What all Independent Schools Need to Know About Data Protection

Robert Wassall, Head of Legal Services at NormCyber share his experiences ahead of the Independent Schools conference

Are independent schools subject to any specific data protection or privacy obligations?

All organisations operating within the UK, including independent schools, must be compliant with the GDPR. While there are no specific data protection rules that apply to independent schools in particular, there are some areas that the ICO has issued specific guidance to schools about, including exam results and taking photos of pupils/students..

In your experience, are most independent schools aware of their data protection responsibilities?

I’d be very surprised if there were many schools that weren’t aware that they have data protection responsibilities. That said, many do not seem to be fully aware of what their specific responsibilities are, how best to comply with them and how to use best practice data protection as a way of elevating what their school has to offer students and parents.

Do all independent schools need a Data Protection Officer, and what should they consider when appointing one?

Although there is no legal obligation for independent schools to have a Data Protection Officer, in my opinion most need one. All schools need to have someone who is responsible for ensuring their school fully understands its data protection responsibilities to comply with its privacy obligations, as well as having sufficient time and resources to do so.

When appointing a DPO, the key considerations are whether that person has sufficient and up-to-date knowledge of data protection law and practice, and can perform the role without any conflict of interests in an independent manner – something which it is virtually impossible to do if the ‘DPO’ holds another senior or influential position in the school.

What are the most important things independent schools need to do in order to foster a culture of best practice data protection?

There is no doubt that an essential element of effective data protection at any school is to have in place an appropriate culture – one that rejects seeing data protection as a bureaucratic exercise and recognises the benefit of meaningful safeguards for the individuals whose personal data is being collected and used. Such a culture can only be achieved if those responsible for governance embrace and appoint someone suitable to champion it, so that data protection becomes fully embedded in the ethos of the school.

How does best practice data protection help independent schools to attract and retain students?

All successful relationships are based on trust and, as the ICO says, “data protection is about ensuring people can trust you to use their data fairly and responsibly”.

When parents send their children to school, they trust that the school will look after their children – in a wide variety of ways. One of those ways is to ensure that their children’s personal information will be used responsibly, as well as of course being protected from abuse and misuse.

No doubt schools know this, but not many seem to make much of an effort to tell parents what they do about it and very few ‘boast’ about it. The reality is that these days most parents are concerned to some degree about privacy (effectively, another name for data protection). Schools should therefore be giving assurance to parents that they take data protection very seriously - e.g. by mentioning this in prospectuses and making a point of bringing the school’s privacy policy to the attention of parents.

----------------------------

To learn more and ask questions about how your school could benefit from demonstrating its commitment to protecting privacy and fostering increased levels of trust, join Robert and the NormCyber team at the Independent Schools conference, where he'll be hosting a roundtable discussion: “How best practice data protection can boost student intake and retention” at 11.55am on 25th November. Sign-up here.