Data protection policy
The data protection policy, published with the date it was last reviewed. Schools and academy trusts must have data protection policies and procedures in place and publish the policy with a review date.
Check this on my websiteWho it applies to
- Published on
- School and trust websites
- School type
- Academies and maintained schools
- School stage
- All stages, from early years to sixth form
- Does not apply to
- No school types are excluded
When is it due?
- Renewal
- No fixed date
The official sources set no renewal date. Keep it accurate whenever it changes.
What's needed
Publish the data protection policy with its review date on the data protection or policies page (guidance says schools should).
What it must contain
1 part- Dates when the data protection policy was last reviewedMust
What the official sources say
Set out in 1 official source:
Data protection in schools: data protection policies and procedures
It’s a legal requirement that your school has data protection policies and procedures in place and that you regularly review and update these, along with the associated documentation.
Must§ Statutory policies
Questions schools ask
Does every school have to publish the data protection policy?
The official sources we check set no requirement for academies. The official sources we check set no requirement for maintained schools.
When does the data protection policy need to be published?
Renewal: No fixed date. The official sources set no renewal date. Keep it accurate whenever it changes.
What must the data protection policy include?
Dates when the data protection policy was last reviewed.
Where does the requirement for the data protection policy come from?
It is set out in Data protection in schools: data protection policies and procedures.
Changes to the official sources
Dated change notes published by the Department for Education on the sources above.
17 June 2026 · Data protection in schools: data protection policies and procedures
Added a 'Filtering and monitoring' section to 'Cyber security and safeguarding'.
28 August 2024 · Data protection in schools: data protection policies and procedures
Guidance has been updated on privacy notices.
12 September 2023 · Data protection in schools: data protection policies and procedures
Added links to the Information Commissioner's Office's data controller's checklist, guidance on how to document processing activities and guidance for organisations using CCTV.
3 February 2023 · Data protection in schools: data protection policies and procedures
New section added.
We last checked these sources on 21 September 2026.
Is this on your school's website?
We check your site the way an inspector or a parent would find it: page by page, against the official wording of each requirement. If it's there, you get the page and the words we found. If it isn't, you get every place we looked.
Check this one requirement free, or scan your whole site against every requirement.
Official sources last checked 21 September 2026 · register version 1.0.4