The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.


Good information handling provides a range of benefits as well as helping you to comply with the Data Protection and Freedom of Information Acts.

Our information rights checklist lists the benefits and risks, along with practical suggestions for how to be open and responsible. And it shows you how to get it right first time.

Information rights video for schools

We have produced a video aimed at headteachers, deputy headteachers, school business managers and school governors. It discusses both data protection and freedom of information, focusing on the areas we think are the most relevant for schools.

It includes key points covering the data protection principles, fair processing, security, disposal, policies, subject access requests, sharing, websites, photographs, CCTV, training, publication schemes, and responding to a FOI request.

You can also view the video on YouTube.

Education resources

Data protection – looking after the information you hold about pupils and students

If you handle and store information about identifiable, living people – for example, about school pupils – you are legally obliged to protect that information. Under the Data Protection Act, you must:

  • only collect information that you need for a specific purpose;
  • keep it secure;
  • ensure it is relevant and up to date;
  • only hold as much as you need, and only for as long as you need it; and
  • allow the subject of the information to see it on request.

Find out about your data protection obligations.

Your pupils and students have rights to see their personal information. They can make a subject access request to see the personal information you hold about them. They – and their parents – also have the right to see their educational records.

Helping schools meet their data protection obligations - in plain English

Working with nine different local authorities in England and Wales, we asked over 400 schools to complete a data protection questionnaire. The ICO then used the results of the questionnaire to produce a report indicating areas for improvement and areas of good practice, and giving practical advice on the application of the Data Protection Act.

The use of biometrics in schools

The Protection of Freedoms Act 2012 places controls on the use of biometric systems in schools, for example for cashless catering or borrowing library books. The provisions in the Act will take effect from 1 September 2013, and the Department for Education (DfE) has advised schools to start planning for this implementation date. The DfE has produced guidance on the requirements of the Act.

Registering with the ICO

If you handle personal information, you may need to register with us as a data controller. Notification is a statutory requirement and every organisation that processes personal information must notify the ICO, unless they are exempt. Failure to notify is a criminal offence.

Find out if you need to register


As an employer, you are obliged to protect your employees’ personal information.


Individuals have the right to see their examination results – see our guidance on the responding to subject access requests.

If you intend to publish exam results in the media, you must inform your pupils and students first. Read our guidance about the publication of exam results by schools.

Taking photos in schools

The Data Protection Act does not prevent parents and teachers from taking photos of events such as the Christmas play or sports day – asking permission to take photos is normally enough to ensure compliance. Read our guidance on taking photos in schools.


We have commissioned some research about young people and data protection. Our most recent research is about young people’s views of privacy in relation to social networking.

Freedom of information – making public information available

If the educational establishment you work in is a public authority, the Freedom of Information Act means you must produce a publication scheme, which outlines the information you will routinely make available to the public - such as minutes of meetings, annual reports or financial information.

What information do we need to publish?

Read our guide to freedom of information to find out what information you need to publish.

We've also provided definition documents:

The Freedom of Information Act also means you must disclose official information when people ask for it (unless there is a good legal reason for you not to), and you must reply within 20 working days.

Find out more about your freedom of information obligations.

Freedom of information and research information

The ICO has produced guidance on freedom of information legislation and research information, specifically for the higher education sector.

ICO Higher Education Sector panel on freedom of information

The ICO meets representatives from the Higher Education Sector on a regular basis to discuss information rights within the sector. We will publish our meeting notes of these discussions.