Schools and early-years settings handle a remarkable amount of sensitive information about people who can’t fully look after their own interests: children. Names, dates of birth, medical conditions, allergies, special educational needs, safeguarding concerns, photographs, behaviour records, attendance, and a parallel set of records on every member of staff. The law takes children’s data especially seriously, and the people who fund your fees — and the inspectors who visit — increasingly expect you to take it seriously too.
You don’t need to become a lawyer. You do need to get a handful of things consistently right. Here they are, in plain English.
You are a “controller”, even when the software does the work
Under the UK GDPR and the Data Protection Act 2018, your school or nursery is a data controller: you decide what information is collected and why. Using a cloud-based MIS, a learning app or an online payment system doesn’t transfer that responsibility — those suppliers are usually processors acting on your instructions, and you remain accountable for what happens to the data. That means the contracts you sign with edtech providers actually matter, not as paperwork, but as a line of defence.
Children’s data carries extra protection
UK law has always treated children’s information as deserving particular care, and the 2025 reforms reinforced this: there’s now an explicit duty to consider “children’s higher protection matters” when you design how you handle their data, especially for any online service a child might use. Layer onto that the genuinely sensitive categories you routinely hold — health information, SEN records, ethnicity, religion, and safeguarding notes — and it’s clear why education sits in a higher-risk bracket than most small organisations. Special category data like health needs a stronger legal justification than an ordinary name and address.
The duties that matter most
Transparency. Pupils, parents and staff should be told clearly what you hold and why, in language that fits the audience. A privacy notice written for parents won’t work for a Year 5 pupil, and a generic template won’t reflect what your setting actually does.
Knowing what you hold. You can’t protect, share or delete information you can’t locate. A simple record of what data you keep, where it lives, and who you share it with (the local authority, examination boards, the NHS, social services) underpins everything else.
Security. Most school data breaches are ordinary: a misdirected email containing a class list, a lost memory stick, a safeguarding file left on a printer. Access controls, encryption on devices, and a firm rule against sending sensitive information to personal accounts prevent the majority of them.
Sharing the right way. Safeguarding sometimes requires you to share information quickly — and data protection law supports that, properly handled. We’ll return to the safeguarding-versus-privacy balance later in this series, because it’s where schools most often hesitate when they shouldn’t.
Retention. Pupil records, safeguarding files and staff records all have their own expected lifespans. “Keep everything forever” isn’t a policy; it’s a liability.
Breach readiness. If personal data is lost or disclosed in a way that risks harming someone, you may have only 72 hours to report it to the ICO. Decide now who makes that judgement during the summer holidays.
What the 2025 law change means for you
The Data (Use and Access) Act 2025 eased the requirement to appoint a formal Data Protection Officer for UK organisations, replacing it in many cases with a Senior Responsible Individual in senior management. Many independent schools and nurseries appointed a DPO voluntarily rather than because they were compelled to, so for you this is less about a new obligation and more about flexibility in who holds the role. The catch is unchanged: whoever holds it still needs real expertise, and inspection regimes won’t accept “we weren’t sure” as an answer.
Where to start this term
Map what personal data you hold and where it sits. Check that your parent and pupil privacy notices match what you actually do. Make sure one named person knows exactly what to do if there’s a breach. Those three steps put a small setting comfortably ahead of its peers.
dponesto helps independent schools, nurseries and training providers handle data protection without hiring a full-time specialist — from a one-off health check to acting as your outsourced data protection lead. If you’d like a plain-English review of where your setting stands, get in touch.