Information Law for Education

Our information law team understands that schools and education providers receive information requests on a daily basis, and dealing with these requests can be a significant burden. Our team provides pragmatic advice to help provide you manage requests effectively and reduce the impact on your organisation. 

For particularly complex requests, we use our extensive experience and deep sector knowledge to provide comprehensive guidance and support on matters such as identifying information for disclosure, providing guidance on the scope of searches, the application of exemptions, dealing with vexatious requests, and more. 

We advise education providers on the following types of requests:

• Subject access requests

• Freedom of information requests 

• Environmental information requests

• Parental requests for information under education laws

• Requests from the police and other investigatory bodies / external agencies

• Requests from solicitors and court orders requiring disclosure of information

We are experienced in managing all types of personal data breaches, including technical cyber-breaches. Our team has extensive experience advising where a breach has taken place, including preparing data breach notifications to the Information Commissioner’s Office and to affected individuals. We can also provide practical advice and support for organisations to help prevent and reduce personal data breaches and manage internal data breach management practices. We have developed specific policy documentation for schools to assist with this, including a data breach protocol and log. 

We advise on a full range of information law compliance matters, including obligations under data protection law (including the UK GDPR, Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR)); and the latest statutory guidance, including the Data Sharing Code of Practice and the Children’s Code.

Data protection law is constantly evolving and we pride ourselves on our ability to identify important developments for our clients. We can provide guidance on upcoming changes, including those proposed by the Data Protection and Digital Information Bill, and developments in technical areas such as EdTech and Artificial Intelligence, to help our education sector clients stay ahead of the curve.

Our information law team advises a range on commercial matters including contractual arrangements (including data processing agreements and data sharing agreements), website compliance (including cookie compliance), data protection due diligence, data transfers in the context of academy conversions and transfers, mergers and acquisitions, data sharing and compliance in the context of establishing a trading subsidiary, cloud-based solutions for storage and processing of personal data, and engaging EdTech providers. We also have far-reaching experience advising on international data transfers, including preparation of standard contractual clauses and advice on sharing personal data under the Transatlantic Data Privacy Framework.

We understand that not all information law issues fit neatly into categories and we have extensive experience advising education providers on a wide range of matters that intersect with information law. We work closely with our clients to identify their objectives and provide solutions. Examples of our wider work in the education sector include: advice on biometrics in schools, CCTV and use of pupil images, delivery of remote education, fundraising and wealth profiling for independent schools, complaints and claims, and data sharing in the context of parental disputes.

We have developed a Toolkit for the education sector: a suite of documentation to help you meet your accountability obligations. This includes template privacy notices and policy documentation, as well as other helpful templates such as data mapping guidance and questionnaires, data processing agreements and more. 
For more information about out policy and guidance offering, please click here. 
 

We understand that carrying out full audits is sometimes necessary, but can be extremely time intensive and expensive. We have therefore developed compliance health checks and reviews specifically tailored to education providers to help you identify compliance issues before they become a problem. 
Our reviews offer a quick and effective insight into your organisation’s data protection compliance practices to help issue spot and understand where to focus your resources. Our health checks offer a more in-depth assessment, that can efficiently and accurately capture information about your organisation and provide tailored guidance and recommendations.
 

We offer bespoke data protection training options for schools and other education providers. We work closely with you to identify your organisation’s needs in order to provide tailored and practical training to ensure your staff understand and comply with their obligations.