Privacy Notice for Parents/Carers (How we use pupil information)
Under data protection law, individuals have a right to be informed about how the school uses any personal data that we hold about them. This privacy notice explains how we collect, store and use personal data about pupils at our school. We will update it from time to time as required by evolving laws, guidance and practice, informing you directly as far as is reasonably practicable of any substantial changes that affect your rights.
Hove Junior School is the “Data Controller” for the purposes of data protection law. Our Data Protection Officer is James England, contactable via Data Protection Education:
0800 086 2018
The categories of school workforce information that we collect, process, hold and share include:
· personal information (such as name and address)
· characteristics (such as gender, age, ethnic group and free school meal eligibility)
· attendance information (such as sessions attended, number of absences and absence reasons)
· results of internal assessments and externally set tests
· safeguarding information
· details of any medical conditions, including physical and mental health
· exclusion information
· details of any support received, including statements and education, health & care plans (EHCPs)
Why we collect and use this information
We use this data to:
· support pupil learning
· monitor and report on pupil progress
· provide appropriate pastoral care
· protect pupil welfare
· assess the quality of our services
· comply with the law regarding data sharing
The lawful basis on which we process this information
Under the GDPR (General Data Protection Regulation 2018) and the DPA (Data Protection Act 1998), consent is one lawful basis for processing but there are alternatives.
For example with regards to data which schools are required to process to satisfy a statutory collection by the DfE (for example, the school census), such processing is permitted within the DPA under conditions 5(b) and (c) of Schedule 2 and conditions 7(1)(b) and (c) of Schedule 3. These conditions permit the processing of personal data where such processing is necessary for the exercise of any function conferred by or under statute and/or for the exercise of any functions of the Crown, Minister of the Crown, or any Government department.
Under GDPR, the collection and processing of data to support DfE specified data collections would largely fall under:
a. GDPR Article 6(1)(e): the processing is necessary for a task carried out in the public interest or in the exercise of official authority vested in the controller.
b. For processing special category personal data (what used to be sensitive personal data under DPA) the GDPR processing condition is in article 9(2)(j) the processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with article 89 (1) based on union or member state law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard fundamental rights and interests of the data subject.
However where schools collect and process data for their own purposes, and which is not covered by regulations / legislation, then another lawful basis for the processing must be identified. This could be via obtaining ‘explicit consent’ from the data subjects or via another lawful basis as outlined in the GDPR articles 6 and 9. See the link below for further guidance from the ICO concerning lawful bases for processing:
Collecting this information
Whilst the majority of information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain pupil information to us or if you have a choice in this.
Storing this information
We use the Information Management Toolkit for Schools which has been created to assist schools to manage their information in line with the current legislative frameworks. To find out more go to:
Who we share this information with
Occasionally, we share pupil information with third parties, such as:
· our local authority
· the Department for Education (DfE)
· educators and examining bodies
· our regulator (Ofsted)
· suppliers and service providers – to enable them to provide the service we have contracted them for (Parentpay, New Era Education, E4 Education, CPOMS, Autographfood, 4th Dimension, PGL Ltd, after school clubs, JP Photography)
· health authorities
· professional advisers and consultants
· police forces, courts, tribunals
· schools that the pupils attend after leaving us
For the most part, personal data collected by us remains within the school and is processed by appropriate individuals only in accordance with access protocols (ie on a “need to know” basis). Particularly strict rules of access apply in the context of medical records and safeguarding files.
Why we share pupil information
We do not share information about our pupils with anyone without consent unless the law and our policies allow us to do so.
We are required to share information about our pupils with our local authority (LA) and the Department for Education (DfE) under section 3 of the Education (Information about Individual Pupils) (England) Regulations 2013.
Data collection requirements
To find out more about the data collection requirements placed on us by the Department for Education including the data that we share with them, go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.
The National Pupil Database (NPD)
The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.
We are required by law, to provide information about our pupils to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013.
To find out more about the NPD, go to
The department may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:
· conducting research or analysis
· producing statistics
· providing information, advice or guidance
The Department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:
· who is requesting the data
· the purpose for which it is required
· the level and sensitivity of data requested
· the arrangements in place to store and handle the data
To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.
For more information about the department’s data sharing process, please visit:
For information about which organisations the department has provided pupil information, (and for which project), please visit:
Requesting access to your personal data
Under data protection legislation, you have the right to make a “subject access request” to gain information about you that we hold. To make a request for your child’s information or be given access to your child’s educational record, contact our Data Protection Officer.
You also have the right to:
· object to processing of personal data that is likely to cause, or is causing, damage or distress
· prevent processing for the purpose of direct marketing
· object to decisions being taken by automated means
· in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
· claim compensation for damages caused by a breach of the Data Protection regulations
If you have a concern about the way we are collecting or using your child’s personal data, we ask that you raise your concern with us in the first instance. To make a complaint, please contact our Data Protection Officer.
Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/
If you would like to discuss anything in this privacy notice, please contact the School Business Manager.