GovWire

Sharing personal data

Department For Education

December 18
16:21 2024

class="gem-c-govspeak govuk-govspeak govuk-!-margin-bottom-0">

To keep children and young people safe in school, you need to share information appropriately, so the correct decisions can be made to protect them.

You must have a compelling reason to share their personal data. Sharing childrens data with third parties can expose them to unintended risks if not done properly. You should carry out a data protection impact assessment to assess any risk before sharing personal information about your pupils.

The Information Commissioners Office website includes further guidance on data sharing. Any data you share must comply with their data sharing code of practice.

Safeguarding

To keep children safe and make sure they get the support they need, you can share information with other schools and childrens social care teams. Its not usually necessary to ask for consent to share personal information for the purposes of safeguarding a child.

Your designated safeguarding lead will decide if personal data needs to be shared. They should make sure they record:

  • who theyre sharing that information with
  • why theyre sharing the data
  • whether they have consent from the pupil, parent or carer

Read working together to safeguard children to find out more information about sharing a pupils safeguarding file. You should also refer to the safeguarding section of keeping children safe in education.

Sharing data with local authorities and government

Occasionally, you may need to share personal information about your pupils with local authorities, other schools or childrens services. For example:

  • if a pupil shows signs of physical or mental abuse, you may need to pass this information on to childrens services
  • another school may need to know which pupils will be at their sports day or on a joint school trip

Sharing information can help provide appropriate services that safeguard and promote the welfare of children. The Data Protection Act 2018 and UK GDPR provides a framework to make sure that personal information is shared appropriately.

Before you share any data, you must:

  • consider all the legal implications
  • check if you need permission to share the data
  • confirm who needs the data, what data is needed and what theyll use it for
  • make sure that you have the ability to share the specified data securely
  • check that the actions cannot be completed or verified without the data

You also have a statutory requirement to share personal data about your pupils with DfE through the school census. You do not need to get consent from pupils, parents or carers to share this data with us. You should provide information about what data you share in your schools privacy notice. Privacy notice model documents suggest wording to explain to staff, parents, carers and pupils what data youre collecting and sharing.

Schools may also need to share personal data about their staff with the local authority.

Sharing data with other schools

If a pupil moves to another school, you should transfer their records to the new school. This includes the pupils common transfer file and educational record. You must:

  • make sure you transfer the data securely
  • transfer the record within 15 days of getting confirmation the pupil is registered at another school
  • be able to trace the record during the transfer

To securely share and transfer pupil records, you could:

  • use the school to school (S2S) system
  • send them to a named person using an encrypted email
  • ask your local authority to transfer them
  • deliver any paper records in person or ask the new school to collect them

If youre organising a school trip with another school, youll need to share data with them to confirm which pupils are going. You may also need to share details such as dietary requirements or medical information to make sure pupils are safe. Where you already have consent for the information, make sure this also covers sharing it.

Before sharing any personal data, you need to identify the lawful basis. This may be consent from the individual. There may be some circumstances where it may not be appropriate to ask for consent, however. For example:

  • if the individual cannot give consent
  • its not reasonable to ask for consent
  • when theres a safeguarding concern

Youll usually need to get the pupils consent to share their data if theyre aged 13 or over. If theyre under 13, you must get consent from whomever holds paren

Related Articles

Comments

  1. We don't have any comments for this article yet. Why not join in and start a discussion.

Write a Comment

Your name:
Your email:
Comments:

Post my comment

Recent Comments

Follow Us on Twitter

Share This


Enjoyed this? Why not share it with others if you've found it useful by using one of the tools below: