Privacy Policy

Privacy Notice for Pupils, Parents and Carers

Introduction

Under data protection law, individuals have a right to be informed about how the school uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their personal data.

This privacy notice explains how we collect, store and use personal data about pupils, parents and carers.

St Hugh’s Catholic Primary School is the ‘data controller’ for data protection law: initial contact, Donna Donaldson, Operations Manager.

Privacy notice – how the school uses pupil information

What categories of information are processed?

The categories of personal information that we process include the following:

personal identifiers and contacts (such as name, unique pupil number, contact details and address)
characteristics (such as ethnicity, language, and free school meal eligibility)
safeguarding information (such as court orders and professional involvement)
special educational needs (including the needs and ranking)
medical and administration (such as doctors’ information, child health, dental health, allergies, medication and dietary requirements)
attendance (such as sessions attended, number of absences, absence reasons and any previous schools attended)
assessment and attainment (such as key stage 1 and phonics results, post 16 courses enrolled for and any relevant results)
behavioural information (such as exclusions and any relevant alternative provision put in place)
Additional activities (extra-curricular activities, educational visits)
Pupil Premium Children (areas for entitlement)
Information provided by parents or carers (letters, emails, or telephone conversations)

This list is not exhaustive. We may also hold data about pupils that we have received from other organisations, including schools, local authorities and the Department for Education (DfE).

Why do we collect and use your information?

We will only collect your information when we have a good reason to do so in line with the law – this is known as having a lawful basis to use data. Here are the reasons we collect your information:

To support pupil learning
To monitor and report on pupil attainment and progress
To provide appropriate pastoral care
To assess the quality of our services
To keep pupils safe
To meet the statutory duties placed on us for government data collections

Under the UK General Data Protection Regulation (UK GDPR), the lawful basis/bases we rely on for processing pupil information are:

The lawful bases often cited for these data transfers are:

UK GDPR Article 6 Bases (Lawfulness of Processing)

- Article 6(1)(c) – Legal Obligation: The school or organization must share information to comply with a legal obligation. Examples include the school census or mandatory safeguarding reports.
- Article 6(1)(e) – Public Task: Sharing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority (e.g., safeguarding, school funding, monitoring pupil progress).

UK GDPR Article 9 Conditions (Special Category Data)

If the information shared includes sensitive data (e.g., health, ethnicity, SEN), a condition under Article 9 is needed:

- Article 9(2)(g) – Substantial Public Interest: Sharing is authorized under UK law (e.g., the DPA 2018) and is necessary for safeguarding children or individuals at risk.
- Article 9(2)(j) – Research and Statistics: For the purpose of using data for statistical or research purposes (e.g., National Pupil Database).

Supporting Legislation and Regulations

- Education (Information About Individual Pupils) (England) Regulations 2013: Mandates sharing pupil data with the DfE.
- Education Act 1996 (Section 507B): Relates to sharing information with the LA and Youth Support Services for pupils aged 13+.
- Children Act 1989/2004:Covers sharing information for safeguarding and welfare purposes.

Key Statutory Requirements

School Census: Mandatory sharing of pupil identifiers, attendance, and characteristics.
Safeguarding: “Working Together to Safeguard Children” guidance confirms that data protection law does not prevent sharing information to protect a child, and consent is not always required.

How do we collect your information?

We collect your personal information via the following methods:

Registration forms
Common Transfer File (CTF) from your previous school
Admission Transfer File (ATF) from the LA
Safeguarding information via CPOMS

Pupil data is essential for the school’s operational use. Whilst the majority of information you provide to us is mandatory, some of it is requested on a voluntary basis. In order to comply with data protection legislation, we will inform you at the point of collection whether you are required to provide certain information to us or if you have a choice.

How do we store your information?

We hold your personal information securely for the set amount of time shown in the school’s Records Management Policy.

Who do we share your information with?

We routinely share your information with:

The Department for Education (DfE)
Schools that you go to after leaving us
Liverpool City Council
Department for Education
NHS England
Outside agencies
Our local authority – to meet our legal obligations to share certain information with it, such as safeguarding concerns and exclusions
The pupil’s family and representatives
Educators and examining bodies
Our regulator [Ofsted, Liverpool Archdiocese)
Suppliers and service providers – to enable them to provide the service we have contracted them for
Financial organisations
Our auditors
Survey and research organisations
Health authorities
Security organisations
Health and social welfare organisations
Professional advisers and consultants
Charities and voluntary organisations
Police forces, courts, tribunals
Professional bodies

Why do we share your information?

We do not share information about you with anyone without your consent, unless the law and our policies allow us to do so.

Department for Education (DfE)

The DfE collects personal information from us and our LA through various collections the school is required to undertake legally. We are required to share information about pupils with the DfE either directly or via our LA for the purpose of those data collections, under:

Section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013

All information we share with the DfE is transferred securely and held by the DfE under a combination of software and hardware controls which meet the current government security policy framework,, which can be found by following this link: https://www.gov.uk/government/publications/security-policy-framework

How does the government use your data?

The pupil data that we lawfully share with the DfE through data collections:

Underpins school funding, which is calculated based upon numbers of pupils and their characteristics in each school.
Informs ‘short-term’ education policy monitoring and school accountability and intervention.
Supports ‘longer-term’ research and monitoring of educational policy, e.g. how certain subject choices go on to affect education or earnings beyond school.

To find out more about the data collection requirements placed on us by the DfE, e.g. via the school census, follow this link: https://www.gov.uk/education/data-collection-and-censuses-for-schools

The National Pupil Database (NPD)

Much of the data about pupils in England goes on to be held in the NPD.

The NPD is owned and managed by the DfE and contains information about pupils in schools in England – it provides evidence on educational performance to inform independent research as well as studies commissioned by the DfE.

Information on the NPD is held in an electronic format for statistical purposes and it is securely collected from a range of sources, including schools, LAs and awarding bodies.

You can find out more about the NPD by following this link: https://www.gov.uk/government/publications/national-pupil-database-npd-privacy-notice/national-pupil-database-npd-privacy-notice

Sharing by the DfE

The DfE is legally allowed to share pupils’ personal information with certain third parties, including the following:

Schools
LAs
Researchers
Organisations connected with promoting the education or wellbeing of children in England
Other government departments and agencies
Organisations fighting or identifying crime

Organisations fighting or identifying crime, such as the Home Office and the police, may use their legal powers to contact the DfE to request access to individual level information relating to a crime.

For more information about how the DfE collects and shares pupil information, you can look at the information in the following two links:

How to find out what personal information the DfE holds about you

Under the Data Protection Act 2018, you are entitled to ask the DfE what personal information it holds about you. You have the right to ask the DfE:

If it processes your personal data.
For a description of the data it holds about you.
The reasons it is holding your data and any recipient it may be disclosed to.
For a copy of your personal data and any details of its source.

To exercise these rights, you should make a subject access request. Information on how to do this can be found by following this link: https://www.gov.uk/government/organisations/department-for-education/about/personal-information-charter

You can also contact the DfE directly using its online contact form by following this link: https://www.gov.uk/contact-dfe.

What are your rights?

You have specific rights to the processing of your data; these are the right to:

Request access to the information the school holds about you.
Restrict our processing of your personal data, i.e. permitting its storage but no further processing.
Object to direct marketing (including profiling) and processing for the purposes of scientific and/or historical research and statistics.
Have your personal data rectified if it is inaccurate or incomplete.
Not be subject to decisions based purely on automated processing where it produces a legal or similarly significant effect on you.
Request the deletion or removal of personal data where there is no compelling reason for the continued processing.

If you want to request access to the personal information that we hold about you, please contact the Operations Manager at office@sthughsprimary.co.uk

If you are concerned about the way we are collecting or using your information, please raise your concern with the school office in the first instance. You can also contact the Information Commissioner’s Office (ICO) at https://ico.org.uk/concerns. The ICO is the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

How to withdraw consent and lodge complaints

Where our school processes your personal data with your consent, you have the right to withdraw your consent.

If you change your mind or are unhappy with how our school uses your personal data, you should let us know by contacting the Operations Manager on office@sthughsprimary.co.uk in the first instance.

Updating this privacy notice

We may need to update this privacy notice periodically if we change how we collect and process data. The school will inform you when this privacy notice has changed; however, we also recommend that you revisit this privacy notice periodically.

This privacy notice was last updated on 24/04/2026

How can you find out more information?

If you would like to discuss anything in this privacy notice, please contact the Operations Manager, at office@sthughsprimary.co.uk in the first instance.

Complaints,

We take any complaints about our collection and use of personal information very seriously.

If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our data processing, please raise this with us in the first instance.

To make a complaint, please contact, Donna Donaldson Operations Manager in the first instance.

Alternatively, you can make a complaint to the Information Commissioner’s Office:

Report a concern online at ico.org.uk/concerns/
Call 0303 123 1113
Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF