Skip to content ↓

GDPR – Data Protection

GDPR and what it means

The General Data Protection Regulation (GDPR) is a legal framework that sets guidelines for the collection and processing of personal information of individuals within the European Union (EU). The GDPR sets out the principles for data management and the rights of the individual, while also imposing fines that can be revenue-based. The General Data Protection Regulation covers all companies that deal with data of EU citizens, so it is a critical regulation for corporate compliance officers at banks, insurers, and other financial companies. GDPR came into effect across the EU on May 25, 2018.

Introduction

Under UK data protection law, individuals have a right to be informed about how our school uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their personal data. 

This privacy notice explains how we collect, store and use personal data about students at our school and their parents/carers. 

We, Bents Green School, Sheffield, are the ‘data controller’ for the purposes of UK data protection law. 

Our data protection officer is EduDataPro (see ‘Contact us’ below). 

The personal data we hold

Personal data that we may collect, use, store and share (when appropriate) about students includes, but is not restricted to:

  • Contact details, contact preferences, date of birth, identification documents
  • Parents/carers names, addresses, email addresses, telephone numbers 
  • Correspondence from parents/carers 

  • Details of your family circumstances 

  • Results of internal assessments and externally set tests 

  • Student and curricular records 

  • Behavioural information (such as exclusions and any relevant alternative provision put in place) 

  • Attendance information 

  • Safeguarding information 

  • Details of any support received, including care packages, plans and support providers 

  • Photographs, videos and CCTV images captured in school

We may also collect, use, store and share (when appropriate) information about your child that falls into "special categories" of more sensitive personal data. This includes, but is not restricted to, information about: 

  • Any medical conditions we need to be aware of, including physical and mental health 

  • Characteristics, such as ethnicity, languages spoken or special educational needs 

We may also hold data about your child that we have received from other organisations, including other schools and social services. 

Why we use this data

We use this data to:

  • Support student learning 

  • Monitor and report on student attainment progress 

  • To contact you about your child and the running of the school 

  • Provide appropriate pastoral care 

  • Protect student welfare and keep children safe (e.g.food allergies, or emergency contact details)  

  • Assess the quality of our services 

  • Administer admissions waiting lists 

  • Carry out research 

  • Comply with the law regarding data sharing 

  • Meet the statutory duties placed upon us by the Department for Education 

Use of your personal data for marketing purposes

Where you have given us consent to do so, we may send you marketing information by email or text promoting school events, campaigns, charitable causes or services that may be of interest to you.  

You can withdraw consent or ‘opt out’ of receiving these emails and/or texts at any time by contacting us (see ‘Contact us’ below).

Use of your child’s personal data in automated decision making and profiling

We do not currently process any personal data through automated decision making or profiling. If this changes in the future, we will amend any relevant privacy notices in order to explain the processing to you, including your right to object to it.

Our lawful basis for using this data

Our lawful basis for processing you and your child's personal data for the purposes listed in section 3 above are as follows: 

  • Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations). We need to process data to meet our responsibilities as a school under UK law as set out here: https://www.gov.uk/government/collections/statutory-guidance-schools An example of this is ‘safeguarding children and young people’  

  • Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. Managing a school is considered a ‘task in the public interest’. Further details are available here: https://www.gov.uk/government/collections/statutory-guidance-schools 

Less commonly, we may also use personal information about you where: 

  • We ask for your Consent: the individual has given clear consent for you to process their (or their child's) personal data for a specific purpose. An example of this may be certain uses of photographs of your child. 

  • We need to protect an individual’s vital interests (i.e. protect your life or someone else’s life), in situations where you’re physically or legally incapable of giving consent 

  • The data needs to be processed for health or social care purposes, and the processing is done by, or under the direction of, a health or social work professional or by any other person obliged to confidentiality under law. 

Where you have provided us with consent to use your data or your child’s data, you may withdraw this consent at any time. We will make this clear when requesting consent, and explain how you would go about withdrawing consent if you wish to do so. 

Some of the reasons listed above for collecting and using personal information about you overlap, and there may be several grounds which justify the school’s use of your data. 

Our basis for using special category data

For ‘special category’ data, we only collect and use it when we have both a lawful basis, as set out above, and one of the following conditions for processing as set out in UK data protection law: 

  • We have obtained your explicit consent to use your child’s personal data in a certain way 

  • We need to protect an individual’s vital interests (i.e. protect your child’s life or someone else’s life), in situations where you’re physically or legally incapable of giving consent 

  • We need to process it for the establishment, exercise or defence of legal claims 

  • We need to use it for reasons of substantial public interest as defined in legislation 

  • We need to process it for health or social care purposes, and the processing is done by, or under the direction of, a health or social work professional or by any other person obliged to confidentiality under law 

  • We need to use it for public health reasons, and it’s used by, or under the direction of, a professional obliged to confidentiality under law 

  • We need to use it for archiving purposes, scientific or historical research purposes, or for statistical purposes, and the use is in the public interest 

Collecting this data

While the majority of information we collect about you and your child is mandatory, there is some information that can be provided voluntarily. 

Whenever we seek to collect information from you, we make it clear whether you must provide this information (and if so, what the possible consequences are of not complying), or whether you have a choice. 

Most of the data we hold about your child will come from you, but we may also hold data about your child from: 

  • Sheffield City Council 

  • Government departments or agencies 

  • Health authorities 

  • Police forces, courts, tribunals 

How we store this data

We keep personal information about you and your child while they are attending our school. We may also keep it beyond their attendance at our school if this is necessary. Our record retention policy sets out how long we keep information about students. 

If you wish to see a copy of the schools retention policy please ask at the main school office. 

We have put in place appropriate security measures to prevent you and your child’s personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.  

We will dispose of you and your child’s personal data securely when we no longer need it. 

Who we share data with

We do not share information about you or your child with any third party without consent unless the law and our policies allow us to do so. 

Where it is legally required, or necessary (and it complies with UK data protection law), we may share personal information about you and your child with: 

  • Our local authority – to meet our legal obligations to share certain information with it, such as attainment and progress, safeguarding concerns and exclusions. 

  • The Department for Education - to meet our legal obligations to share certain information with it, such as census data and statistics. 

  • The student’s family and representatives - to meet our legal obligations to share certain information with them, progress and attainment, such as safeguarding concerns and exclusions 

  • Educators and examining bodies - to meet our legal obligations to share certain information with it, such as evidence of coursework and exam entries 

  • Our regulator, Ofsted – to monitor the performance of the school. 

  • Suppliers and service providers – to enable them to provide the service we have contracted them for 

  • Health and social welfare organisations – to provide professional support, advice and guidance 

  • Professional advisers and consultants – to provide professional support, advice and guidance 

  • Police forces, courts, tribunals - when required to by law 

National Student Database

We are required to provide information about students to the Department for Education as part of statutory data collections such as the school census. 

Some of this information is then stored in the National student Database (NPD), which is owned and managed by the Department and provides evidence on school performance to inform research. 

The database is held electronically so it can easily be turned into statistics. The information is securely collected from a range of sources including schools, local authorities and exam boards.  

The Department for Education may share information from the NPD with third parties, such as other organisations which promote children’s education or wellbeing in England. These third parties must agree to strict terms and conditions about how they will use the data. 

For more information, see the Department’s webpage on how it collects and shares research data

You can also contact the Department for Education with any further questions about the NPD.  

Transferring data internationally

Where we transfer your personal data to a third-party country or territory, we will do so in accordance with UK data protection law. 

In cases where we have safeguarding arrangements in place to complete this transfer, you can get a copy of these arrangements by contacting us. 

How to access personal information that we hold about you and your child

You have a right to make a ‘subject access request’ to gain access to personal information that we hold about you and your child. 

If you make a subject access request, and if we do hold information about you and your child, we will (subject to any exemptions that apply): 

  • Give you a description of it 

  • Tell you why we are holding and processing it, and how long we will keep it for 

  • Explain where we got it from, if not from you 

  • Tell you who it has been, or will be, shared with 

  • Let you know whether any automated decision-making is being applied to the data, and any consequences of this 

  • Give you a copy of the information in an intelligible form 

You may also have the right for your child’s personal information to be transmitted electronically to another organisation in certain circumstances. 

If you would like to make a request, please contact us (see ‘Contact us’ below). 

Your right to access your child’s educational record

Parents, or those with parental responsibility, also have the right to access their child’s educational record (which includes most information about a student). This right applies as long as the student is aged under 18. 

There are certain circumstances in which this right can be denied, such as if releasing the information might cause serious harm to the physical or mental health of the student or another individual, or if it would mean releasing exam marks before they are officially announced. 

To make a request, please contact the Headteacher at headteacher@bentsgreen.sheffield.sch.uk

Your other rights regarding you and your child’s data 

Under UK data protection law, you have certain rights regarding how you and your child’s personal data is used and kept safe. For example, you have the right to: 

  • Object to our use of you and your child’s personal data 

  • Prevent you and your child’s data being used to send direct marketing 

  • Object to and challenge the use of you and your child’s personal data for decisions being taken by automated means (by a computer or machine, rather than by a person) 

  • In certain circumstances, have inaccurate personal data corrected  

  • In certain circumstances, have the personal data we hold about you and your child deleted or destroyed, or restrict its processing 

  • Withdraw your consent, where you previously provided consent for your personal information to be collected, processed and transferred for a particular reason 

  • In certain circumstances, be notified of a data breach 

  • Make a complaint to the Information Commissioner’s Office 

  • Claim compensation for damages caused by a breach of the data protection regulations  

To exercise any of these rights, please contact us (see ‘Contact us’ below). 

Complaints

We take any complaints about our collection and use of personal information very seriously.

If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our data processing, please raise this with us in the first instance.

Alternatively, you can make a complaint to the Information Commissioner’s Office: 

  • Report a concern online at https://ico.org.uk/make-a-complaint/ 

  • Call 0303 123 1113 

  • Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF 

Contact us

Our data protection officer is: 

However, our data protection lead has day-to-day responsibility for data protection issues in our school.  

If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact them: