Home Page

Data Protection

Data Protection and the GDPR – January 2021

As the UK transitional arrangements expired on 31 December 2020, there are some practical changes for Data Protection and the GDPR.

To comply with the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 please note that every policy, notice and procedural guide that refers to ‘GDPR’ shall now be read as ‘UK GDPR’.

The rights, responsibilities and data protection that the Data Protection Act 2018 and the GDPR are not changed. Our procedures and arrangements will not change.

If you have any queries please contact  School Data Protection Officer through

How We Handle Information About You


We’re making it easier for you to find out how we handle your information

A new data privacy law (General Data Protection Regulation) is being introduced on 25th May 2018.  As a result, we’re publishing a new Data Protection Policy and a range of documents to make it easier for you to find out how we use and protect your information.  The most important document for you is our Privacy Notice.  We will have one for pupils and one for staff.  We won’t be changing the ways we use your personal information, but the new privacy notices will provide you with additional details such as:

  • your increased rights in relation to the information we hold about you
  • who we share your information with
  • the types of personal information we collect about you and how we use it
  • the legal grounds for how we use your information




The legal grounds for using your information

This is common for all personal and sensitive data we collect and process about staff, volunteers, pupils, parents, carers and any other individuals.

Some data is more sensitive than other types of data. These special categories are as follows: personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric information, health information, and information about sex life or orientation.



The school will ask for consent to process data about you or a pupil. The type of data that is to be used, and how it is to be used will be specified on the consent forms.

You have the choice to opt in for certain types of data usage, and this is made clear. However, some data that is collected and processed in schools is not optional.


Legitimate interests

This means that the processing is necessary for legitimate interests except where the processing is unfair to you. The School relies on legitimate interests for many of the ways in which it uses information.

Specifically, the school has a legitimate interest in:

  • Providing educational services to pupils
  • Safeguarding and promoting the welfare of pupils and staff
  • Promoting the objects and interests of the school
  • Ensuring the efficient operation of the school
  • Compliance with all relevant legal obligations of the school
  • Keeping the whole school community informed about events, news and activities


Necessary for a contract

Information about individuals may be necessary to perform our obligations under our contracts.

For example, maintaining the school Management Information System database.


Legal obligation

Much of school life is governed by legal obligations to supply information to organisations such as the Department for Education or Local Authority or HMRC. We may also have to disclose information to third parties such as the courts, Disclosure and Barring Service or the police where legally obliged to do so.


Vital interests

For example, to prevent someone from being seriously harmed or killed.


Public interest

The School considers that it is acting in the public interest when providing education. Certain regulations, DfE and Local Authority, health and other guidance may require the school to process data in the public interest.


Legal claims:

The processing is necessary for the establishment, exercise or defence of legal claims. This allows us to share information with our legal advisors and insurers.


Your rights – What decisions can you make about your information?


From May 2018 data protection legislation gives you a number of rights regarding your information. Some of these are new rights whilst others build on your existing rights.


Your rights are as follows:


  • you can ask what information we hold about you and be provided with a copy. Sometimes we are not able to share all the information, but this is set out in our Subject Access Policy
  • if information is incorrect you can ask us to correct it
  • you can ask us to delete the information that we hold about you or your child in certain circumstances. For example, where we no longer need the information;
  • you can ask us to send you, or another organisation, certain types of information about you in a format that can be read by computer – this does not apply to pupil records as these are transferred by a DfE process called the Common Transfer File
  • our use of information about you may be restricted in some cases. For example, if you tell us that the information is inaccurate we can only use it for limited purposes while we check its accuracy


If you disagree with any decision we make about your data you can use our complaints policy, you also have the right to make a complaint to the Information Commissioner, and sometimes to the Information Tribunal or through the court process.  Our complaints policy is available on the website.



Test and Trace

Schools are in a very difficult situation. The tracing process of ‘Test and Trace’ is made more difficult as schools are public authorities. They have a legal duty to protect and promote the welfare of pupils and a duty of care to staff. It is hoped that additional government guidance will be provided for schools.

As a private individual, compliance with the scheme is optional, you cannot at the present time be forced to provide details. As a school it is more complicated.

If a person in a school has Covid or symptoms they will be sent home as will other people in school who have had contact and who may be at risk.

In school it would be most unusual for any one person to know the details of everyone else who may be affected. It is only the school that will have that data. We would notify individuals about a risk, and in many instances that will be sufficient.

However, the Department of Education Guidance goes onto say

‘As part of the national test and trace programme, if other cases are detected within the child or young person’s cohort or in the wider education or childcare setting, Public Health England’s local Health Protection Teams will conduct a rapid investigation and will advise schools and other settings on the most appropriate action to take.’

So in this situation it is not a matter of giving consent to share data, there is a Public Duty to do so. As a school we will co-operate with such requests. Schools are under an obligation to share data

At no point we will we share data without a sound legal basis, but please be aware that we will share data where necessary.


We’re here to help


If you have any questions about how we use your information, please contact:
Miss L Slater, School Business Manager

Granby Junior School

Heanor Road







Or you can contact our Data Protection Officer:
Mr J A Walker, Solicitor

Office 7,

The Courtyard,

Gaulby Lane,


Leicestershire LE2 2FL

United Kingdom



Tel: 0333 772 9763