How we use pupil information

We collect and hold personal information relating to our pupils and may also receive information about them from their previous school, local authority and/or the Department for Education (DfE) or the Diocese. Our Privacy Notice below establishes how and why we use your data.

This information will include their contact details, national curriculum assessment results, attendance information, any exclusion information, where they go after they leave us and personal characteristics such as their ethnic group, any special educational needs they may have as well as relevant medical information. We will only ever ask you for information that is relevant and is necessary to support your child in school, you may refuse to give us certain information. All information is stored securely in school and is not taken off site by staff.

We will not give information about our pupils to anyone without your consent unless the law and our policies allow us to do so. If you want to receive a copy of the information about your son/daughter that we hold, please contact:

• Mrs Maxwell – Office Manager/Data Protection Oversight with HT

We are required, by law, to pass certain information about our pupils to our local authority (LA), the Department for Education (DfE) and the Diocese. The DfE may also share pupil level personal data that we supply to them, with third parties. This will only take place where legislation allows it to do so and it is in compliance with the Data Protection Act 1998 and principles of GDPR.

Decisions on whether DfE releases this personal data to third parties are subject to a robust approval process and are based on a detailed assessment of who is requesting the data, the purpose for which it is required, the level and sensitivity of data requested and the arrangements in place to store and handle the data.

To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.

For more information about the department’s data sharing process, please visit: https://www.gov.uk/data-protection-how-we-collect-and-share-research-data  

For information about which organisations the department has provided pupil information, (and for which project), please visit the following website: https://www.gov.uk/government/publications/national-pupil-database-requests-received

How we deal with data protection complaints at OLOL

Data protection law says that OLOL must:

• give people a way of making data protection complaints to us and how we manage data
• acknowledge receipt of complaints within 30 days of receiving them
• without undue delay, take appropriate steps to respond to complaints, including making appropriate enquiries, and keep people informed
• without undue delay, tell people the outcome of their complaints

If you believe that we have infringed data protection legislation because of the way we have handled your personal information (or the personal information of a child you are acting on behalf of), you are allowed to complain to us.

In order to complain, you don’t have to use legal terms or quote sections of the legislation.

People may submit complaints about:

• the way we have responded to a subject access request (SAR), or other rights request
• the security measures we use to store information (e.g. someone who has been impacted by a data breach, regardless of whether it’s reportable to us) or
• how we have collected or used your personal information (e.g. where we have stored it, how long we have kept it for, or its accuracy)

Sometimes people may complain about our service or other matters, whilst also exercising their data protection rights. This doesn’t count as a data protection complaint and would be handled using the normal complaint process.

We will confirm the identity of anyone making a data protection complaint for themselves and will verify the right to complain of anyone who claims to be representing someone else in a complaint of this nature. 

What will we do?

If we receive a complaint we will:

• Confirm the identity of the complainant
• Acknowledge the complaint within 30 days (day 1 is the day after the complaint is received)
• Gather all relevant information from the complainant and staff/pupils in school
• Investigate the complaint, keep a record of all actions taken and keep the complainant informed of any undue delay
• Provide the complainant and Governors with the outcome of the complaint (if the outcome is completed within 30 days the complainant may receive the acknowledgement and outcome at the same time)
• Share any resolutions or actions we have or will be taking
• Advise you of your right to complain to the ICO should you wish to do so