Data Protection and GDPR
Under data protection law, individuals have the right to be informed about how we collect and use their personal information. This privacy notice explains how Barham Church of England Primary School collects, stores, uses and shares information about pupils.
Under data protection law, individuals have the right to be informed about how we collect and use their personal information. This privacy notice explains how Barham Church of England Primary School collects, stores, uses and shares information about pupils.
Barham Church of England Primary School is the data controller for the personal information described in this notice.
School contact details
Barham Church of England Primary School
Valley Road
Barham
Canterbury
Kent
CT4 6NX
Telephone: 01227 831312
Email: [office@barham.kent.sch.uk](mailto:office@barham.kent.sch.uk)
Our Data Protection Officer is Satswana Ltd:
Email: [info@satswana.com](mailto:info@satswana.com)
Telephone: 01252 516898
This notice is written principally for parents, carers and older pupils. Children have the same data-protection rights as adults, and we aim to explain our use of information in ways that pupils can understand.
A child-friendly summary
We collect information about pupils so that we can:
* teach and support them;
* keep them safe and well;
* understand their progress and what help they may need;
* run the school properly; and
* meet our legal responsibilities.
We keep this information secure and only share it when there is a lawful and appropriate reason. Pupils and their parents or carers can ask us questions about the information we hold.
The pupil information we collect and use
The information we process may include:
* names, addresses, dates of birth, unique pupil numbers and contact details;
* parent, carer, emergency contact and relevant family information;
* admissions information and details of previous schools;
* characteristics such as sex, ethnicity, language and eligibility for free school meals or Pupil Premium;
* looked-after, previously looked-after, adopted-from-care and special guardianship information;
* attendance, absence and previous-school information;
* assessment, attainment, progress and curriculum records;
* special educational needs and disability information;
* behaviour, bullying, suspension, exclusion and alternative-provision information;
* physical and mental health information, allergies, dietary requirements, medication and first-aid records;
* safeguarding information, including court orders and professional involvement;
* pastoral support, care plans, support packages and details of external professionals;
* information about school meals, trips, clubs, swimming, performances, competitions and wraparound provision;
* photographs, video or audio recordings;
* correspondence, complaints and information supplied by parents or carers;
* usernames, online identifiers and information generated through school-approved educational systems and applications; and
* information generated by the school’s internet filtering, safeguarding and monitoring systems.
We may also process information about parents, carers and other family members where this is necessary to educate, support or safeguard a pupil.
Where we obtain pupil information
We collect pupil information from:
* pupils and their parents or carers;
* admission and annual information forms;
* teachers and other school staff;
* previous schools, usually through the secure Common Transfer File;
* Kent County Council and other local authorities;
* the Department for Education;
* health, social care and safeguarding professionals;
* the police and other public authorities where appropriate; and
* organisations providing services to the school.
Why we use pupil information
We use pupil information to:
* support teaching and learning;
* monitor and report on attainment, progress and wider development;
* identify and provide appropriate educational, pastoral, medical and SEND support;
* safeguard pupils and promote their welfare;
* manage attendance and behaviour;
* support admissions, transfers and transitions between schools;
* communicate with pupils, parents and carers;
* organise school meals, trips, clubs, wraparound care and other activities;
* administer statutory assessments and moderation;
* allocate funding and manage school resources;
* assess and improve the quality of our provision;
* produce statistics and undertake approved research or evaluation;
* meet statutory data-collection requirements;
* respond to complaints, legal claims and regulatory enquiries; and
* comply with our legal and safeguarding responsibilities.
Where a child may be missing education or is withdrawn to be electively home educated, we may share relevant school history and the latest known pupil and parent contact details with Kent County Council. This supports the local authority’s education and safeguarding duties. Elective home education is not, in itself, treated as a child-missing-education concern.
Our lawful bases
Under Article 6 of the UK GDPR, we normally process pupil information because:
Article 6(1)(c) – legal obligation: processing is necessary for us to comply with the law;
*Article 6(1)(e) – public task:processing is necessary for us to carry out our official education and safeguarding functions;
*Article 6(1)(d) – vital interests: processing is necessary to protect someone’s life; or
Article 6(1)(a) – consent: consent has been given for a specific optional purpose.
Where we rely on consent, we will explain what the information will be used for. Consent can be withdrawn at any time without affecting processing that has already taken place.
Our legal responsibilities arise from legislation including:
* the Education Acts 1996 and 2002;
* the Children Acts 1989 and 2004;
* the Children and Families Act 2014;
* the Equality Act 2010;
* the Education (Pupil Information) (England) Regulations 2005;
* the Education (Information About Individual Pupils) (England) Regulations 2013;
* the School Attendance (Pupil Registration) (England) Regulations 2024;
* the UK General Data Protection Regulation; and
* the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.
Special-category and criminal-offence information
Some pupil information is particularly sensitive. This includes information about health, ethnicity, religion and certain safeguarding matters.
In addition to an Article 6 lawful basis, we process special-category information under an appropriate condition in Article 9 of the UK GDPR and the Data Protection Act 2018. Depending on the purpose, this may include:
* explicit consent;
* protecting someone’s vital interests;
* reasons of substantial public interest, including safeguarding children and promoting equality of opportunity; or
* the provision or management of health or social care.
Any criminal-offence information is processed only where both a lawful basis and an appropriate condition under Article 10 of the UK GDPR and the Data Protection Act 2018 apply.
Providing pupil information
Most of the pupil information we collect is necessary for the school to operate and meet its legal responsibilities. Some information is optional.
When we collect information, we will explain whether it must be provided or whether there is a choice. Where information is required, we will explain any likely consequences of not providing it.
How we store and retain information
Pupil information is stored securely in approved electronic systems and, where necessary, in secure paper records. Access is limited to authorised people who need the information to carry out their work.
We retain information in accordance with the school’s Records Management Policy and Retention Schedule. Retention periods vary according to the type of record, the reason it is held and any statutory, safeguarding, insurance or operational requirements.
When information is no longer required, it is securely deleted, destroyed or anonymised. Relevant pupil records are transferred securely to the pupil’s next school where the law requires this.
A copy of the school’s retention schedule can be requested from the school office.
Who we share pupil information with
We only share pupil information where there is a lawful, necessary and proportionate reason. Depending on the circumstances, this may include:
* the school or education provider a pupil attends after leaving us;
* Kent County Council and other local authorities;
* the Department for Education;
* the Standards and Testing Agency and approved assessment providers;
* Ofsted and other regulators;
* health, social care and safeguarding services;
* the police, courts and tribunals;
* education, SEND and mental-health professionals;
* school meal, transport, trip, sports, music and wraparound providers;
* approved IT, safeguarding, filtering and educational-service providers;
* professional advisers, insurers and legal representatives;
* parents, carers and representatives where appropriate; and
* other schools for statutory moderation or approved collaborative work.
Where an organisation processes information on our behalf, it must do so under an appropriate contract and in accordance with our instructions and data-protection law.
We do not need consent to share information where another lawful basis applies—for example, where sharing is required by law or necessary to safeguard a child.
Department for Education and the National Pupil Database
As a maintained school, we are required to share specified pupil information with Kent County Council and the Department for Education under regulation 3 of the Education (Information About Individual Pupils) (England) Regulations 2013.
This information is used to support school funding, monitor education policy, evaluate school performance and support research into children’s education and wellbeing.
Some of this information is stored in the National Pupil Database, which is owned and managed by the Department for Education. The DfE may share information from the database where it is lawful, secure and ethical to do so.
Further information is available from:
* [DfE school data collections](https://www.gov.uk/education/data-collection-and-censuses-for-schools)
* [National Pupil Database privacy notice](https://www.gov.uk/government/publications/national-pupil-database-npd-privacy-notice/national-pupil-database-npd-privacy-notice)
* [How the DfE shares personal data](https://www.gov.uk/guidance/data-protection-how-we-collect-and-share-research-data)
* [DfE external data shares](https://www.gov.uk/government/publications/dfe-external-data-shares)
International transfers
Some approved service providers may process or allow access to personal information outside the UK.
Where a restricted international transfer takes place, we ensure that it is covered by UK adequacy regulations, appropriate safeguards—such as an approved international data-transfer agreement—or a permitted exception under data-protection law. Appropriate risk assessments are completed where required.
Further information about relevant safeguards can be requested from our Data Protection Officer.
Pupils’ and parents’ rights
Data-protection rights belong to the pupil. A parent or carer may exercise these rights on a pupil’s behalf where this is appropriate, taking account of the pupil’s age, understanding, wishes and best interests. There is no automatic fixed age at which this changes.
Depending on the circumstances and the lawful basis being used, individuals may have the right to:
* be informed about how their information is used;
* request access to their personal information;
* have inaccurate or incomplete information corrected;
* request deletion of information in certain circumstances;
* request that processing is restricted;
* receive and transfer information electronically in certain circumstances;
* withdraw consent where consent is the lawful basis; and
* challenge solely automated decisions that have a legal or similarly significant effect.
Individuals may also have the right to object to processing carried out as a public task. This right is not absolute, and the school may continue processing where there are compelling lawful reasons to do so.
The rights to erasure, objection and data portability do not apply in every situation—for example, they may not apply where we are legally required to process the information.
The school does not currently make decisions about pupils based solely on automated processing where those decisions would have legal or similarly significant effects.
Requests can be made verbally or in writing by contacting the school office or Data Protection Officer.
Access to educational records
Parents and carers of pupils at maintained schools also have a separate legal right to request access to their child’s educational record under the Education (Pupil Information) (England) Regulations 2005, subject to the relevant exemptions.
Requests should be made in writing to the Headteacher through the school office.
Questions and complaints
Questions or concerns should initially be raised with the school or our Data Protection Officer:
School:office@barham.kent.sch.uk
Data Protection Officer:info@satswana.com
Telephone:01252 516898
A data-protection complaint can be made by email, telephone or letter. We will acknowledge receipt within 30 days, take appropriate steps to investigate the matter without undue delay and inform the complainant of the outcome.
If you remain dissatisfied, you may complain to the Information Commissioner’s Office:
Telephone: 0303 123 1113
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Review of this notice
This privacy notice will be reviewed at least annually and whenever there is a significant change to the way pupil information is processed.
Last updated: July 2026