Data Protection Policy This policy is applicable to all (past and present) Governors, staff, associates, volunteers and Student Teachers, | |
For the purposes of data protection, Cheadle Hulme School is known as the “Data Controller” and the ICO registration number is Z6044788. For the ordinary running of the School, certain personal information about employees, volunteers and others who work on behalf of the School, current, former and prospective pupils, parents, carers or guardians (referred to as “parents”), as well as hirers of School facilities, other visitors, website browsers, neighbours, academic collaborators and the wider community who engage with the School, needs to be collected and used ("processed"). The School will take the privacy of personal information very seriously and this Data Protection Policy will set out the School’s approach to complying with data protection laws (Data Protection Act 2018; the Data (Use and Access) Act 2025; and, General Data Protection Regulations (UK GDPR)). The Director of Operations will be the member of the Senior Leadership Team responsible for the protection of data, and conducting annual information audits to ensure that information processed remains adequate, relevant and is not excessive. Privacy Notices To be transparent about how the School collects personal information fairly and lawfully, Privacy Notices will be published, which will identify the legal basis for processing personal information about:
The Privacy Notices will be clear about how information is to be collected, the specific purpose for collecting it; with whom it will be shared with; and the rights these individuals have when it comes to their personal information. From time to time, the School may need to change what information is collected or who it is shared with, and so the Privacy Notices will be kept up to date on the School website and any substantial changes will be notified directly to individuals as far as is reasonably practicable.
Secure Storage of Personal Information The School will have appropriate organisational procedures and technical security measures in place to ensure that data is kept safe and secure. These will be outlined in the E-Security Framework and Record Retention and Storage Procedures. The School will conduct Data Protection Impact Assessments to ensure personal information will be handled according to individual data protection rights and principles. Data Protection Impact Assessments Retention of Personal Information To make sure that personal information will not be kept longer than is necessary, the School will have a Records Management Policy with an associated Records Retention Procedure & Schedule. Updating Personal Information It is vital to the health and wellbeing of pupils and staff that the information gathered remains accurate and up to date, including preferred contact methods. Individuals will be asked to check at regular milestones that their information is still accurate, and clear guidance will be provided on how to contact the School to update information at any other time. Accessing Personal Information The Director of Operations will deal with all requests and enquiries concerning the School’s uses of personal data and the School will have a Subject Access Request procedure in place to respond to any such requests within the time limits. The School will respect individual rights to access, rectify, erase, restrict and transfer their personal information. All Subject Access Requests must be made in writing, and to help the School recognise a formal request and manage the response, individuals will be asked to submit requests through an online form. Sharing Personal Information with Other People For the legitimate interests of running a School, the School may need to share some personal data without consent, if there is a clear and legitimate reason to do so, this may be with third parties, external agencies, and statutory or governing bodies. The School may also need to safeguard the vital interests of an individual. The School has a Data Sharing Procedure to accompany Privacy Notices, which will give an outline of when information may be shared and ensure that sharing is carried out in a way that complies with the law, is fair, transparent, and in line with good practice. Staff Training Everyone who works for the School has a responsibility for ensuring data is collected, stored and handled appropriately. Training will be provided to help staff understand these responsibilities. Freedom of Information Requests Cheadle Hulme School is not a public body and therefore not subject to Freedom of Information (FOI) requests, which is separate from data protection legislation. However, the School will still comply with obligations to publish certain information about activities proactively. The School will be committed to transparency and openness and will respond to reasonable requests for information. Any requests should be put in writing to privacy@chschool.co.uk Guidance on Privacy The Information Commissioner’s Office regulates data protection and privacy matters in the UK. Individuals can make a complaint at any time about the way the School uses their information. However, the School will welcome any opportunity to maximize the quality of the personal information held, and will actively encourage individuals to consider raising any issue or complaint they have directly with the School in the first instance. |
SLT member responsible: | Director of Operations |
Governor sub-Committee responsible: | Risk Committee |
Date of approval: | March 2023 |
Date ratified by Governors: | March 2023 |
Policy procedures: | |
Other related policies and procedures: Campus Security Plan (sign in required) Equality, Diversity & Inclusion Policy e-Security Procedures (sign in required) Records Management Policy (sign in required) Records Retention Procedures & Schedule | |
To view previous versions of this policy please email us on enquiries@chschool.co.uk | |