Skip to main content

School privacy notice

Being transparent and providing accessible information to individuals about how we use personal information is a key element of the Data Protection Act 2018 and the General Data Protection Regulation.

What Information are we processing about you?

The Council is collecting the following pupil level data:

  • Student family name
  • Student given name
  • Student given name 2
  • Date of birth
  • Gender
  • Student address detail
  • Student attendance
  • Student exclusions
  • Student chosen family name
  • Student chosen given name
  • First language
  • Former UPN
  • Gifted and talented flag
  • Home language
  • Medical flag
  • National Curriculum Year
  • Part Time
  • Religion
  • Student ethnicity
  • Unique Learner Number
  • Unique Pupil Number
  • Student looked after details
  • Student SEN history
  • Student service family
  • Student Traveller Family History

Why do we need it?

The data is being collected from schools and academy trusts to enable the Council to monitor key education measures to ensure it meets its statutory duty to promote the effective participation in education and training of children and young people in the city.

What is the Lawful basis for processing the information?

The information being collected is being processed under the lawful basis of Public Task. The processing is necessary for the local authority and schools to perform a task for their official functions.

  • Section 13 Education Act 1996
  • Section 10 Education and Skills Act 2008

Information sharing

To ensure that the council provides you with an efficient and effective service we will sometimes need to share your information between teams within the council as well as with our partner organisations that support the delivery of the service you may receive. In this case, the information collected will be shared with:

  • Teams within Education, Participation and Skills
  • Children’s Social Care where necessary
  • Relevant Local Authority staff where elements of this data set are included in various reports
  • Relevant NHS teams to ensure that essential health services are received

We will only ever share your information if we are satisfied that our partners or suppliers have sufficient measures in place to protect your information in the same way that we do. We will never share your information for marketing purposes.

How long do we keep your data?

We will only keep your information for as long as is mandated under the council retention scheme and the national guidelines on data for vulnerable children.

Principles for processing personal information

As a local authority, the council delivers services to you. To do this in an effective way we will need to collect and use personal information about you.

The Data Protection Act 2018 and the UK General Data Protection Regulation ensure that we comply with a series of data protection principles. These principles are there to protect you and they make sure that we:

  • Process all personal information lawfully, fairly and in a transparent manner.
  • Collect personal information for a specified, explicit and legitimate purpose.
  • Ensure that the personal information processed is adequate, relevant and limited to the purposes for which it was collected.
  • Ensure the personal information is accurate and up to date.
  • Keep your personal information for no longer than is necessary for the purpose(s) for which it was collected.
  • Keep your personal information securely using appropriate technical or organisational measures.

Your rights

You have certain rights under the Data Protection Act 2018 and the UK General Data Protection Regulations (GDPR), these are:

  • The right to be informed via privacy notices such as this.
  • The right of access to any personal information the council holds about you.
  • The right of rectification, we must correct inaccurate or incomplete data within one month.
  • The right to erasure. You have the right to have your personal data erased unless we are processing your data on the basis of a legal obligation or for the purposes of a public task.
  • The right to restrict processing. You have the right to the suppression of your personal data. We can retain just enough information about you to ensure that the restriction is respected in future.
  • The right to data portability. Depending on the basis of our processing we can provide you with your personal data in a structured, commonly used, machine readable form when asked.
  • The right to object. This is dependent on the purpose and basis for our processing.
  • You have rights in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

Processing your information for other reasons

We may need to process or share your information for a legal reason, outlined in the Data Protection Act, which is not related to the service we are providing, for example:

  • To protect a child, an adult with care and support needs, or member of the public
  • For the purposes of the prevention and/or detection of crime.
  • For the assessment or collection of a tax or duty
  • Where the disclosure is directed by the court or required by law
  • Your information will only be shared where we have a lawful basis for doing so.

Details of transfers to third country and safeguards

Your personal and sensitive data will only be stored and processed on servers based within the United Kingdom.

Special categories of personal data

The Council will only process special categories of data (also known as sensitive data) about you where we are legally obliged to do so or are authorised to do so in law. Where we process your special categories of data in relation to our statutory duty to promote the effective participation in education and training of children and young people in the city, additional safeguards, as described in the Appendix to the Council’s Data Protection Policy, will be in place to protect your information.

The lawful basis for processing your personal data:

Public task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law.

The additional condition for processing your special category data:

  • Reasons of substantial public interest
    • Statutory etc. and government purposes

Data Controller

Plymouth City Council is registered as a data controller with the Information Commissioner's Office (registration number: Z7262171).

For any concerns or enquiries the contact details for the Council's data controller are:
Data Protection Officer, Plymouth City Council, Ballard House, West Hoe Road, Plymouth PL1 3BJ.


Information Commissioners Office

If you remain dissatisfied with the way we have handled or shared your personal data you have the right to raise a complaint with the Information Commissioner’s Office. They can be contacted at:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Tel: 0303 123 1113