Skip to content ↓

Data protection and information

Trust-wide policy. Adopted: October 2016

1 Introduction

The Inspiration Trust collects and uses personal information about staff, pupils, parents and other individuals who come into contact with our academies. This information is gathered in order to enable us to provide education and other associated functions.

In addition, we are subject to certain legal requirements to collect, use, and share information to ensure that we comply with our statutory obligations.

The Trust also holds general organisational records, documents, and other material that relates to our work. These may be subject to public access under the Freedom of Information Act or the Environmental Information Regulations..

The Trust is registered with the Information Commissioner’s Office under the Data Protection Act on behalf of its academies. The Trust’s Head of Communication acts as data controller for the Trust, and is also the designated contact for requests under the Freedom of Information Act and Environmental Information Regulations.

2 Purpose

This policy is intended to ensure that personal information is dealt with correctly and securely and in accordance with relevant legislation. It also discharges statutory requirements related to non-personal information held by the Trust.

It applies to information regardless of the way it is collected, used, recorded, stored and destroyed, and irrespective of whether it is held in paper files or electronically.

All staff involved with the collection, processing and disclosure of personal and other data must be aware of their duties and responsibilities and adhere to these guidelines.

Failure to follow these guidelines may result in disciplinary action, or in some cases constitute a prosecutable offence.

3 Complaints

Complaints relating to access to information will be dealt with in accordance with the Trust’s complaints policy.

Complaints relating to requests under the Data Protection Act, Freedom of Information Act, or Environmental Information Regulations may be referred to the statutory regulator, the Information Commissioner.

4 Handling and disclosure of personal information

4.1 What is personal information?

Personal information or data is defined as data which relates to a living individual who can be identified from that data, or other information held.

4.2 Data protection principles

The Data Protection Act 1998 establishes eight enforceable principles that must be adhered to at all times:

  1. Personal data shall be processed fairly and lawfully;

  2. Personal data shall be obtained only for one or more specified and lawful purposes;

  3. Personal data shall be adequate, relevant and not excessive;

  4. Personal data shall be accurate and where necessary, kept up to date;

  5. Personal data processed for any purpose shall not be kept for longer than is necessary for that purpose or those purposes;

  6. Personal data shall be processed in accordance with the rights of data subjects under the Data Protection Act 1998;

  7. Personal data shall be kept secure i.e. protected by an appropriate degree of security;

  8. Personal data shall not be transferred to a country or territory outside the European Economic Area, unless that country or territory ensures an  adequate level of data protection.

4.3 General statement

The Trust is committed to maintaining the above principles at all times. Therefore we will:

  • inform individuals why the information is being collected when it is collected

  • inform individuals when their information is shared, and why and with whom it was shared

  • check the quality and the accuracy of the information it holds

  • ensure that information is not retained for longer than is necessary

  • ensure that when obsolete information is destroyed that it is done so appropriately and securely

  • ensure that clear and robust safeguards are in place to protect personal information from loss, theft and unauthorised disclosure, irrespective of the format in which it is recorded

  • share information with others only when it is legally appropriate to do so

  • set out procedures to ensure compliance with the duty to respond to requests for access to personal information, known as subject access requests

  • ensure our staff are aware of and understand our policies and procedures

4.4 Rights of access to personal information

4.4.1 Information about any individual

Under the Data Protection Act 1998 any individual has the right to make a request to access the personal information held about them. In certain circumstances, a parent or other representative may make a request on behalf of a child.

A fee of £10 may be charged per request. Additional charges may be made for copies of part of a pupil’s education record.

4.4.2 Information about pupils

Under the Education (Independent School Standards) (England) Regulations 2010 parents have the right to receive an annual written report about their child. In practice, our academies will share information more frequently to help support pupils’ education through written reports, parents’ evenings, and the like.

As academies, the Education (Pupil Information) (England) Regulations 2005 do not apply to our schools. Instead, pupils or parents acting on their behalf may request information under the Data Protection Act.

Under the Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000, a fee of up to £50 may be charged for printed copies of part of a pupil’s education record.

4.5 Making and handling data protection requests

4.5.1 When to make a request

In many circumstances, information may be shared informally as part of the normal working relationship between academies and families, or between staff and employer.

When considering such requests Trust staff should be mindful of the data protection principles and consider whether disclosing information would be considered fair processing for a proper purpose.

4.5.2 Making a request

Formal requests for information must be made in writing, which includes email. There is no need to use a specific form.

Requests relating to pupils should be made in the first instance to the academy they attend; requests relating to staff should be made to the Trust’s central Human Resources department.

Once received, all requests must be forwarded promptly to the Trust’s Head of Communication for validation and processing.

A fee may be payable for fulfilling a request. If required, the requester will be asked to provide this.

4.5.3 Handling a request

4.5.3.1 Establishing identity

The identity of the requestor must be established before the disclosure of any information; in the case of a parent or member of staff they may already be well known to the Trust or academy staff. Where relevant, checks should also be carried out regarding proof of relationship to the child. Evidence of identity can be established by requesting production of:

  • passport

  • driving licence

  • utility bills with the current address

  • birth certificate

  • P45/P60

  • credit card or mortgage statement

4.5.3.2 Consent for disclosing information about a child

Any individual has the right of access to information held about them. However with children, this is dependent upon their capacity to understand (normally age 12 or above) and the nature of the request.

The principal should be asked to discuss the request with the child; a child with competency to understand can refuse to consent to the request for their records. Where the child is not deemed to be competent an individual with parental responsibility or guardian shall make the decision on behalf of the child.

4.5.3.3 Handling charges

A charge of £10 will normally be made for the handling of each request. Where the information requested includes part of a child’s educational record a charge of up to £50 may be made for printed copies, dependent on the number of pages.

4.5.3.4 Timescales for dealing with a request

The response time for subject access requests, once officially received, is 40 calendar days. However the 40 days will not commence until after receipt of fees or clarification of information sought.

4.5.3.5 Exemptions when disclosing information

The right to access relates to information, not documents, so the Trust is not generally obliged to provide copies of original documents - only the relevant information within them.

The Data Protection Act 1998 allows exemptions as to the provision of some information. Any information which may cause serious harm to the physical or mental health or emotional condition of the subject or another should not be disclosed, nor should information that would reveal that an individual is at risk of abuse, or information relating to court proceedings.

Where information has provided by the police, local authority, health care professional or another school, their advice should normally be obtained before disclosing the information.

Where redaction (information blacked out/removed) has taken place then a full copy of the information provided should be retained privately by the Trust in order to establish, if a complaint is made, what was redacted and why.

4.5.3.6 Providing meaningful information

Information disclosed should be clear, thus any codes or technical terms will need to be clarified and explained. If information contained within the disclosure is difficult to read or illegible, then it should be retyped.

It may be useful for information to be provided at a face to face meeting, with a relevant member of staff on hand to help and explain matters if requested, or provided at face to face handover.

The views of the applicant should be taken into account when considering the method of delivery. If sent by post, a signature must be obtained on delivery.

5 Handling and disclosure of non-personal information

5.1 Rights of access to non-personal information

The Trust is a public authority for the purposes of the Freedom of Information Act, and as such the public have a general right of access to information held by the Trust, subject to certain exemptions.

The Trust is also required to adopt a publication scheme, setting out information it will pro-actively publish.

The Trust is also a public authority for the purposes of the Environmental Information Regulations, which gives access to environmental information.

5.2 Making and handling freedom of information requests

5.2.1 When to make a request

In many circumstances, information may be shared informally as part of the Trust’s normal working practices. Where more detailed or sensitive information is required it should be treated as a formal Freedom of Information request, or where relevant, a request under the Environmental Information Regulations..

Requests for information that includes the personal data of the applicant should be treated as a data protection subject access request, rather than under freedom of information provisions.

5.2.2 Making a request

Formal requests for information must be made in writing, which includes email. There is no need to use a specific form.

Requests may be made in the first instance to an academy or the Trust centrally. Once received, all requests must be forwarded promptly to the Trust’s Head of Communication for validation and processing.

A fee may be payable for fulfilling a request. Requests may be refused if complying with them would exceed processing limits set by legislation, or if the information is exempt from disclosure.

5.2.3 Handling a request

5.2.3.1 Handling charges

Where processing a Freedom of Information request would exceed the cost limits set by legislation, the Trust may refuse the request. In other cases, the Trust may charge disbursement costs as set out in our publication scheme.

For requests under the Environmental Information Regulations, the Trust will charge for reasonable staff time required to collate the information in addition to any disbursement costs, as set out in our publication scheme.

Where a charge is to be applied we will issue a fees notice and require payment prior to completing the request.

5.2.3.2 Timescales for dealing with a request

For schools, the standard time limit for a Freedom of Information request is 20 school days, or 60 working days if this is shorter. Requests should normally be processed within this time.

Under the Environmental Information Regulations, the limit is 20 working days or 40 working days for particularly complex requests.

5.2.3.3 Exemptions when disclosing information

The right to access relates to information, not documents, so the Trust is not generally obliged to provide copies of original documents - only the relevant information within them.

Both the Freedom of Information Act and Environmental Impact Regulations allow exemptions as to the provision of some information, such as where disclosing information would not be in the public interest.

Where information has provided by the police, local authority, health care professional or another school, their advice should normally be obtained before disclosing the information.

Where redaction (information blacked out/removed) has taken place then a full copy of the information provided should be retained privately by the Trust in order to establish, if a complaint is made, what was redacted and why.

5.2.3.4 Providing meaningful information

Information disclosed should be clear, thus any codes or technical terms will need to be clarified and explained. If information contained within the disclosure is difficult to read or illegible, then it should be retyped.

It may be useful for information to be provided at a face to face meeting, with a relevant member of staff on hand to help and explain matters if requested, or provided at face to face handover.

The views of the applicant should be taken into account when considering the method of delivery.

5.2.4 Freedom of Information Act publication scheme for academies

This generic model publication scheme has been prepared and approved by the Information Commissioner. It has been adopted by the Inspiration Trust.

The scheme commits the Trust:

  • To proactively publish or otherwise make available as a matter of routine, information, including environmental information, which is held by the authority and falls within the classifications below.

  • To specify the information which is held by the authority and falls within the classifications below.

  • To proactively publish or otherwise make available as a matter of routine, information in line with the statements contained within this scheme.

  • To produce and publish the methods by which the specific information is made routinely available so that it can be easily identified and accessed by members of the public.

  • To review and update on a regular basis the information the authority makes available under this scheme.

  • To produce a schedule of any fees charged for access to information which is made proactively available.

  • To make this publication scheme available to the public
     

5.2.4.1 Classes of information

  • Who we are and what we do:
    Organisational information, locations and contacts, constitutional and legal governance.

  • What we spend and how we spend it:
    Financial information relating to projected and actual income and expenditure, tendering, procurement and contracts.

  • What our priorities are and how we are doing:
    Strategy and performance information, plans, assessments, inspections and reviews.

  • How we make decisions:
    Policy proposals and decisions. Decision making processes, internal criteria and procedures, consultations.

  • Our policies and procedures:
    Current written protocols for delivering our functions and responsibilities.

  • Lists and registers:
    Information held in registers required by law and other lists and registers relating to the functions of the authority.

  • The Services we offer:
    Advice and guidance, booklets and leaflets, transactions and media releases. A description of the services offered.

The classes of information will not generally include:

  • Information the disclosure of which is prevented by law, or exempt under the Freedom of Information Act, or is otherwise properly considered to be protected from disclosure.

  • Information in draft form.

  • Information that is no longer readily available as it is contained in files that have been placed in archive storage, or is difficult to access for similar reasons.

5.2.4.2 The method by which information published under this scheme will be made available

The authority will indicate clearly to the public what information is covered by this scheme and how it can be obtained.

Where it is within the capability of a public authority, information will be provided on a website. Where it is impracticable to make information available on a website or when an individual does not wish to access the information by the website, a public authority will indicate how information can be obtained by other means and provide it by those means.

In exceptional circumstances some information may be available only by viewing in person. Where this manner is specified, contact details will be provided. An appointment to view the information will be arranged within a reasonable timescale.

Information will be provided in the language in which it is held or in such other language that is legally required. Where an authority is legally required to translate any information, it will do so.

Obligations under disability and discrimination legislation and any other legislation to provide information in other forms and formats will be adhered to when providing information in accordance with this scheme.

5.2.4.3 Charges which may be made for Information published under this scheme

The purpose of this scheme is to make the maximum amount of information readily available at minimum inconvenience and cost to the public. Charges made by the authority for routinely published material will be justified and transparent and kept to a minimum

Material which is published and accessed on a website will be provided free of charge.

Charges may be made for information subject to a charging regime specified by Parliament. Charges may be made for actual disbursements incurred such as:

  • photocopying

  • postage and packaging

  • the costs directly incurred as a result of viewing information

Charges may also be made for information provided under this scheme where they are legally authorised, they are in all the circumstances, including the general principles of the right of access to information held by public authorities, justified and are in accordance with a published schedule or schedules of fees which is readily available to the public.

If a charge is to be made, confirmation of the payment due will be given before the information is provided. Payment may be requested prior to provision of the information.

5.2.4.4 Written requests

Information held by a public authority that is not published under this scheme can be requested in writing, when its provision will be considered in accordance with the provisions of the Freedom of Information Act.

Requests should be made to the Head of Communications, Inspiration Trust, 28 Bethel Street, Norwich, NR2 1NR.

5.2.4.5 The method by which information published under this scheme will be made available

Information to be published

 

How the information can be obtained

Cost

Class 1 - Who we are and what we do

(Organisational information, structures, locations and contacts)

Who’s who in the school

Website

Free

Who’s who on the governing body / board of governors and the basis of their appointment

Website

Free

Instrument of Government / Articles of Association

Website

Free

Contact details for the principal and for the governing body, via the school

Website

Free

School prospectus

Website
Hard copy

Free

School session times and term dates

Website

Free

Address of school and contact details, including email address.

Website

Free

Class 2 – What we spend and how we spend it

(Financial information relating to projected and actual income and expenditure, procurement, contracts and financial audit)

Annual budget plan and financial statements

Website

Free

Capital funding

Website

Free

Financial audit reports

Website

Free

Governors’ allowances that can be incurred or claimed, and a record of total payments made to individual governors.

Website

Free

Class 3 – What our priorities are and how we are doing

(Strategies and plans, performance indicators, audits, inspections and reviews)

Performance management policy and procedures adopted by the governing body.

Website

Free

Performance data or a direct link to it

Website

Free

Ofsted inspection reports

Website

Free

The school’s future plans; for example, proposals for and any consultation on the future of the school, such as a change in status

Website

Free

Safeguarding and child protection

Website

Free

Class 4 – How we make decisions

(Decision making processes and records of decisions)

Admissions policy

Website

Free

Agendas and minutes of meetings of the governing body and its committees. (NB this will exclude information that is properly regarded as private to the meetings).

Website

Free

Class 5 – Our policies and procedures

(Current written protocols, policies and procedures for delivering our services and responsibilities)

Records management and personal data policies

Website

Free

Charging regimes and policies.

Website

Free

Class 6 – Lists and Registers

Asset register

By inspection

Free

Any information the school is currently legally required to hold in publicly available registers

By inspection

Free

Class 7 – The services we offer

(Information about the services we offer, including leaflets, guidance and newsletters produced for the public and businesses)

Extra-curricular activities

Website

Free

Out of school clubs

Website

Free

Services for which the school is entitled to recover a fee, together with those fees

Website

Free

School publications, leaflets, books and newsletters

Website

Free

 

5.2.4.6 Schedule of charges

Charge

Description

Basis of charge

Disbursement cost

Photocopying/printing @ 10p per sheet (black & white)

Actual cost

 

Photocopying/printing @ 20p per sheet (colour)

Actual cost

 

Postage

Actual cost of Royal Mail standard 2nd class

Statutory fees

 

In accordance with the relevant legislation

.

6 Records management and retention

The Data Protection Act requires that information is retained only for as long as necessary. These guidelines detail the standard retention period for data held by the Trust.

The retention period may differ in particular circumstances. Where an academy has been taken on by the Trust, certain records may have been retained by the predecessor organisation.

Type of data

Retention period

Reason

Human Resources files: training records; notes of grievance, disciplinary and capability hearings

6 years from the end of employment

Provision of references and limitation period for litigation

Staff application forms/interview notes (unsuccessful applicants)

8 months from the date of the interviews

Limitation period for litigation

Facts relating to redundancies (less than 20)

3 years from the date of redundancies

Limitation period for litigation

Facts relating to redundancies (20 or more)

12 years from the date of redundancies

Limitation period for litigation

Income Tax and NI returns: correspondence with HMRC

6 years after the end of the financial year to which the records relate

Income Tax (Employment) Regulations 1993

Statutory maternity pay records and calculations

3 years after the end of the financial year to which the records relate

Statutory Maternity Pay (General) Regulations 1986

Wages and salary records

6 years from the last date of employment

Taxes Management Act 1970

Records and reports of accidents

3 years after the date of the last entry

RIDDOR 1985

Health records

During employment

Management of Health and Safety at Work Regulations

Health records where reason for termination of employment is concerned with health, including stress related illness

3 years

Limitation period for personal injury claims

Medical records kept by reason of the Control of Substances Hazardous to Health

40 years

COSHHR 1994

Student records including academic achievements and conduct

6 years from the last day of the course, 10 years with the consent of the student for personal and academic references

Limitation period for negligence

 

7 Privacy notice: Information about pupils

Data Protection Act 1998: How we use pupil information

We collect and hold personal information relating to our pupils and may also receive information about them from their previous school, local authority and/or the Department for Education (DfE). We use this personal data to:

  • support our pupils’ learning

  • monitor and report on their progress

  • provide appropriate pastoral care; and

  • assess the quality of our services

This information will include their contact details, national curriculum assessment results, attendance information, any exclusion information, where they go after they leave us and personal characteristics such as their ethnic group, any special educational needs they may have as well as relevant medical information.

For pupils enrolling for post 14 qualifications, the Learning Records Service will give us the unique learner number (ULN) and may also give us details about your learning or qualifications.

Once our pupils reach the age of 13, the law requires us to pass on certain information to the local authority who have responsibilities in relation to the education or training of 13-19 year olds.

We may also share certain personal data relating to children aged 16 and over with post-16 education and training providers in order to secure appropriate services for them. A parent/guardian can request that only their child’s name, address and date of birth be passed to the local authority by informing the academy. This right is transferred to the child once he/she reaches the age 16.

We will not give information about our pupils to anyone without your consent unless the law and our policies allow us to do so. If you want to receive a copy of the information that we hold about about your child please contact your child’s academy.

We are required, by law, to pass some information about our pupils to the Department for Education (DfE). This information will, in turn, then be made available for use by the local authority.

The DfE may also share pupil level personal data that we supply to them, with third parties. This will only take place where legislation allows it to do so and it is in compliance with the Data Protection Act 1998.

Decisions on whether DfE releases this personal data to third parties are subject to a robust approval process and are based on a detailed assessment of who is requesting the data, the purpose for which it is required, the level and sensitivity of data requested and the arrangements in place to store and handle the data. To be granted access to pupil level data, requestors must comply with strict terms and conditions covering the confidentiality and handling of data, security arrangements and retention and use of the data.

For more information on how this sharing process works, please visit: https://www.gov.uk/guidance/national-pupil-database-apply-for-a-data-extract

For information on which third party organisations (and for which project) pupil level data has been provided to, please visit: https://www.gov.uk/government/publications/national-pupil-database-requests-received

If you need more information about how our local authority and/or DfE collect and use your information, please visit:

8 Privacy notice: Information about staff

The Data Protection Act 1998: How we use your information

We process personal data relating to those we employ to work at, or otherwise engage to work at, our academies and supporting operations. This is for employment purposes to assist in the running of the Trust and to enable individuals to be paid. The collection of this information will benefit both national and local users by:

  • improving the management of workforce data across the sector

  • enabling development of a comprehensive picture of the workforce and how it is deployed

  • informing the development of recruitment and retention policies

  • allowing better financial modelling and planning

  • enabling ethnicity and disability monitoring; and

  • supporting the work of the School Teachers’ Review Body

This personal data includes identifiers such as names and National Insurance numbers and characteristics such as ethnic group, employment contracts and remuneration details, qualifications and absence information.

We will not share information about you with third parties without your consent unless the law allows us to. We are required, by law, to pass on some of this personal data to:

  • the relevant local authority

  • the Department for Education (DfE)

If you require more information about how the local authority and/or DfE store and use your personal data please visit:

If you want to see a copy of information about you that we hold, please contact the Trust’s central Human Resources department.