• This policy is intended to provide information about how the school will use (or “process”) personal data about individuals including current, past and prospective pupils; and their parents, carers or guardians (referred to in this policy as “parents”).
  • It applies in addition to the school’s terms and conditions, and any other information the school may provide about a particular use of personal data, including e.g. the school’s policy on taking, storing and using images of children.
  • Anyone who works for, or acts on behalf of, the school (including staff, volunteers and service providers) should also be aware of and comply with the school’s data protection policy for staff, which also provides further information about how personal data about those individuals will be used.


  • The School has appointed the Bursar as Data Protection Officer (“DPO”) who will endeavour to ensure that all personal data is processed in compliance with this policy and the Act.


  • The school may process a wide range of personal data about individuals including current, past and prospective pupils and their parents as part of its operation, including by way of example:
    • names, addresses, telephone numbers, e-mail addresses and other contact details;
    • bank details and other financial information, e.g. about parents who pay fees to the school;
    • past, present and prospective pupils’ academic, disciplinary, admissions and attendance records (including information about any special needs), and examination scripts and marks;
    • where appropriate, information about individuals’ health, and contact details for their next of kin;
    • references given or received by the school about pupils, and information provided by previous educational establishments and/or other professionals or organisations working with pupils; and
    • images of pupils (and occasionally other individuals) engaging in school activities (in accordance with the school’s policy on taking, storing and using images of children);
    • Generally, the school receives personal data from the individual directly (or, in the case of pupils, from parents). However, in some cases personal data may be supplied by third parties (for example another school, or other professionals or authorities working with that individual), or collected from publicly available resources.
    • The school may, from time to time, need to process “sensitive personal data” regarding individuals.  Sensitive personal data includes information about an individual’s physical or mental health, race or ethnic origin, political or religious beliefs, sex life, trade union membership or criminal records and proceedings.  Sensitive personal data is entitled to special protection under the Act, and will only be processed by the school with the explicit consent of the appropriate individual, or as otherwise permitted by the Act.


  • The school will use (and where appropriate share with third parties) personal data about individuals for a number of purposes as part of its operations, including as follows:
    • For the purposes of pupil selection and to confirm the identity of prospective pupils and their parents;
    • To provide education services (including SEN), career services, and extra-curricular activities to pupils; monitoring pupils’ progress and educational needs; and maintaining relationships with alumni and the school community;
    • For the purposes of management planning and forecasting, research and statistical analysis, and to enable the relevant authorities to monitor the school’s performance;
    • To give and receive information and references about past, current and prospective pupils, including relating to outstanding fees or payment history, to/from any educational institution that the pupil attended or where it is proposed they attend; and to provide references to potential employers of past pupils;
    • To enable pupils to take part in national or other assessments, and to publish the results of public examinations or other achievements of pupils of the school;
    • To safeguard pupils’ welfare and provide appropriate pastoral (and where necessary, medical) care, and to take appropriate action in the event of an emergency or accident, including by disclosing details of an individual’s medical condition where it is in the individual’s interests to do so, for example for medical advice, insurance purposes or to organisers of school trips;
    • To monitor (as appropriate) use of the school’s IT and communications systems;
    • To make use of photographic images of pupils in school publications, on the school website and (where appropriate) on the school’s social media channels in accordance with the school’s policy on taking, storing and using images of children;
    • For security purposes, and for regulatory and legal purposes (for example child protection and health and safety) and to comply with its legal obligations; and
    • Where otherwise reasonably necessary for the school’s purposes, including to obtain appropriate professional advice and insurance for the school.


  • The school will use the contact details of parents, alumni and other members of the school community to keep them updated about the activities of the school, including by sending updates and newsletters, by email and by post. Unless the relevant individual objects, the school may also:
  • Contact parents and/or alumni by post and email in order to promote and raise funds for the school and, where appropriate, other worthy causes;
  • Should you wish to limit or object to any such use, or would like further information about them, please contact the DPO in writing.


  • Individuals have the right under the Act to access to personal data about them held by the school, subject to certain exemptions and limitations set out in the Act.  Any individual wishing to access their personal data should put their request in writing to the DPO.
  • The school will endeavour to respond to any such written requests (known as “subject access requests”) as soon as is reasonably practicable and in any event within statutory time-limits. The school may charge an administration fee of up to £10 for providing this information.
  • You should be aware that certain data is exempt from the right of access under the Act. This may include information which identifies other individuals, or information which is subject to legal professional privilege. The school is also not required to disclose any pupil examination scripts nor any reference given by the school for the purposes of the education, training or employment of any individual.
  • Pupils can make subject access requests for their own personal data, provided that, in the reasonable opinion of the school, they have sufficient maturity to understand the request they are making. Pupils aged 12 or over are generally assumed to have this level of maturity, although this will depend on both the child and the personal data requested. All subject access requests from pupils will therefore be considered on a case by case basis.
  • A person with parental responsibility will generally be expected to make a subject access request on behalf of younger pupils. A pupil of any age may ask a parent or other representative to make a subject access request on his/her behalf.


  • The rights under the Act belong to the individual to whom the data relates. However, the school will in most cases rely on parental consent to process personal data relating to pupils (if consent is required under the Act) unless, given the nature of the processing in question, and the pupil’s age and understanding, it is more appropriate to rely on the pupil’s consent. Parents should be aware that in such situations they may not be consulted.
  • In general, the school will assume that pupils consent to disclosure of their personal data to their parents, e.g. for the purposes of keeping parents informed about the pupil’s activities, progress and behaviour, and in the interests of the pupil’s welfare, unless, in the school’s opinion, there is a good reason to do otherwise.
  • However, where a pupil seeks to raise concerns confidentially with a member of staff and expressly withholds their agreement to their personal data being disclosed to their parents, the school will maintain confidentiality unless, in the school’s opinion, there is a good reason to do otherwise; for example, where the school believes disclosure will be in the best interests of the pupil or other pupils.
  • Pupils are required to respect the personal data and privacy of others, and to comply with the school’s policies and rules.


  • The school will endeavour to ensure that all personal data held in relation to an individual is as up to date and accurate as possible.  Individuals must notify the DPO of any changes to information held about them.
  • An individual has the right to request that inaccurate information about them is erased or corrected (subject to certain exemptions and limitations under the Act) and may do so by contacting the DPO in writing.
  • The school will take appropriate technical and organisational steps to ensure the security of personal data about individuals. All staff will be made aware of this policy and their duties under the Act.


  • Any comments or queries on this policy should be directed to the DPO (Bursar).
  • If an individual believes that the school has not complied with this policy or acted otherwise than in accordance with the Act, they should utilise the school complaints procedure and should also notify the DPO.

September 2017