Privacy Notice (How We Use Information About Pupils and Their Families)
Introduction
This privacy notice explains how we collect, use, share, and protect personal information about our pupils and their families.
The relevant legislation governing data privacy in the UK is:
- The Data Protection Act 2018
- The UK General Data Protection Regulation (UK GDPR)
- The Data (Use and Access) Act 2025 (DUUA)
Categories of Information We Process
The categories of pupil/family information that we process include:
- Personal identifiers and contacts (such as name, unique pupil number, contact details, and address)
- Characteristics (such as ethnicity, language, and pupil premium/free school meal eligibility)
- Safeguarding information (such as court orders and professional involvement)
- Special educational needs (including specific needs and rankings)
- Medical and administration (such as doctors’ information, child health, dental health, allergies, medication, and dietary requirements)
- Attendance records (such as sessions attended, number of absences, absence reasons, and previous schools attended)
- Assessment and attainment
- Post-16 courses enrolled, relevant results, and other post-16 options
- 16+ information (including options regarding participation in education, training, or employment)
- Behavioural information (records of incidents and exclusions, and relevant alternative provision) This list is not exhaustive; please see our data processing map (Record of Processing Activities – RoPA) for the current list.
Why We Collect and Use Pupil and Family Information
We collect and use pupil information and that of their families for the following purposes:
- To support pupil learning, assessment, and special educational needs as appropriate.
- To monitor and report on pupil attainment and progress.
- To provide appropriate pastoral care.
- To assess the quality of our services.
- To keep children safe (e.g., food allergies or emergency contact details) and safeguard in accordance with our responsibilities under Keeping Children Safe in Education (KCSiE).
- To meet the statutory duties placed upon us for the Department for Education (DfE) data collections and health services.
Lawful Bases for Processing Personal Data
Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing pupil information include:
- Article 6 (1) (c): Processing is necessary for compliance with a legal obligation to which the controller is subject.
- Article 6 (1) (e): Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
- For special category data, we rely on:
o Article 9 (2) (a): The data subject has given explicit consent to the processing for specified purposes.
o Article 9 (2) (c): To protect the vital interests of the individual. o Article 9 (2) (f): Legitimate purposes involving legal claims.
o Article 9 (2) (i): Required for purposes of public health.
Storing Pupil/Family Data
We hold pupil data securely for the time specified in our data retention schedule. We have adopted the Information and Records Management Society (IRMS) recommendations. For more information, please see the Data Protection Policy and the IRMS Toolkit for schools.
Who We Share Pupil/Family Information With
We routinely share pupil information with:
- Schools that the pupils attend after leaving us.
- Our local authority.
- Youth support services (pupils aged 13+).
- The Department for Education (DfE).
- National Health Service.
- Targeted and family support services.
- The Police.
- Courts and the Children and Family Court Advisory and Support Service (Cafcass).
- Service providers (such as Data Protection, HR, and IT support services where appropriate).
Why We Regularly Share Pupil Information
We do not share information about our pupils without consent unless the law and our policies allow us to do so. For example, we must share pupil information in accordance with the Education (Pupil Information) (England) Regulations 2005 and Keeping Children Safe in Education statutory guidance.
Youth Support Services
For pupils aged 13+, we pass pupil information to our local authority and/or provider of youth support services. This enables them to provide services related to education and training for 13-19-year-olds.
Withdrawal of Consent and the Right to Lodge a Complaint
Where we process personal data based on consent, you have the right to withdraw that consent. If you are unhappy with our use of your personal data, please let us know by contacting the Headteacher at info@stjohns.org.uk or the Data Protection Officer (DPO) Richard Lewis-Ogden at DPO@bywaterkent.co.uk.
Data Retention
We will hold pupil data securely for the duration specified in our data retention schedule, following the IRMS guidelines.
Right to Access
Parents and pupils have the right to request access to information about them that we hold. To make a request, please contact the Head Teacher or our Data Protection Officer via email at DPO@bywaterkent.co.uk.
Complaints
If you wish to raise a complaint about how the school manages your personal data, please refer to our Data Protection Policy for further information on the complaints process.
Last Updated
This version was last updated in January 2026.