°Ç¸ç³Ô¹Ï

This guidance is for schools and local authorities, when they work with children, young people and parents.

It explains:

• what a privacy notice is
• when you should issue a privacy notice
• what information we expect a privacy notice to include
• why issuing privacy notices is important

Privacy notices are the most common way to provide accessible information to individuals about the use of personal data.

Providing this information is an important part of:

• the
• UK General Data Protection Regulation (GDPR)

Every school must make its privacy notices freely available to those whose personal data it handles, under this legislation.

The Department for Education (DfE) substantially revised this document as part of a data protection review in 2024. There is also a link to it in the privacy notices section of the data protection in schools policies and procedures guide.

How to use this guide

This document has tips and guidance only. It is not formal legal guidance. A school or local authority is ultimately responsible for its own data protection procedures and compliance with legislation.

You must expand and amend this information to reflect local needs and circumstances, because you will process personal data that is not only for use in DfE data collections.

There is also a set of privacy notice model documents. These templates are also suggestions. You must review and amend them to reflect the type of institution and local circumstances.

What a privacy notice is

A privacy notice explains:

• why a school needs to collect personal data
• what you plan to do with it
• how long you will keep it
• whether you will share it with any other organisation

Privacy notices need to be:

• clear
• accessible
• regularly reviewed and updated

Being transparent builds trust, avoids confusion and lets everyone in the school community know what to expect.

Issuing and reviewing notices

You can issue privacy notices in several ways – for example, on your website or in:

• induction packs
• staff contracts
• information about social services

Your data protection officer should review privacy notices:

• at least annually
• whenever you make a significant change to how you process personal data

What to include in a privacy notice

The Information Commissioner’s Office (ICO) has a list of .

Your school’s privacy notice must include what personal data your school shares with DfE. You can read examples of this text in DfE’s privacy notice model documents.

DfE’s model privacy notices include suggested wording that schools can tailor to inform staff, parents, carers, and pupils about the collection of data.

A privacy notice can be in any format, if it is accessible. For example, you can provide a short version of your privacy notice, along with details of how to view further information. This is known as a .

Data subjects’ rights

Data subjects’ rights over the use of their personal data are important to a privacy notice. They are:

• the right to be informed
• the right of access
• the right to rectification
• the right to erasure
• the right to restrict processing
• the right to data portability
• the right to object
• rights in relation to automated decision-making and profiling

Your school should clearly communicate to data subjects:

• what personal data is being processed
• why their personal data is being processed
• on what lawful basis their personal data is being processed
• who their personal data will be shared with, and why
• how their personal data will be stored, and for how long
• how they can exercise their rights over their personal data
• who to contact if they have any questions or concerns

The information in your record of processing activities will be a useful source of information in this regard.

Inform data subjects about their privacy rights

Privacy notices are the most common way of complying with data subjects’ right to be informed.

There are several ways you can keep data subjects informed about how your school deals with their personal data.

For pupils, these include sharing the school’s privacy notice:

• in an induction pack, when joining the school
• at the start of each school year
• when they provide extra personal data during the school year
• through the school website

For staff, these include:

• when they apply for a role, accept a contract, are appraised, or leave the school
• making sure you make existing staff members aware of the privacy notice at the start of each school year
• making the notice visible on the staff notice board and intranet

For pupils and staff, you must make sure the privacy notice is accessible at all times.

Our example template offers a simple way for a school to seek parents’ and carers’ consent to process children’s personal data at the same time as they ask them to confirm or amend it.

Inform children about their privacy rights

Children have the same rights over their personal data as adults. Schools can be inventive in the way they present child friendly privacy rights information. For example, you can use:

• diagrams
• graphics
• comic strips
• videos

For example, DfE has a privacy notice specifically for children and young people.

Introducing the idea of data privacy in wider online safety lessons allows teachers to:

• use age-appropriate language
• make sure pupils understand
• encourage pupils to ask questions

Personal information shared with DfE

DfE collects personal information from educational settings, local authorities and other organisations, through various statutory data collections.

Each data collection or census guide includes the legislation detailing the lawful basis for collection.

This data is used for many purposes, including to inform funding, monitor education policy and school accountability, and to support research.

Your school’s privacy notice must include what personal data is shared with DfE. Our privacy notice model documents have examples of this text.

Version history

We updated this document, and the links, in August 2026. , are available in the National Archives.