Good information handling provides a range of benefits as well as helping you to comply with the Data Protection and Freedom of Information Acts.
Our information rights checklist lists the benefits and risks, along with practical suggestions for how to be open and responsible. And it shows you how to get it right first time.
- We have produced a set of lesson plans for primary and secondary schools, developed by teachers and tailored to the national curriculum.
- The ICO has produced advice aimed at young people.
- We also produce a lot of publications for organisations and individuals. You can request publications from the ICO here.
Data protection – looking after the information you hold about pupils and students
If you handle and store information about identifiable, living people – for example, about school pupils – you are legally obliged to protect that information. Under the Data Protection Act, you must:
- only collect information that you need for a specific purpose;
- keep it secure;
- ensure it is relevant and up to date;
- only hold as much as you need, and only for as long as you need it; and
- allow the subject of the information to see it on request.
Find out about your data protection obligations.
Your pupils and students have rights to see their personal information. They can make a subject access request to see the personal information you hold about them. They – and their parents – also have the right to see their educational records.
- Find out how to respond to requests for information about school records (pdf)
- Find out your obligations regarding the storing and release of any references (pdf)
Helping schools meet their data protection obligations - in plain English
Working with nine different local authorities in England and Wales, we asked over 400 schools to complete a data protection questionnaire. The ICO then used the results of the questionnaire to produce a report indicating areas for improvement and areas of good practice, and giving practical advice on the application of the Data Protection Act.
- Read our report detailing data protection advice for schools (Clear English Standard) (pdf)
- Read a summary of the report (pdf)
The use of biometrics in schools
The Protection of Freedoms Act 2012 places controls on the use of biometric systems in schools, for example for cashless catering or borrowing library books. The provisions in the Act will take effect from 1 September 2013, and the Department for Education (DfE) has advised schools to start planning for this implementation date. The DfE has produced guidance on the requirements of the Act.
Registering with the ICO
If you handle personal information, you may need to register with us as a data controller. Notification is a statutory requirement and every organisation that processes personal information must notify the ICO, unless they are exempt. Failure to notify is a criminal offence.
As an employer, you are obliged to protect your employees’ personal information.
- Employment topic guide
- Quick guide to the employment practices code (pdf)
- Subject access code of practice (pdf)
Individuals have the right to see their examination results – see our guidance on the responding to subject access requests.
If you intend to publish exam results in the media, you must inform your pupils and students first. Read our guidance about the publication of exam results by schools.
Taking photos in schools
The Data Protection Act does not prevent parents and teachers from taking photos of events such as the Christmas play or sports day – asking permission to take photos is normally enough to ensure compliance. Read our guidance on taking photos in schools.
We have commissioned some research about young people and data protection. Our most recent research is about young people’s views of privacy in relation to social networking.
Freedom of information – making public information available
If the educational establishment you work in is a public authority, the Freedom of Information Act means you must produce a publication scheme, which outlines the information you will routinely make available to the public - such as minutes of meetings, annual reports or financial information.
What information do we need to publish?
Read our guide to freedom of information to find out what information you need to publish.
We've also provided definition documents:
- Colleges of further education (pdf)
- Schools in England (pdf)
- Schools in Northern Ireland ((pdf)
- Schools in Wales (pdf)
- Universities (pdf)
Template guide to information for schools (doc)
Welsh language version (doc)
How to complete the guide to information for schools (pdf)
Welsh language version (pdf)
The Freedom of Information Act also means you must disclose official information when people ask for it (unless there is a good legal reason for you not to), and you must reply within 20 working days.
Freedom of information and research information
The ICO has produced guidance on freedom of information legislation and research information, specifically for the higher education sector.
ICO Higher Education Sector panel on freedom of information
The ICO meets representatives from the Higher Education Sector on a regular basis to discuss information rights within the sector. We will publish our meeting notes of these discussions.
- Meeting note – 26 September 2013 (pdf)
- Datasets presentation – 26 September 2013 (pdf)
- Meeting note – 24 September 2012 (pdf)
- Meeting note – January 2012 (pdf)
- Meeting note – September 2011 (pdf)
- Meeting note – 12 July 2011 (pdf)
- Meeting note – 24 May 2011 (pdf)
- Meeting note – 13 April 2011 (pdf)
- Meeting note – 27 January 2011 (pdf)
- Meeting note – 29 September 2010 (pdf)