The Department has provided suggested texts for privacy notices to be used by schools and local authorities in the associated resources of this page.

These are only suggested texts and the Department recommends local authorities and academies use their own legal advisors to review and amend them to suit local needs.

The Privacy Notices refer the recipients to their LA websites to see how they will store and use the data. Suggested information for an LA to include on their website is also provided. The LA needs to include details of their Primary Care Trusts, Youth Support Services, and any other local bodies with which they share data.

The Privacy Notices also refer the recipients to the Department for Education website to see how they will store and use the data. Explanations are provided on how the data collected in the School Census, Children in Need Census and the School Workforce Census will be used.

Privacy Notices must be issued to new learners at a school or new staff at a school or LA for which data are being provided in the School Workforce Census. They can be issued to new learners or staff by the school or LA at the same time as other communications. For example:

  • A learner might receive the Privacy Notice as part of a school brochure or induction pack or in a school diary, and/or it could be posted on the school notice board.
  • For staff, the Privacy Notice might be included as part of a contract or induction pack, and/or posted on the staff notice board.
  • A child receiving social care services or a child looked after might receive their Privacy Notice as part of other information about the services that they are being offered.

The LA and/or the Department will need to make hard copies of their website information available to those without web access.

It is anticipated that staff, and young people who have the maturity to understand the nature and the implications of the request they are making and who have a general understanding of their rights under the Data Protection Act, should generally be able to request to see their personal information themselves under the Subject Access Provisions (S.7) of the Data Protection Act. For children under 12, their parents will generally act on their behalf. In every case, it will be for the school, as data controller, to assess whether the child is capable of understanding their rights under the Act, and the implications of their actions and so decide whether the parent needs to make the request on the child's behalf.

Contact us

Please use the service request form for queries about this guidance.