Data Protection & Freedom of Information

Schools and education providers handle large amounts of information every day. Some of it is personal data about pupils, parents, staff and governors. Some of it is organisational information about decisions, policies, spending and governance. Geldards Education provides clear, practical advice on data protection in schools and freedom of information duties for schools, academy trusts, independent schools, specialist settings, colleges and other education providers.

Data protection in schools

Data protection in schools affects almost every part of school life. It covers how personal data is collected, used, stored, shared and deleted. This includes pupil records, safeguarding information, SEND records, health information, staff files, parent communications, CCTV, photographs, attendance data and behaviour records.

Schools need clear systems that staff understand and follow. Poor data handling leads to complaints, breaches, loss of trust and pressure on senior leaders.

We help schools understand their data protection duties and put practical processes in place. Our advice is clear, proportionate and focused on how schools operate in real life.

School data protection policy

A school data protection policy should explain how personal data is handled and who is responsible for keeping it safe. It should be clear enough for staff to use and detailed enough to support compliance with UK GDPR and the Data Protection Act 2018.

We draft and review data protection policies for schools, academy trusts and education providers. This includes advice on privacy notices, retention, lawful bases, consent, data sharing, security, breach reporting, subject access requests and staff responsibilities.

A good policy should not sit unread on a website. It should support everyday decisions and help staff understand what to do when handling personal data.

Does the Freedom of Information Act apply to schools?

A common question we get is: does the Freedom of Information Act apply to schools? For maintained schools, academies and other state-funded schools in England, the answer is yes. These schools are subject to freedom of information duties and must respond properly to valid requests for recorded information. However, the guidance for independent and private schools, nurseries and early years providers is different so it’s imperative to ensure you get the correct legal advice for your setting.

Freedom of information requests are different from data protection requests. FOI usually deals with recorded non-personal information held by the school, such as policies, procedures, governance information, spending, contracts or decision-making records.

We help schools understand whether a request should be treated as an FOI request, a subject access request or another type of information request. Getting this right at the start helps avoid delay, confusion and unnecessary legal risk.

Freedom of information policy in schools

Freedom of information policy in schools should explain how FOI requests are handled, who manages them, what timescales apply and how exemptions are considered. Schools also need to think about their publication scheme and the information they make available proactively.

We review and draft freedom of information policies, publication scheme documents and request-handling procedures. We also advise on live FOI requests, including sensitive requests linked to complaints, procurement, governance, staff issues, exclusions or reputation.

Clear FOI processes help schools respond consistently and keep proper records of how decisions were made.

SAR processing for schools

SAR processing for schools in the UK requires careful handling. A subject access request allows an individual to ask for access to their personal data. In schools, SARs may come from parents, pupils, students, staff, former employees or other individuals.

SARs often arise alongside complaints, employment disputes, safeguarding issues, exclusions, SEND concerns or breakdowns in trust. They may involve large volumes of emails, records, reports and correspondence.

We support schools with the full SAR process. This includes identifying the request, checking identity and authority, searching for information, reviewing exemptions, redacting documents, preparing responses and keeping clear records.

Data breaches and information risks

Data breaches in schools need a quick and organised response. A breach may involve an email sent to the wrong person, lost records, unauthorised access, cyber incidents, accidental disclosure, misplaced devices or inappropriate sharing of sensitive information.

We advise on breach assessment, containment, ICO notification, communication with affected individuals and post-breach reviews. We also help schools understand what changes are needed to reduce the risk of similar incidents happening again.

This may include updating policies, improving staff training, changing processes, reviewing supplier contracts or strengthening information governance.

Information governance and joined-up support

Information issues rarely sit in isolation. A data protection or FOI issue may involve safeguarding, SEND, employment, governance, complaints, procurement, contracts, reputation management or litigation risk.

Geldards Education provides joined-up advice across these areas. This means we look at the full issue, not just the information request or policy.

We work with headteachers, business managers, data protection officers, governors, trustees, clerks, HR teams and senior leaders to help information governance work properly across the organisation.

How we help

We regularly support education providers with:

• Data protection in schools and education settings
• School data protection policy drafting and review
• Freedom of information policy and ongoing school support
• Advice on whether the Freedom of Information Act applies to schools
• SAR processing for schools
• Subject access requests from parents, pupils, students and staff
• Freedom of information requests
• Publication schemes and proactive disclosure
• Privacy notices and consent issues
• Data sharing agreements
• Data processor and supplier clauses
• Data breaches and ICO notifications
• CCTV, photographs and image use
• Safeguarding, SEND and health data
• Staff training and information governance procedures
• Complaints, disputes and reputation-sensitive information requests

Why choose Geldards Education?

Geldards Education understands the pressure information requests and data issues place on schools and education providers. We know that leaders need advice that is legally sound, practical and easy to act on.

Our team brings together experience in education law, data protection, freedom of information, safeguarding, employment, governance, complaints, commercial contracts and disputes. This means we help you manage the legal position and the wider context.

Whether you need advice on data protection in schools, support with a school data protection policy, help with SAR processing for schools UK or guidance on freedom of information requests, we provide clear advice that helps you manage risk and respond with confidence.