Privacy notice templates

For use in schools and Children's Services

A privacy notice is issued to staff, children and their families, to meet the requirements of the Data Protection Act (1998).

The notice summarises the information collected, why it is held, and the third parties to whom it may be passed on.

Purpose of privacy notices (previously called fair processing notices)

The Data Protection Act requires that data is only shared with the data subject (or their parents/carers in the case of children under 13), unless the data subject has given permission to share.

The law may also require that the information is shared. Permissions and legal requirements often change according to the service being used. There are different privacy notices for each type of service and/or data collection.

For general information on privacy policies, please see the Information Commissioner's guidance.

Privacy notice templates

Suggested privacy notices for schools and local authorities to issue to staff, parents and pupils about the collection of data.

Schools are their own data controller in the eyes of the law. They develop their own policies and documentation to comply with the Data Protection Act. The templates support schools to develop their own privacy notices. Schools need to be aware of the information they collect and wish to share or use about staff, children and their parents outside of the normal reasons for collection, for example:

  • emailing electronic school newsletters
  • sharing contact details of parents within a class, for example help to arrange birthday parties for younger pupils
  • sharing with parent teacher groups to help arrange unofficial school events, such as discos and fundraising activities
  • sharing across the Local Children’s Partnership for more vulnerable children
  • sharing across a school consortia
  • sharing contact details for governors
There are statutory requirements for schools to exchange information about staff, parents and children:
  • school workforce census
  • pupil level censuses
  • school travel surveys, forces children census etc
  • Youth Service (was Connexions service) data exchange (in year 8)
  • information exchanged when moving between schools
  • exam entries and results
These are apart from the standard reasons mentioned in the Data Protection Act of:
  • protecting vulnerable individuals
  • the prevention and detection of crime

Schools should include copies of their privacy notices in enrolment documentation (as a minimum). This should include a link to their privacy policy at the bottom of forms that collect personal information. It is good practice to send regular reminders of privacy notices through:

  • articles in newsletters
  • school web pages
  • notices in the reception area

Many schools used to send out fair processing notices at the start of each academic year. These often linked to an annual data collection to ensure that the information held about pupils is correct. Schools can do the same with privacy notices if they wish.

At the start of year 8, schools need to make parents and pupils aware of their right to opt out from providing information to the Integrated Youth Service under the Learning and Skills Act 2000 through a privacy notice, a message in a school newsletter or other suitable means. Schools should ensure that the message reaches both the pupils and their parents.

At the age of 13, children are assumed, for most purposes, to have rights over their own information. They need to be aware of privacy notices and their rights to see their own record.

Schools may personalise the Example Privacy Notices to their own requirements.

The text in the outline privacy notice for parents/pupils that relates to the work of the Integrated Youth Service and the Learning Records Service is only necessary for secondary schools.

As well as the privacy notice, schools also need to ensure they have made details of any routine information sharing arrangements known to the individuals concerned. This can be done through the use of the school website, as part of the publication scheme or through advice by contacting a named individual at the school.

Early education and child care

The County Council provides an outline privacy notice for nurseries and child minders. This is updated every autumn and distributed as part of the census package.

Most provision in this sector is delivered through private providers. Many will wish to use the privacy notices belonging to their organisation. As with schools, the outline privacy notice is provided for advice only.

Social care

The Department for Education has a data collection that requires an extra privacy notice for all young people having a referral to social care as a Child in Need. This privacy notice is mandatory for use within Children’s Services and should be provided:

  • to the child (if deemed Fraser/Gillick competent, normally aged 13) and
  • their family at the first suitable meeting with social care after the referral
Youth Service

Personal advisers should explain the Youth Service privacy policy to young people at their first meeting. A copy of the privacy policy leaflet will also be provided. This includes details of the privacy notice and how to collect their consent to the sharing of information about themselves.

For further information please contact the Children’s Services Data Protection lead by email