Data Protection Policy

Data Protection Policy

Boldmere Infant and Nursery School Last reviewed: reviewed annually | Next review: 16 September 2026, at the Full Governing Body meeting | Approved by: the Governing Body

1. Purpose

This policy sets out how Boldmere Infant and Nursery School collects, stores, uses, and disposes of personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data Protection Officer

Our Data Protection Officer (DPO) is Mrs S Kenny, Data Protection Officer, Boldmere Infant and Nursery School, who can be contacted at:

3. What personal data we hold

We process personal data relating to pupils, parents/carers, staff, governors, and visitors, including but not limited to:

• Names, addresses, contact details, dates of birth
• Attendance, behaviour, and academic records
• Special educational needs and medical information
• Photographs and images used for identification or promotional purposes
• Staff employment and payroll records

4. Why we collect this data

We process personal data to:

• Support pupil learning and wellbeing
• Monitor and report on pupil progress
• Provide appropriate pastoral and safeguarding care
• Meet legal obligations, including statutory returns to the Department for Education (DfE)
• Administer admissions and school meals
• Keep children and staff safe

5. Legal basis for processing

Our legal bases for processing include: public task (education legislation), legal obligation (statutory returns, safeguarding duties), vital interests (emergency medical situations), and, where appropriate, consent (e.g. optional photo use).

6. Sharing data

We may share personal data with:

• The Department for Education, as part of the school census and other statutory data collections
• The local authority
• Other schools, when a pupil transfers (including the pupil’s common transfer file and educational record, transferred within 15 days of confirmation the pupil is registered elsewhere)
• Third-party service providers who process data on our behalf (e.g. MIS provider, school meals provider), under a data processing agreement
• Relevant authorities where there is a safeguarding concern

We do not share personal data with any third party without a lawful basis for doing so.

7. Data retention

We retain personal data in accordance with the Information and Records Management Society (IRMS) Toolkit for Schools. Where a record type is not listed in the toolkit, we retain a written rationale for the retention period applied, available on request. Data no longer required is securely deleted or destroyed.

8. Data security

We maintain appropriate technical and organisational measures to protect personal data, including access controls, staff training, and secure storage of physical and digital records. Any transfer of personal data outside the UK is only made where adequate safeguards, such as a Standard Contractual Clause, are in place.

9. Your rights

Under UK GDPR, individuals have the right to:

• Access their personal data
• Request correction of inaccurate data
• Request erasure in certain circumstances
• Object to or restrict certain processing
• Lodge a complaint with the Information Commissioner’s Office (ICO)

Requests should be made in writing to the DPO using the contact details above.

10. Biometric data

11. Complaints

If you are unhappy with how we have handled your personal data, please contact our DPO in the first instance. You also have the right to raise a concern directly with the ICO at ico.org.uk.

12. Related policies

ICO Registration Number: ZA529697 (registration valid to 7 July 2027)