Privacy notice: what to publish on your school website

the identity and the contact details of the controller and, where applicable, of the controller's representative;

Must: Required by law, statutory guidance or the academy's funding agreement.§ Article 13(1)(a)

the contact details of the data protection officer, where applicable;

Must: Required by law, statutory guidance or the academy's funding agreement.§ Article 13(1)(b)

the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;

Must: Required by law, statutory guidance or the academy's funding agreement.§ Article 13(1)(c)

where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;

Must: Required by law, statutory guidance or the academy's funding agreement.§ Article 13(1)(d)

the recipients or categories of recipients of the personal data, if any;

Must: Required by law, statutory guidance or the academy's funding agreement.§ Article 13(1)(e)

where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of relevant regulations under Article 45A, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), the safeguards relied on and the means by which to obtain a copy of them or where they have been made available.

Must: Required by law, statutory guidance or the academy's funding agreement.§ Article 13(1)(f)

the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;

Must: Required by law, statutory guidance or the academy's funding agreement.§ Article 13(2)(a)

the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;

Must: Required by law, statutory guidance or the academy's funding agreement.§ Article 13(2)(b)

where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

Must: Required by law, statutory guidance or the academy's funding agreement.§ Article 13(2)(c)

the right to make a complaint to the Commissioner under section 165 of the 2018 Act;

Must: Required by law, statutory guidance or the academy's funding agreement.§ Article 13(2)(d)

the right to make a complaint to the controller under section 164A of the 2018 Act;

Must: Required by law, statutory guidance or the academy's funding agreement.§ Article 13(2)(ca)

The arrangement referred to in paragraph 1 shall duly reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects. The essence of the arrangement shall be made available to the data subject.

Must: Required by law, statutory guidance or the academy's funding agreement.§ Article 26(2)

This means: – placing signs where CCTV is in use – updating your privacy notices

Must: Required by law, statutory guidance or the academy's funding agreement.§ Being transparent (CCTV)

Any guidance you create must be regularly reviewed to ensure it reflects the changes to the use of CCTV , including any modern advancements.

Must: Required by law, statutory guidance or the academy's funding agreement.§ Being transparent (CCTV)

Your subject access request policy should cover CCTV , as people can ask to see any footage you have recorded of them.

Should: Recommended in official guidance, such as the DfE's. Not a legal requirement in itself.§ Record-keeping

– ensure that you make people other than workers, such as visitors or customers, who may inadvertently be caught by monitoring, aware of its operation and why you are carrying it out;

Must: Required by law, statutory guidance or the academy's funding agreement.§ Surveillance in the workplace

For pupils, these include sharing the school’s privacy notice: – in an induction pack, when joining the school – at the start of each school year – when they provide extra personal data during the school year – through the school website

Good practice: Recommended as good practice. Not required.§ Inform data subjects about their privacy rights

Every school must make its privacy notices freely available to those whose personal data it handles, under this legislation.

Must: Required by law, statutory guidance or the academy's funding agreement.§ Introduction (after 'Providing this information is an important part of')

You must expand and amend this information to reflect local needs and circumstances, because you will process personal data that is not only for use in DfE data collections.

Must: Required by law, statutory guidance or the academy's funding agreement.§ How to use this guide

Your school’s privacy notice must include what personal data your school shares with DfE . You can read examples of this text in DfE ’s privacy notice model documents.

Must: Required by law, statutory guidance or the academy's funding agreement.§ What to include in a privacy notice

Your school’s privacy notice must include what personal data is shared with DfE . Our privacy notice model documents have examples of this text.

Must: Required by law, statutory guidance or the academy's funding agreement.§ Personal information shared with DfE

If you would like to discuss anything in this privacy notice, please contact: [Insert name and / contact details of your administrator / data protection officer]

Good practice: Recommended as good practice. Not required.§ Contact

You must review and amend to reflect local needs and circumstances, as you will process data that is not solely for use within data collections]

Must: Required by law, statutory guidance or the academy's funding agreement.§ Header bracket, 'Privacy Notice (How we use workforce information)'

[School / local authority should insert the lawful basis (bases) for collecting and using personal information for general purposes (must include a basis from Article 6, and one from Article 9 where data processed is special category data from the UK GDPR). Ensure you list all relevant legislation that supports the lawful basis.

Must: Required by law, statutory guidance or the academy's funding agreement.§ Why we collect and use workforce information