11 Data Protection Policy

Purpose

This policy makes sure the school processes personal data lawfully, fairly and securely across its online education provision, including during live lessons and in recordings.

Data protection principles

Personal data will be:

• used for specified, lawful purposes;
• kept to the minimum necessary, in line with data minimisation;
• accurate and kept up to date where required;
• retained only as long as necessary;
• handled securely, using appropriate technical and organisational measures;
• processed in line with pupils' rights and the school's transparency duties.

Data types processed

• Pupil identity and contact details, as needed for registration.
• Learning data, such as attendance, engagement and submitted work.
• Safeguarding records, including incident records.
• Staff records and suitability documentation, where relevant.
• Online learning data, such as lesson access, moderation logs and chat evidence where it is needed.

Lawful basis

The school relies on appropriate lawful bases for processing, which may include:

• processing necessary for the provision of education and for school governance;
• compliance with a legal obligation;
• consent where it is specifically required, for example for certain uses of recordings or images;
• legitimate interests, where permitted and balanced against the rights of the data subject.

Security and safeguards

• Access to personal data is restricted to staff who need it for their role.
• The school uses secure accounts, strong passwords, and multi-factor authentication wherever it is available.
• Systems are configured to prevent unauthorised access to pupil recordings and accounts.

Retention

The school keeps personal data only for the period set out in its Records Management and Retention Policy. Recording files are kept only as long as educational purposes require and remain under access control while they exist.

Data subject rights

The school responds to requests about:

• access to personal data;
• correction of inaccurate data;
• objections and the withdrawal of consent where those apply;
• other rights required by law.

Requests are handled through the school's designated process and within the statutory timescales.

Data breaches

Any personal data breach, including loss of access credentials or the unauthorised disclosure of recordings, is reported and managed under the school's incident and breach procedures. Where required, the school considers notifying the Information Commissioner's Office and tells the people affected where it must.

Review

This policy is reviewed at least once a year and after any material change to the school's systems or processes.