V10 May 2022
Data Protection Act 2018 and
General Data Protection Regulation Privacy Notice
Burbage Primary School
Please read this notice carefully. It contains important information to help you to understand what data we collect, why we need it and how we process store and secure it.
The categories of pupil information that we collect, hold and share include:
Personal information (such as name, unique pupil number, address, relevant medical information)
Characteristics (such as ethnicity, language, nationality, country of birth and free school meal eligibility)
Attendance information (such as sessions attended, number of absences and absence reasons)
Information and data specific to educational attainment, progress and assessment
Special educational needs information
Exclusions / behavioural information
We collect and hold personal information relating to our pupils and may also receive information about them from their previous school, local authority and/or the Department for Education (DfE). We use this personal data to:
support our pupils’ learning
monitor and report on their progress
provide appropriate pastoral care
assess the quality of our services
to comply with the law regarding data sharing
The lawful basis on which we use this information
Lawful Basis for Processing
The six lawful bases for processing are set out in Article 6 of the GDPR. In school we use the following basis for processing the information we hold about your child:
(a) Consent: the individual has given clear consent for us to process their personal data for a specific purpose
This includes data under Article 9 – Processing special categories of data requiring specific consent (such as biometric information, health and sexual orientation)
(b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
For example, this may apply when pupils are referred to a third party for counselling / specialist support
(c) Legal obligation: the processing is necessary for us to comply with the law (not including contractual obligations).
For example, the school may be required to pass on information to the police in relation to a suspected crime.
(d) Vital interests: the processing is necessary to protect someone’s life.
For example, the school may need to pass on information to provide students with emergency medical care or in relation to safeguarding concerns.
(e) Public task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law.
The school has a need to process personal data to meet with the government’s statutory (legal requirement) to offer education to students.
(f) Legitimate interests: the processing is necessary for our legitimate interests.
To ensure your child’s information is kept safe we have the following controls in place:
a) the information will not be used for any purpose other than those stated in this notice
b) the information will be held within secure systems/locations, with appropriate levels of security, that comply with relevant data protection legislation
c) the information will only be shared for lawful purposes and with an appropriate level of security that complies with relevant data protection legislation
d) the information will only be held for the periods agreed in our Record Retention Policy and Schedule, after which it will be securely destroyed. (This includes electronic records) Our Record Retention and Schedule can be found online at:
e) the information will be held, used and shared in accordance with current legislation and the General Data Protection Regulation (GDPR) from 25 May 2018.
We will not give information about our pupils to anyone without your consent unless the law and our policies allow us to do so.
Collecting pupil information
Whilst the majority of pupil information you provide to us is mandatory, some of it is provided to us on a voluntary basis. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain pupil information to us or if you have a choice in this.
Who we share pupil information with
We routinely share pupil information with:
Other schools that pupils progress to.
Our local authority: Derbyshire County Council services (including: school health, NHS, multi-agency teams (MAT), safeguarding services, educational visit services (EVOLVE), school improvement services).
RM Integris – RM Unify (management information system)
ParentPay (processing and tracking school related payments)
Parent Hub (online communication)
ITrack (pupil assessment data)
Wonde/Groupcall (data processors to transfer data to third party providers)
Perspective Lite (data processors to transfer data to Derbyshire County Council)
Purple Mash (online learning site)
Phonics Play (online teaching and learning service)
Spelling Tutor (online teaching and learning service)
Times Table Rockstar (online teaching and learning service)
My Maths (online teaching and learning service)
Spag.com (online assessment service)
Spellzone (online teaching and learning service)
Tapestry (online learning journal service for Early Years Foundation Stage pupils)
CPOMS (online safeguarding service)
Seesaw (online teaching and learning service)
Pearson Curriculum – including Abacus / Active Learn / Bug Club / Maths Flex / Power Maths / Maths Factor (online teaching and learning service)
Social Media (Facebook and Twitter)
Twinkl (online teaching and learning service)
Nessy (online teaching and learning service)
Doodle (online teaching and learning service)
My Child’s Art (artwork provider for Christmas cards etc)
Active Photographic (professional photographer providing individual/class and staff photographs)
Microsoft Outlook 365
Passtab (online pupil/staff/visitor signing in/out system)
Scratch (online system providing programming resources)
Department for Education (DfE)
Data collection requirements:
To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go to
The National Pupil Database (NPD
The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes.
This information is securely collected from a range of sources including schools, local authorities and awarding bodies.
We are required by law, to provide information about our pupils to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013.
To find out more about the NPD, go to https://www.gov.uk/government/publications/national-pupil-database-user-guide-and-supporting-information
The department may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:
conducting research or analysis
providing information, advice or guidance
The Department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:
who is requesting the data
the purpose for which it is required
the level and sensitivity of data requested: and
the arrangements in place to store and handle the data
To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.
For more information about the department’s data sharing process, please visit: https://www.gov.uk/data-protection-how-we-collect-and-share-research-data
For information about which organisations the department has provided pupil information, (and for which project), please visit the following website:
To contact DfE: https://www.gov.uk/contact-dfe
Requesting access to your personal data
Under data protection legislation, parents and pupils have the right to request access to information about them that we hold. To make a request for your personal information, or be given access to your child’s educational record, please see the contact at the end of this notice.
You may also use these contacts details to:
object to processing of personal data that is likely to cause, or is causing, damage or distress
prevent processing for the purpose of direct marketing
object to decisions being taken by automated means
in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed;
discuss the content of this privacy notice; and
claim compensation for damages caused by a breach of the Data Protection regulations
If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner’s Office at https://ico.org.uk/concerns/
Burbage Primary School
firstname.lastname@example.org Tel No: 01298 22278