Data protection and privacy: what schools must publish
How you tell families about their data: privacy notices, cookies, CCTV and biometrics.
6 requirements
- Biometric information noticeMust: Required by law, statutory guidance or the academy's funding agreement.If your school uses fingerprint or face recognition, for example for lunch payments, your website needs a notice telling parents about their right to object and the alternative on offer.Keep it up to date
- CCTV policyMust: Required by law, statutory guidance or the academy's funding agreement.If your school uses CCTV, your CCTV policy says who is responsible for it and who can view or share the footage.Keep it up to date
- Cookie consentMust: Required by law, statutory guidance or the academy's funding agreement.If your website sets non-essential cookies, such as analytics or embedded videos, it needs to ask visitors first, with rejecting as easy as accepting.Keep it up to date
- Cookie policyMust: Required by law, statutory guidance or the academy's funding agreement.Your cookie policy explains each cookie your website sets, what it does and which ones need consent.Keep it up to date
- Data protection policyMust: Required by law, statutory guidance or the academy's funding agreement.Your data protection policy, with the date it was last reviewed.Keep it up to date
- Privacy noticeMust: Required by law, statutory guidance or the academy's funding agreement.Your website needs a privacy notice saying what personal data you hold about pupils, parents and staff, why, who you share it with and their rights.Keep it up to date
Want to know which of these your school's website has? We check every one, with the page and the words we found.
Request a free audit