Privacy Notice - Pupils
Privacy Notice for pupils (also provided to parents and carers)
This letter might be difficult for you to understand. You can ask your parents or another adult such as your teacher to help you understand it.
It is about how we use information about you and what we do with it. We call this information about you ‘personal data’ or ‘personal information.’
Who we are
You already know that your school is called Neatherd and that it is part of the Academy Trust called Mid Norfolk Academy Trust (MNAT) but we have to tell you that the Academy Trust is the organisation which is in charge of your personal information. This means the Academy Trust is called the Data Controller.
The postal address of the Academy Trust is
Mid Norfolk Academy Trust Ltd
Dereham Neatherd High School
Norwich Road, Dereham
Norfolk, NR20 3AX
If you want to contact us about your personal information you can contact our Data Protection Officer who is The DPO Centre. You can also use the email address email@example.com
The categories of pupil information that we process include:
- personal identifiers and contacts (such as name, unique pupil number, contact details and address)
- characteristics (such as ethnicity, language, and free school meal eligibility)
- safeguarding information (such as court orders and professional involvement)
- special educational needs (including the needs and ranking)
- medical and administration (such as doctors information, child health, dental health, allergies, medication and dietary requirements)
- attendance (such as sessions attended, number of absences, absence reasons and any previous schools attended)
- assessment and attainment (such as attainment grades, GCSE forecast grades, test results, ATL scores)
- behavioural information (such as exclusions, isolation room sanctions and detentions)
- information about free school meal and pupil premium eligibility
- information for catering management purposes ( e.g whether you have school dinners and how often)
- biometric data for the canteen’s cashless payment system (this is the measurement of your fingerprint, but not the actual fingerprint)
- identity and medical information needed for school trips and excursions
We will also use photographs or you. More details about this are in our photographic images section of the Data Protection and Freedom of Information Policy.
Why we collect and use pupil information
We [Mid Norfolk Academy Trust] collect and hold personal information relating to our pupils and may also receive information about them from their previous school, local authority and / or the Department for Education (DfE). We use this personal data to:
- support your learning
- monitor and report on your progress
- provide appropriate care for you; and
- assess the quality of our services
- to keep children safe (food allergies, or emergency contact details)
- to comply with the statutory duties placed on us by DfE data collections
- support the careers service and further education, apprenticeship and employment providers when you leave Neatherd
For pupils enrolling for post 14 qualifications, the Learning Records Service will give us the unique learner number (ULN) and may also give us details about your learning or qualifications.
The use of your information for these purposes is lawful for the following reasons:
- The Academy Trust is under a legal obligation to collect the information or the information is necessary for us to meet legal requirements imposed upon us such as our duty to safeguard pupils.
- It is necessary for us to hold and use your information for the purposes of our functions in providing schooling and so we can look after our pupils. This is a function which is in the public interest because everybody needs to have an education. This means we have a real and proper reason to use your information.
- We will not usually need your consent to use your information. However, if at any time it appears to us that we would like to use your personal data in a way which means that we would need your consent then we will explain to you what we want to do and ask you for consent. This is most likely to be where we are involved in activities which are not really part of our job as an Academy Trust / School but we are involved because we think it would benefit our pupils. If you give your consent, you may change your mind at any time. If we think that you will not understand what we are asking then we will ask your parent or carer instead. Usually, we will involve your parents even if you can make your own decision.
How we collect pupil information
When we collect personal information on our forms, we will make it clear whether there is a legal requirement for you / your parents to provide it, whether there is a legal requirement on the school / academy trust to collect it. If there is no legal requirement then we will explain why we need it and what the consequences are if it is not provided.
We will also obtain information from your previous school, usually via secure file transfer from your previous school.
When we give your information to others
Once our pupils reach the age of 13, the law requires us to pass on certain information to Norfolk County Council who have responsibilities in relation to the education or training of 13-19 year olds. We may also share certain personal data relating to children aged 16 and over with post-16 education and training providers in order to secure appropriate services for them. A parent / guardian can request that only their child’s name, address and date of birth be passed to Norfolk County Council by informing Mrs Daniels, the Data Manager. This right is transferred to the child once he / she reaches the age 16. For more information about services for young people, please go to our local authority website https://www.norfolk.gov.uk/
We also share your information with Beacon East, our contracted Careers Advice provider. Their Data Protection Policy is attached to the policy of ours. This helps our careers advisor support you in the careers interviews you receive from year 9 onwards.
We will not give information about our pupils to anyone without your consent unless the law and our policies allow us to do so. If you want to receive a copy of the information about you that we hold, please contact:
The Data Protection Officer at firstname.lastname@example.org
We are required, by law (under regulation 5 of the Education (Information about Individual Pupils) England Regulations 2013, to pass some information about our pupils to the Department for Education (DfE). This is the part of the Government which is responsible for schools. This information may, in turn, then be made available for use by the Local Authority.
The DfE may also share information about pupils that we give to them, with other people or organisations. This will only take place where the law, including the law about data protection allows it.
The National Pupil Database (NPD)
The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.
We are required by law, to provide information about our pupils to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013.
To find out more about the pupil information we share with the department, for the purpose of data collections, go to https://www.gov.uk/education/data-collection-and-censuses-for-schools.
To find out more about the NPD, go to National pupil database: user guide and supporting information - GOV.UK.
The department may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:
- conducting research or analysis
- producing statistics
- providing information, advice or guidance
The Department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:
- who is requesting the data
- the purpose for which it is required
- the level and sensitivity of data requested: and
- the arrangements in place to store and handle the data
To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.
For more information about the department’s data sharing process, please visit:
For information about which organisations the department has provided pupil information, (and for which project), please visit the following website: https://www.gov.uk/government/publications/national-pupil-database-requests-received
To contact DfE: https://www.gov.uk/contact-dfe
We will also normally give information about you to your parents or your main carer. Where appropriate, we will listen to your views first. We will also take family circumstances into account, in particular where a Court has decided what information a parent is allowed to have.
We will also disclose your personal data to:
- Your new school if you move schools
- Disclosures connected with SEN support – e.g. non-LA professionals [such as education psychologists or SEN specialists]
- School nurse
- School Counsellor
- CAMHS (Child and Adolescent Mental Health Service)
The information disclosed to these people / services will include sensitive personal information about you. Usually this means information about your health and any special educational needs or disabilities which you have. We do this because these people need the information so that they can support you.
Our disclosure of your personal data is lawful for the following reasons:
- The Academy Trust is under a legal obligation to disclose the information or disclosing the information is necessary for us to meet legal requirements imposed upon us such as our duty to look after our pupils and protect them from harm.
- It is necessary for us to disclose your information for the purposes of our functions in providing schooling. This is a function which is in the public interest.
- There is a substantial public interest in disclosing your information because it is necessary to keep our pupils safe from harm.
- We may not need consent to disclose your information. However, if at any time it appears to us that we would need consent then we will ask before a disclosure is made.
It is in your interests for your personal information to be passed to these people or services. If we need consent to pass on your information, we will ask you for consent once we think that you can understand what we are asking. This is because the law requires us to ask you if you can understand. Normally, we involve your parents too. By law we won’t need their consent if you can give it but parents like to be involved because it is part of looking after you. Before you are old enough to understand we will ask your parents to consent for you.
We do not normally transfer your information to a different country which is outside the European Economic Area. This would only happen if one of your parents lives abroad or if you move to a new school abroad. If this happens we will be very careful to make sure that it is safe to transfer your information. We will look at whether that other country has good data protection laws for example. If we cannot be sure that it is safe then we will talk to you and your parents about it and make sure that you are happy for us to send your information. As this is not something we normally do and we don’t know which country we might need to send your information to, we cannot tell you more about it now but if we want to transfer your data to a different country then we will tell you whether or not we think it is safe and why we have decided that.
How long we keep your information
We only keep your information for as long as we need to or for as long as the law requires us to. Most of the information we have about you will be in our pupil file. We usually keep these until your 25th birthday unless you move to another school in which case we send your file to your new school. We have a policy which explains how long we keep information. It is called a Records Retention Policy and you can ask the Data Protection Officer for a copy.
You have these rights:
- You can ask us for a copy of the information we have about you
- You can ask us to correct any information we have about you if you think it is wrong
- You can ask us to erase information about you (although we may have good reasons why we cannot do this)
- You can ask us to limit what we are doing with your information
- You can object to what we are doing with your information
- You can ask us to transfer your information to another organisation in a format that makes it easy for them to use.
There is more information in our Data Protection Policy or you can ask the DPO.
The policy can be found at http://neatherd.org/Policies/ or you can ask for a copy at reception.
You can complain about what we do with your personal information. If you are not happy with our answer to your complaint then you can complain to the Information Commissioner’s Office:
Information Commissioner's Office
Tel: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number.
This page was last updated on 15th July 2019.