Data protection myth-busting guide for schools
2 February 2023
7 common data protection myths in schools: our debunking guide
Data protection can be complicated. There are many myths out there making things even harder to get your head around.
Our education experts have put together guide to debunk some of these common data protection myths in schools.
Myth 1: You can’t give out class lists for Christmas cards
Myth 2: You can’t send paper copies of pupil reports home
We would recommend sending documents containing children’s data electronically wherever possible.
However, paper copies of reports can be either handed to parents or guardians when they come into school or sent home in the child’s book-bag if necessary.
We would just suggest that the personal information on any paper documents should be kept to a minimum, to reduce the risk if a report is lost.
Myth 3: Parents and guardians can’t record school plays and events
Myth 4: You must have consent to process someone’s personal data
As an organisation carrying out a public task, schools process most personal data because it is necessary to be able to carry out their statutory functions.
You only need to ask for consent to process someone’s information if it’s for something that isn’t compulsory, for example using children’s photos on the school website or social media.
Myth 5: You must keep allergy or dietary information locked away at all times
Myth 6: You can’t have school leaver hoodies with pupil names on
This is fine, so long as the personal information on school leaver hoodies is limited to only the pupil’s name.
We recommend using the first name and, where necessary, the initial of the surname.
Primary schools should inform parents in advance so that they have an opportunity to object if they don’t want their child included.
Myth 7: The police can have any personal information they ask for
The school must be confident that you have a lawful basis for sharing information with a third party, including the police.
Depending on the situation, it may be necessary and proportionate to share information.
Each request should be carefully considered, and you should only share the minimum information for the purpose.