The UK General Data Protection Regulation (UK GDPR) ensures a balance between an individual’s rights to privacy and the lawful processing of personal data undertaken by organisations in the course of their business. It aims to protect the rights of individuals about whom data is obtained, stored, processed or supplied and requires that organisations take appropriate security measures against unauthorised access, alteration, disclosure or destruction of personal data.
The Lady Margaret and Durdan’s Park Schools’ Federation, “the federation”, will protect and maintain a balance between data protection rights in accordance with the UK GDPR.
This policy sets out how we handle the personal data of our pupils, parents, suppliers, employees, workers and other third parties.
This policy does not form part of any individual’s terms and conditions of employment with the federation and is not intended to have contractual effect. Changes to data protection legislation will be monitored and further amendments may be required to this policy in order to remain compliant with legal obligations.
All members of staff are required to familiarise themselves with its content and comply with the provisions contained in it. Breach of this policy will be treated as a disciplinary offence which may result in disciplinary action under the federation’s disciplinary policy and procedures up to and including summary dismissal depending on the seriousness of the breach.
Personal data
Personal data is any information relating to an individual where the individual can be identified (directly or indirectly) from that data alone or in combination with other identifiers we possess or can reasonably access. This includes special category data and pseudonymised personal data but excludes anonymous data or data that has had the identity of an individual permanently removed.
Personal data can be factual (for example, a name, email address, location or date of birth) or an opinion about that person’s actions or behaviour.
Personal data will be stored either electronically or as part of a structured manual filing system in such a way that it can be retrieved automatically by reference to the individual or criteria relating to that individual.
Special category data
Previously termed “Sensitive Personal Data”, Special Category Data is similar by definition and refers to data concerning an individual Data Subject’s racial or ethnic origin, political or religious beliefs, trade union membership, physical and mental health, sexuality, biometric or genetic data and personal data relating to criminal offences and convictions.
Data Subject
An individual about whom such information is stored is known as the Data Subject. It includes but is not limited to employees.
Data Controller
The organisation storing and controlling such information (i.e., the federation is referred to as the Data Controller.
Processing
Processing data involves any activity that involves the use of personal data. This includes but is not limited to: obtaining, recording or holding data or carrying out any operation or set of operations on that data such as organisation, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transmitting or transferring personal data to third parties.
Automated processing
Any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, in particular to analyse or predict aspects concerning that individual’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
An example of automated processing includes profiling and automated decision making. Automatic decision making is when a decision is made which is based solely on automated processing (without human intervention) which produces legal effects or significantly affects an individual. Automated decision making is prohibited except in exceptional circumstances.
Data Protection Impact Assessment (DPIA)
DPIAs are a tool used to identify risks in data processing activities with a view to reducing them.
Criminal records information
This refers to personal information relating to criminal convictions and offences, allegations, proceedings, and related security measures.
Approved by:
Governing Body
Date:
17th September 2024
Last reviewed on:
August 2024
Next review due by:
August 2025