Data Protection Policy ‘required by law’ in academies

For those of you who did not already know, the Department for Education’s list of “Policies and other documents that Governing Bodies are required to have by law” confirms that a Data Protectio

n Policy is a necessity for all Academies.

  • Data Protection Policy is recorded on page three under ‘Statutory policies required by other legislation which impacts particularly on schools (including academies and free schools)’ [our emphasis added].

The DfE simply point those looking to draft a Data Protection Policy to the data protection principles (not overly helpful) and to the Information Commissioner’s Office Education sector guide (more helpful)….

This is one of the difficulties with the Data Protection Act. It provides eight guiding principles, addressing the handling of personal information from collection through to disposal. While this enables a degree of flexibility on how you meet your obligations, the difficulty comes from interpreting the principles and turning them into practice – into something that employees can use, and that provides proportionate protection while enabling efficient use of personal information.