Cheselbourne Village School

Statement of Data Protection Policy

Please read this policy in conjunction with the Child Protection and Safeguarding Policies

This is a statement of data protection policy adopted by Cheselbourne Village School.

The School recognises that in order to operate efficiently, it needs to collect, use and share personal data (more commonly referred to as personal information) as defined by the Data Protection Act 2018.  The 2018 Act can be found here:     

https://www.gov.uk › data-protection.

        The School regards the lawful and correct treatment of personal information as very important to its successful operation, and recognises the need to maintain confidence between those with whom it deals and the School.  It also recognises the need to ensure that it treats personal information lawfully and correctly.

Data Protection Principles

The School fully endorses the Data Protection Principles as detailed in Schedule 1 of the Act.

Specifically, the Principles require that personal information will:

1. be processed fairly and lawfully:
2. only used for specified and lawful purposes and shall not be used in any manner incompatible with those purposes.
3. be adequate, relevant and not excessive;
4. be accurate and, where necessary, kept up to date;
5. not be kept any longer than is necessary;
6. be used in accordance with the rights of the individuals to whom it relates;
7. be protected against unauthorised use, theft, accidental loss, destruction or damage by the use of appropriate technical and organisational measures;
8. not be transferred to a country or territory which does not have an adequate level of legal protection for the rights of individuals in relation to the processing of their personal data.

Therefore, the School will, through appropriate management, and strict application of criteria and controls:

• fully observe conditions regarding the fair collection and use of information;

• meet its legal obligations to specify the purposes for which information is used;

• collect and use appropriate information, and only to the extent that it is needed to fulfil operational needs or to comply with any legal requirements;

• ensure the quality of information used;

• apply strict checks to determine the length of time information is held;
• ensure that the rights of people about whom information is held can be fully exercised under the Act.  (These include: the right to be informed that processing is being undertaken: the right of access to one’s personal information; the right to prevent processing in certain circumstances; the right to correct rectify, block or erase information which is regarded as wrong information.);

• take appropriate technical and organisational security measures to safeguard personal information;

• ensure that personal information is not transferred abroad without suitable safeguards.

Management of Personal Information

In addition, the School will ensure that:

• there is someone with specific responsibility for data protection in the organisation.  (Currently, the Nominated Person is the Headteacher);

• everyone managing and handling personal information understands that they are contractually responsible for following good data protection practice;

• everyone managing and handling personal information is appropriately trained to do so;

• everyone managing and handling personal information is appropriately supervised;

• anybody wanting to make enquiries about the use and protection personal information knows how to do so;

• queries about handling personal information are promptly and courteously dealt with;

• the way personal information is managed is kept under review;

• performance with handling personal information is regularly assessed and evaluated.

Access to personal information;

Under the provisions of the Act, individuals have a general right of access to personal information which relates to them, although there are some exemptions to this right. In certain circumstances, this right may be exercised by parents (or those with parental responsibility) on behalf of the pupil.

The school may impose a charge up to the maximum permitted by law and must comply with any such request within the statutory time limit. Both of these will be governed by the associated data protection regulations in force at the time of the request.

Complaints about the school’s use of personal information:

In the first instance, all complaints relating to the collection, use and sharing of personal information should be referred to the school’s complaints process. If after exhausting this process you remain dissatisfied, you can refer your complaint to the Information Commissioner at:

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Telephone helpline - 0303 123 1113

Web: http://ico.org.uk/

GDPR – The School’s Privacy Notice can be found on the Website: www.cheselbourne.dorset.sch.uk