Guidance for bursars, heads and data protection leads
Last reviewed 13 November 2026, by Marc Davies, named Data Protection Officer to independent schools since 2018.
The short answer
Article 30 of the UK GDPR requires a school to keep a written record of what personal data it processes, why, who it goes to and how long it is kept. The exemption for organisations with fewer than 250 staff almost never helps a school, because a school processes pupils’ and staff data every day and holds health, special educational needs and safeguarding information.
The quickest way to a record that is accurate, and stays accurate, is to list the school’s processing activities (admissions, safeguarding, payroll and so on), then work through six questions for each one. This guide takes you through those steps, the judgement calls that schools most often get wrong, and how to keep the record alive once it exists.
Do you need one?
Organisations with 250 or more employees must document all of their processing. Smaller organisations must still document any processing that is not occasional, that is likely to result in a risk to people’s rights and freedoms, or that involves special category or criminal offence data (Article 30(5)).
Pupil records, attendance, fees and payroll happen every day, so they are not occasional. Medical needs, special educational needs and safeguarding concerns are special category data. In practice, every independent school should keep a full record, whatever its size.
What it must contain
Article 30(1) sets out what the record must hold. The ICO also expects you to be able to show your lawful basis, your conditions for special category data and your retention decisions, and the record is the natural place to keep them.
| Item | What to record | Source |
|---|---|---|
| Who you are | The school’s name and contact details, and those of your data protection officer and any UK or EU representative | Article 30(1)(a) |
| Purpose | Why the school processes the data, in plain words | Article 30(1)(b) |
| People and data | The categories of people (pupils, parents, staff, applicants) and of personal data | Article 30(1)(c) |
| Recipients | Who the data is shared with, including suppliers, exam boards and local authorities | Article 30(1)(d) |
| Transfers | Any transfer outside the UK, and the safeguard relied on | Article 30(1)(e) |
| Retention | How long each category is kept, where possible | Article 30(1)(f) |
| Security | A general description of the security measures, where possible | Article 30(1)(g) |
| Lawful basis | The Article 6 basis for each activity | Good practice; supports Articles 5(2) and 13 |
| Special category condition | The Article 9 condition, and the Schedule 1 condition of the Data Protection Act 2018 where one is needed | Good practice; Schedule 1 records are required |
| Suppliers | Each processor used for the activity, and whether you hold Article 28 terms | Good practice |
| DPIA | Whether a data protection impact assessment exists, and where | Good practice; supports Article 35 |
Step 1
A record organised by system (the MIS, the finance package, Microsoft 365) tells you where data sits but not why the school holds it, and the same system usually serves several purposes with different lawful bases. Organise by activity instead, as the ICO’s own template does, and link each activity to the systems and suppliers it uses.
Most independent schools will recognise the following list. Use it as a starting point and add anything particular to your school, such as a boarding house, a nursery or a commercial lettings arm.
Step 2
The record is only as good as the conversations behind it. Spend half an hour each with the bursar, the registrar, the designated safeguarding lead, the SENCo, the school nurse, the head of IT and the development director. Ask what they collect, where it goes, which suppliers they use and what happens to it when a pupil or member of staff leaves.
You will almost always find something nobody had written down: a spreadsheet of applicants kept on a shared drive, a trip provider that receives medical information, or an app a department adopted on a free trial.
Step 3
Independent schools are not public authorities, so most of their processing rests on contract (the parent contract), legal obligation (for example, statutory safeguarding duties and employment law) or legitimate interests. Consent is the right basis only where the person has a real choice, such as using a pupil’s photograph in a prospectus.
Health, special educational needs, safeguarding concerns and biometric data each need an Article 9 condition as well. Safeguarding usually relies on Article 9(2)(g) with the condition for safeguarding children and individuals at risk in Schedule 1 of the Data Protection Act 2018, and that condition requires an appropriate policy document. Record the condition against each activity, so the policy document and the record say the same thing.
Step 4
Each activity should name the suppliers that process data for it: the MIS, the payments provider, the safeguarding software, the cloud storage. For each one, check that you hold data processing terms that meet Article 28, and note whether the supplier or its sub-processors transfer data outside the UK and on what safeguard.
Supplier lists drift quickly. A record that links to the suppliers themselves, rather than retyping their names, makes it obvious when a supplier is no longer used or when a new one has appeared without a contract.
Step 5
Retention is the item schools most often leave blank. The Information and Records Management Society’s toolkit for schools is the usual reference: for example, it suggests keeping the pupil file until 25 years after the pupil’s date of birth, reflecting the time a former pupil has to bring a claim. Adapt the periods to your school, record them against each activity, and make sure your systems can delete or archive data when the time comes.
Keep a short note of the reasoning where you depart from the toolkit. It is much easier to defend a decision that was written down at the time.
Step 6
A general description is enough: role-based access in the MIS, multi-factor sign-in for staff accounts, encryption on laptops, locked cabinets for paper medical records. Where an activity involves children’s special category data at scale, new technology or monitoring, note whether a data protection impact assessment exists. If it does not, the record has just told you where to start.
The difficult areas
Trips and activities
Trip providers, coach firms and overseas hosts often receive dietary, medical and passport details. Record the recipients, the transfer safeguard where the trip is abroad, and when the provider deletes the data.
Alumni and fundraising
Researching the wealth or connections of former pupils and parents is a separate activity from keeping in touch, and needs its own lawful basis and transparency. Record it separately.
Catering and access
Fingerprint and facial recognition systems process special category data. Record the condition you rely on, the alternative offered to pupils who do not take part, and the DPIA.
New tools
Departments adopt apps and AI tools quickly, often on free trials. Make adding a supplier to the record part of approving any new tool, so the record keeps pace with what staff actually use.
Keeping it alive
Review the whole record at least once a year, and update it whenever the school adopts a new system, changes a supplier or starts a new activity. Report its status to governors alongside your other data protection reporting, and keep earlier versions: if the ICO asks for your record, it will want to see how it has been maintained, not just the version printed that morning.
The ICO can ask to see the record at any time, and it is often the first document a regulator, an insurer or a parent’s solicitor asks for after an incident.
Next steps
The GDS client portal includes a record of processing built for schools. You can start from a template of sixteen typical school activities, link each one to the suppliers it uses and their current security rating, see the gaps highlighted, and download the record as a PDF or spreadsheet. See how the client portal works.
If you would rather talk it through, book a free 30-minute consultation or call us on 0333 121 6772. How we support independent schools.
© 2026 GDS Analytics. All rights reserved.