Hampshire and Isle of Wight Educational Psychology Service (parent/carer)

Privacy Notice


Hampshire and Isle of Wight Educational Psychology (HIEP) respects your privacy and is committed to protecting your personal data. Please read this Privacy Notice carefully – it describes why and how we collect and use personal data and provides information about your rights. It applies to personal data provided to us, both by individuals themselves or by third parties and it supplements the Hampshire County Council generic Privacy Notice.

Hampshire County Council is the data controller for the purposes of the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR). We keep this Privacy Notice under regular review.

About us

Hampshire & Isle of Wight Educational Psychology (HIEP) works to ensure partnership with parents and carers at all stages of our work in line with our professional codes of conduct and ethics and also in line with the ethos of the SEN Code of Practice (DfE & DoH, 2014). All of our educational psychologists (EPs) are registered with the Health and Care Professions Council (HCPC) and our work is underpinned by their standards of conduct, performance and ethics. EPs hold qualifications that give them eligibility for chartered status with the British Psychological Society (BPS).

Working within the team, we also have trainee educational psychologists and psychologists who are in the process of registering with the HCPC (following completion of the doctorate programme in educational psychology). All team members who are not yet eligible for registration with the HCPC are supervised by an HCPC registered educational psychologist.

Why we collect this information

HIEP collects information about you and your child in order to:

  • keep in contact with you about our work with your child
  • keep a record of the time and nature of HIEP involvement with you and your child and the impact that it has had
  • inform our assessment of your child’s needs and, in turn, inform any ongoing work with you and/or your child and/or their educational setting
  • undertake wider County Council statutory duties in support of your child’s education and welfare
  • monitor and evaluate the impact of the services provided for your child individually and across the breadth of work offered to ensure that a high quality, accessible service is provided in line with professional standards
  • ensure compliance with our obligations under the accuracy principles of the UK General Data Protection Regulation (Article (5)(1)(d)), making sure our records about you and your family are up-to-date.

The following sections provide further detail around the information we process setting out what allows us to do this (lawful basis), who we may share it with, how long we keep it for (the retention period), alongside identifying any rights you may have and who to contact if you think we are not handling your information in the right way.

The categories of information that we collect, hold and share

When we have agreed to be involved with your child, you will be asked to complete a Consent Form. You may also be asked to complete a ‘Request for Further Information Form’. After you have given consent, we will collect and hold the following personal and special category personal data:

  • your child’s personal information (such as name, date of birth, address, early years’ setting/school/college)
  • information about your child’s characteristics (such as their Special Educational Need(s)/Disability, gender, ethnicity, home language) and medical information
  • information about your child’s education (such as school attendance figures, previous and current academic reports, pastoral feedback from settings and schools, reports from other professionals)
  • your personal information (such as name, address, email, telephone number)
  • your and/or your child’s views about their progress, the EP’s work and its impact

Sometimes after we have been involved with your child, we may approach you to ask your views or to provide feedback about HIEP and the service we have provided to you as part of a whole service evaluation. On occasion, we may share a link to an online survey (if you have given consent, using your email address) and seek your views about the service through asking you to provide ratings and comments. These activities are optional and you would not have to complete any surveys or provide other feedback if you didn’t want to. If you did choose to take part, we would not ask directly for your or your child’s name or date of birth as the information and views provided would only be used to help us to explore which parts of our service are working well and what can be improved. Your views would be collated with the views of other parents/carers and the findings summarised. Although direct quotes may be used in reports, in presentations or on the HIEP website, no-one would be able to identify any child, family or school from any of the above.

A second type of involvement is where you yourself are receiving training or support from a HIEP EP. In this case, you will be provided with specific information about the training or support and about how any data you provide will be processed.

As HCPC registered educational psychologists, we respect confidentiality and your right to privacy. In our professional role, sometimes it is helpful to share relevant, necessary and proportional information about a child with other professionals in Education, Health and Children’s Social Care, for example, talking to a teacher about our assessment or talking to a speech and language therapist where they are also involved with your child.

On occasion, we may have a duty, by law, to share information with other teams in the County Council, for example, with the:

  • Children Missing Education Team (for ensuring the provision of full time education)
  • Data Protection Team (for personal data incidents)
  • Virtual School (for support of children currently and previously looked after)
  • Social Care teams (supporting welfare, safeguarding and corporate parent functions)
However, as above, any information shared will be necessary, relevant and proportional to the lawful basis and activity being undertaken. We may also share information through the County Council’s role in the Hampshire Safeguarding Children Partnership (HSCP) to comply with their statutory duties.

The lawful basis on which we process this information

For children and young people where we are involved on an individual basis, we collect and use the information, ensuring that we comply with the UK GDPR and the Data Protection Act 2018 (DPA 2018) requirements for processing personal data through:

  • Article 6(1)(c) - the processing is necessary for compliance with a legal obligation to which the controller is subject
  • Article 6(1)(e) - the processing is necessary to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law.

And Special Category Personal Data through:

  • Article 9(g) - the processing is necessary for reasons of substantial public interest
  • Schedule 1, paragraph 6 of the Data Protection Act (2018)

These articles under the UK GDPR and DPA (2018) are supported by the following specific legislation

  • Part 3 of the Children and Families Act 2014 and associated guidance
  • The Special Educational Needs and Disability Regulations 2014
  • The Equality Act (2010).

Under these lawful bases we do not require your consent to process or share this information, but we are required, through this privacy notice, to ensure you are fully informed of why we are collecting this information and what we will do with it.

We will seek your consent for involvement with your child through our Consent Form, unless this is an assessment under the Children and Families Act (2014). You may withdraw your consent for educational psychology involvement by contacting the service directly. 

The information you provide will be entered into our service’s secure system (SharePoint) to create an electronic record. We will store and protect this information in line with the County Council’s data retention strategy for the Children’s Services Department. Our systems are hosted in secure UK based data centres. Appropriate security measures are in place to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

A paper based working file is kept on site and when not in use is kept in a secure/locked storage unit. The information held within the working file is kept securely in line with the County Council’s established retention schedule before being disposed of as appropriate.

The County Council takes its data security responsibilities seriously and has policies and procedures in place to ensure any personal data held by us is:

  • prevented from being accidentally or deliberately compromised
  • accessed, altered, disclosed or deleted only by those authorised to do so
  • accurate and complete in relation to why we are processing it
  • continually accessible and usable with daily backups
  • protected by levels of security appropriate to the risks presented by our processing

The County Council also ensures its IT Department is certified to the internationally recognised standard for information security management, ISO27001.

Requesting access to your personal data and your rights

Under data protection legislation, individuals have the right to request access to information that we hold about them. To make a request for your personal information, or someone you have responsibility for, please contact the Children’s Services Department’s Subject Access Request (SAR)

You also have the right to:

  • prevent processing for the purpose of direct marketing
  • in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed.

Please note that under the UK GDPR, there is also a right to erasure but the right to erasure does not provide an absolute ‘right to be forgotten’. Where the data being processed is for the purpose of ‘performing a task in the public interest or for our official functions, and the task or function has a clear basis in law’ (Article 6(1)(e))’, this right does not automatically apply.

Indirect involvement

As part of their everyday work, HIEP educational psychologists also train and support schools and other settings to deliver a range of interventions. This is sometimes called 'indirect involvement' as we are not directly involved with the children and young people themselves but are working with the adults supporting them. In this type of work, it would be the staff in the setting who identify students to take part in an intervention, liaise with you as parents/carers, provide the interventions and assess the children’s progress. However, it is important that HIEP evaluates these interventions to ensure that they are working and are helpful to children and young people across Hampshire and the Isle of Wight, promoting their progress and wellbeing. The psychologist, although training and supporting staff, will not be involved directly with your child and so will not hold information about them, for example their name or date of birth.

We may however seek anonymous information from schools and other settings about the progress made by individual children and young people through these interventions. In this case, we would ask the setting to provide a code for any data rather than using children’s names as we would not want to know which children were involved or to receive identifiable information about them. As this data would be anonymous it would not fall under the UK GDPR and the Data Protection Act (2018). However, we will ensure that schools and other settings seek your consent before sharing any anonymous data with the service.

Further information

The above information is the specific privacy notice for this service. For more information about your rights in relation to your personal data, see the County Council’s general privacy notice.

You have some legal rights in respect of the personal information we collect from you. See our Data Protection page for further details.

You can contact the County Council’s Data Protection Officer by email [email protected].

If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner’s Office.