agencies.
The police and other relevant authorities when required or permitted by law.
Examination, assessment and educational service providers.
Approved software providers and other organisations delivering services on behalf of the school.
Information will only be shared where it is necessary, proportionate and lawful. The school will consider confidentiality, the best interests and safety of children, and the rights of the individuals concerned.
Safeguarding information may need to be shared without consent where there is a lawful justification, including where sharing is necessary to protect a child from harm. Consent is not a prerequisite for appropriate safeguarding information sharing.
Where an external organisation processes personal data on the school's behalf, appropriate contractual arrangements and security safeguards must be in place. The school will establish the responsibilities of each organisation and ensure that access to personal information is appropriately controlled.
Keeping personal information secure
We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, alteration, disclosure or destruction.
These measures include, as appropriate:
Restricting access to personal information to authorised staff who need it for their role.
Using passwords, access controls and secure systems.
Providing staff with data protection, confidentiality and information security guidance.
Storing paper records securely and disposing of confidential documents appropriately.
Using approved systems for communicating and sharing information.
Following procedures for managing safeguarding records and other sensitive information.
Reviewing the security arrangements of third-party providers.
Maintaining procedures for responding to suspected data breaches.
All staff and other authorised individuals who handle personal information are responsible for protecting it and must follow the school's data protection and information security procedures.
Data breaches and reporting concerns
A personal data breach occurs when personal information is lost, destroyed, altered, disclosed or accessed without authorisation, whether accidentally or deliberately.
Anyone working for or representing the school must report a suspected data breach or information security incident promptly through the school's established reporting arrangements. Incidents must be assessed, investigated and recorded, including where a breach is not ultimately reportable to the ICO.
Where a breach is likely to result in a risk to individuals' rights and freedoms, the school must notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to individuals, the school must also inform affected individuals without undue delay, unless a legal exception applies.
The 72-hour deadline does not mean that every incident must be reported to the ICO. The reporting requirement depends on the assessed risk. All incidents should be handled in accordance with the school's data breach procedure.
Your data protection rights
Under data protection legislation, individuals have rights in relation to their personal information. Depending on the circumstances, these include the right to:
Be informed about how their information is used.
Access their personal information by making a subject access request.
Rectify inaccurate or incomplete information.
Request erasure of personal information where the legal conditions are met.
Restrict processing in certain circumstances.
Data portability where the relevant legal conditions apply.
Object to certain types of processing.
Safeguards concerning automated decision-making, where applicable.
These rights are not absolute and may be subject to exemptions or restrictions under data protection legislation. For example, information cannot always be deleted where the school has a legal obligation to retain it, and safeguarding or third-party confidentiality considerations may affect disclosure.
Requests to exercise these rights should be directed to the school. We will respond in accordance with the applicable legal requirements and timescales.
Children have their own data protection rights. We will provide information in an accessible, age-appropriate way so that pupils can develop an understanding of privacy, confidentiality and how their personal information is used.
Photographs, videos and publication of information
Photographs, videos and other recordings that identify pupils may constitute personal data. The school will handle these in accordance with its privacy information, safeguarding arrangements and applicable data protection requirements.
Consent may be appropriate for particular uses, such as some forms of publicity or publication, depending on the circumstances. The school will distinguish between activities supported by consent and processing carried out under another lawful basis.
The school will consider the purpose, audience and risks before publishing identifiable information, particularly on websites, social media or other publicly accessible platforms. We will respect applicable restrictions and any relevant safeguarding concerns.
How long do we keep personal information?
The school retains personal information in accordance with applicable legal requirements, statutory guidance and its records management and retention arrangements.
Retention periods vary according to the type of record and its purpose. Information will not be kept indefinitely without a lawful reason. When records are no longer required, they will be securely destroyed or otherwise disposed of in accordance with the school's procedures.
Who is responsible for data protection?
Saughall All Saints C of E Primary School is responsible for ensuring that personal information is handled lawfully and securely. The school must maintain appropriate records, policies and procedures to demonstrate compliance.
The school has access to a Data Protection Officer (DPO), whose details are provided in the school's privacy notices and data protection information. The DPO advises on compliance, monitors data protection arrangements and acts as a point of contact for individuals and the ICO, as appropriate.
All staff, governors, volunteers and other authorised individuals must follow the school's data protection procedures. The school will review its arrangements regularly and provide appropriate training and guidance.
Raising a concern or making a complaint
If you have a question or concern about how your personal information is being handled, please contact the school in the first instance using the contact details published on the school website.
You also have the right to raise a concern with the Information Commissioner's Office:
Information Commissioner's Office (ICO)
Website: https://ico.org.uk/
Telephone: 0303 123 1113
The ICO provides independent information and guidance about data protection rights and responsibilities.
Further information
The school's privacy notices, data protection policies and related information are available through the school office or the school website.
We are committed to maintaining the trust of our school community by handling personal information responsibly, protecting confidentiality and being transparent about how information is used.