General Data Protection Regulation (GDPR)

General Data Protection Regulation (GDPR)

The General Data Protection Regulation 2016 (GDPR) became enforceable on 25 May 2018. The Data Protection Act 2018 (DPA) was revised in the same year and updated data protection laws for the digital age. This new legislation brought new accountabilities for all schools.  The ultimate responsibility and accountability for data protection compliance sits with governors and trustees. This new and revised legislation moves schools from having to show that they ‘comply’ to having to show that they are actively demonstrating and evidencing they are in compliance.


ICO Enforcement Watch

Part of the ICO's role is to take action to ensure organisations meet their information rights obligations.  Details of the most recent enforcement action they've taken is shown below:

13 June 2019:

The Information Commissioner’s Office (ICO) has fined Smart Home Protection Ltd £90,000 for making nuisance calls to people registered with the Telephone Preference Service (TPS).

The Staffordshire company was behind 118,000 unlawful marketing calls made between January 2017 and September 2018 to people registered with the TPS.


KS2 Assessment and Reporting Arrangements (ARA) - Keeping and maintaining records

14 Keeping and maintaining records Page 53

14.1 Pupils’ educational records

Maintained schools and non-maintained special schools must ensure that educational records are maintained and disclosed to parents on request, as prescribed in the Education (Pupil Information) (England) Regulations 2005.

14.2 Disclosure of educational records

There are several pieces of legislation under which information may be accessed from public organisations, including schools. These include the GDPR, the DPA and the Freedom of Information Act 200069. Access to a pupil’s educational record held by a maintained school or non-maintained special school is covered by a parent’s right of access under the Education (Pupil Information) (England) Regulations 2005.

14.3 Transferring records to a pupil’s new school

Headteachers at maintained schools, including maintained special schools, must ensure the statutory requirements for the transfer of records between schools are fulfilled, including the completion of the CTF. This requirement is set out in the Education (Pupil Information) (England) Regulations 200572, as amended.

If a pupil moves to another school in England, Wales, Scotland or Northern Ireland, the pupil’s CTF and educational records must be passed to the new school. Academies are not subject to this requirement but are expected to adhere to the following protocols as a matter of good practice.


For full details read section 14 of 2020 KS2 Assessments and Reporting Arrangements (ARA)

Find out more about GDPR and the support on offer

Find out more
Scroll to top