Guidance for bursars, compliance managers and IT leads
Last reviewed 14 November 2026, by Marc Davies, named Data Protection Officer to independent schools since 2018.
The short answer
The Department for Education (DfE) publishes Meeting digital and technology standards in schools and colleges, a set of 12 standards for the technology a school runs on. It asks every school and college to be working towards six core standards by 2030, and says the filtering and monitoring standard should be met now.
For an independent school the standards are the clearest public statement of what good looks like. Insurers, auditors and inspectors increasingly ask the same questions, so a school that can show where it stands against them, with evidence, is in a far stronger position than one that cannot.
What they are
The DfE last updated the standards on 16 September 2026. Six are core. The other six still apply, and the DfE says schools should continue to refer to all of them.
| Standard | Status | In brief |
|---|---|---|
| Cyber security | Core | An annual cyber risk assessment reviewed each term, staff and pupil awareness, anti-malware and a firewall, controlled accounts, licensed and updated software, tested backups and reporting attacks |
| Filtering and monitoring | Core, to be met now | Appropriate filtering and monitoring systems, with named responsibility and regular review |
| Digital leadership and governance | Core | A senior leader responsible for digital technology, up-to-date registers, technology within continuity plans and a strategy reviewed every year |
| Broadband internet | Core | A connection suited to the size and needs of the school, with resilience |
| Wireless network | Core | Reliable and secure wireless coverage |
| Network switching | Core | Switches that give a fast, reliable and secure network |
| Cloud solutions | Standard | Cloud services that follow data protection law, with access management and backup |
| Servers and storage | Standard | Secure, energy-efficient servers and storage that meet data protection law |
| Network cabling | Standard | Cabling able to carry the speeds the school needs |
| Laptops, desktops and tablets | Standard | Devices that are safe, secure and fit for teaching and learning |
| IT support | Standard | IT support planned, commissioned and reviewed so that it meets the school’s needs |
| Digital accessibility | Standard | Technology and content that staff and pupils with different needs can use |
Do they apply to you?
The guidance is addressed to all schools and colleges and makes no exception for independent schools. It is guidance, not legislation, and much of the DfE’s funding and support around it is aimed at the state sector.
Two things bring it home for independent schools. First, Keeping children safe in education 2026, the statutory safeguarding guidance in force since 1 September 2026, points schools to the filtering and monitoring standards and to the cyber security standards. Second, the standards describe controls that cyber insurers ask about at renewal, such as backups, access control and an incident response plan.
Where data protection comes in
The standards are about technology, but several of them depend on your data protection officer.
Governance
The governance standard expects an information asset register owned by the data protection officer. It should agree with your Article 30 record of processing, so keep the two together.
Cloud
The cloud standard expects a data protection impact assessment where a cloud service holds personal data, assurance from the provider, and data kept in the UK or EU unless a transfer is lawful.
Cyber security
When an attack is reported, the data protection officer decides whether it is a personal data breach that must go to the ICO within 72 hours. Backups you have tested are what make recovery possible.
Getting started
The standards themselves suggest an order: governance first, because everything else depends on someone being responsible and on knowing what you have.
Next steps
The GDS client portal includes the 12 DfE standards as an assessment. You rate each item, attach your evidence, see a score and your biggest gaps for each standard, and turn the gaps into an action plan with owners and dates. The cyber risk assessment sits in the portal’s risk register, next to your record of processing and supplier monitoring. See how the client portal works.
If you would rather talk it through, book a free 30-minute consultation or call us on 0333 121 6772. How we support independent schools.
The DfE standards are Crown copyright and are summarised here under the Open Government Licence v3.0. This guide is not endorsed by the DfE.
© 2026 GDS Analytics. All rights reserved.