Data protection

The Data Protection Act covers all personal data held by any organisation and sets the rules for how this data is used. All schools are required to have a registration under the Data Protection Act 1998.

To ensure you are compliant with this law, you need to notify the Information Commissioner's Office of the type of personal data you hold. A notification registration lasts for one year and it will cost you £35 to register your school.

Under the Data Protection Act 1998 all schools processing personal data must comply with the eight enforceable principles of good practice. Data must be:

fairly and lawfully processed
processed for limited purposes
adequate, relevant and not excessive
accurate
not kept longer than necessary
processed in accordance with the data subject's rights
secure
not transferred to other countries without adequate protection

To comply with these principles every school processing personal data must notify under the Act. Failure to notify is a criminal offence.

To check your current notification contact the Data protection register, Tel: (01625) 545 740.

Useful documents:

Dos and don'ts of data protection (word)
Some guidance on how to comply with the act.

Ealing data protection policy statement (pdf)
Information includes the council's responsibilites, what the act means for the individual and the Ealing framework.

Ealing data protection principles (word)
Detailed explanation of the principles in the list above.

Ealing data protection practice notes (word)
Guidance for collecting or using data about living individuals.

DfE - guide to the law for school governors

Useful websites:

Department for Constitutional Affairs
General information on the Data Protection Act.

DfE - data protection for schools
This site gives advice on the basics of data protection and how it applies to schools.

Data Protection Act 1998
The Data Protection Act legislation in full.

For further information contact:

Michelle Gabay
Tel: (020) 8825 8282
Email: dataprotection@ealing.gov.uk