News

Following the popularity of our recent CCTV webinar, we've published some pointers for headteachers, governance professionals, head of operations and estates managers about CCTV compliance.

We discuss the legal obligations and common pitfalls of CCTV surveillance under the UK GDPR and Data Protection law.

Legal Foundations for Organisations

To operate CCTV lawfully, organisations must move beyond just installing camera.

• Lawful basis - every camera must have a lawful basis.
• DPIA - is mandatory and should be completed before installation to prove the system is necessary and proportionate/
• Special category data - CCTV cameras capture sensitive information (i.e. race, health/disability), which requires a specific article 9 condition for processing.

High Risk Locations: Toilets & Changing Rooms

Placing cameras in or near private areas carries extreme legal risk under the Human Rights Act 1998.

• Expectation of Privacy: pupils and staff have a high expectation of privacy in toilets.
• Proportionality Test: you must prove that less intrusive methods failed before installing CCTV. This might include increased supervision, better lighting, vaping sensors for example.
• Criminal Liability: capturing intimate footage of minors can lead to criminal changes.

Top 10 CCTV Compliance Essentials

Summary Checklist

1. Appoint/Consult a DPO for all CCTV decisions.

2. Layer your notices: Short signs at entrances, full policy on the website.

3. Be transparent: Tell parents and staff why and where cameras are used.

4. Report Breaches: If footage is lost or misused, you must notify the ICO within 72 hours.

Contact for Support: Data Protection Education provides DPO services, DPIA templates, and redaction support. Email: This email address is being protected from spambots. You need JavaScript enabled to view it. | Phone: 0800 0862018

DPE Customers Resources

DPE customers have access to the CCTV Best Practice Area which includes signs, template policies and guidance. We can also do a review of the CCTV when visiting during our data walks (Making the Rounds) or we can come and do a full CCTV Audit.  Customers may also choose to complete the CCTV Checklist as part of their compliance documentation.

The DfE has announced a new update to the DfE Digital Cyber Security Standards for Schools and Colleges.

The DfE Wireless Networks is part of the DfE Digital Standards guidance and has recently been updated to include references to Wi-Fi7. You must check with this standard before you plan any Wi-Fi upgrades!

What's New?

There is a now clear guidance that specifies that any new wireless solution or upgrade must, at a minimum, meet the Wi-Fi 8 standard.

What is Wi-Fi 7?

Wi-Fi 7 provides significantly higher throughput and lower latency. In a classroom where 30 students might simultaneously stream high-definition educational videos or engage in augmented reality (AR) lessons, Wi-Fi 7 ensures the connection remains stable and fast.

What is the DfE Wireless Network Standard?

The Wireless Network Standard is part of the set of DfE Digital Standards and one of the main core six which the DfE require schools to be meeting by 2030.

The core sections are:

🛜Wireless Standard

• A high performance solution is needed to make sure that the speed of the connection does not slow down as more devices connect to the wireless network.

🛜Wireless Signal

• A good wireless connection relies on signal strength. It's important to make sure there is strong signal coverage in all areas of your school or college where mobile devices are to be used.

🛜Central Management

• A wireless network will be made up of many wireless access points. A central management solution will allow your support team to monitor and configure your network and identify and resolve issues.

🛜Security Features

• Your school or college IT networks should prevent access by unauthorised users while providing access to regular and guest users.

Wireless Checklist:

When do I need do this?

Whenever you upgrade or change your current Wireless Network, review the latest guidance in the DfE Wireless Network Standards to ensure you are meeting the standard. 

You should upgrade or change your network if it is no longer meeting your device requirements.

DPE Tracker Update

• Replaced Wi-Fi 6 with Wi-Fi 7 reference and question.
• Added clear statement about the DfE Cyber Security Standards being one of the six core standards.
• Additional links to the Cyber Security Standard as a dependency.

Where do I start?

If you're unclear about where to start with this, we would advise initially assigning an SLT digital lead in your organisation and work from there. The responsibility of meeting the standard lies with the school, it is up to you to ask your IT provider if you are meeting the standard and how to meet the standard.  The DfE Digital Standards are a series of standards in document form that help you work towards being cyber resilient in all aspects of the organisation.

Making the Rounds: we will ask some of these questions when we come and visit your school or trust as part of our Making the Rounds or data walk.  We will then provide feedback via a report.

Just at the start of the Easter holidays, an IT system called C2K was the target of a cyber attack. The attack disrupted access to digital tools used by schools across Northern Ireland at a critical point ahead of the exam season. 

🔄☁️ Having a robust backup is being prepared against data loss and data theft.  March 31st is World Backup day to remind everyone of the importance of having a robust and accessible backup.

St Anne's Catholic School in Southampton has been forced to close four days after a cyber attack.

We're pleased to share our Acceptable Use Policy & Agreement for volunteers in response to our customer's requests.

This policy ensures the volunteers in your organisation use school technology responsibly and protect the personal data of pupils and staff. 

We typically see a spike in Subject Access Requests (SARs) at the end of term.  Understanding how to recognise and response to these requests is vital for staying compliant with Data Protection Law.

Did you know there is an increase in cyber attacks on a long weekend? Long weekends and holidays are 'peak season' for hackers who exploit reduced oversight.

A paper archive is a physical collection of documents, records and contracts stored in their original hard-copy form.  This article discusses best practice guidance for keeping records, safe, secure and accessible - an archive is much more than just a 'storage unit'.

Schools are increasingly required to manage sensitive information in ways that balance transparency, fairness, and data protection. One area that frequently creates confusion is the difference between redaction undertaken for a Subject Access Request (SAR) and redaction applied when preparing documentation for a Permanent Exclusion (PEX) Review Panel. The Redaction Guide for PEX Panels has been introduced to address this issue and provide clear, practical guidance for staff.

On March 11, threat actors breached Stryker's network via a unique cyber attack - while the data was removed and then devices wipes, the method of entry into Stryker's network is key to improving your own cyber resilience.

From filing to shredding: Master the entire data lifecycle with our simple guides. We're excited to launch our FREE Records Management Toolkit:  3-Minute Data Sweep, Data Protection Records Management Handbook and our Records Management Reference Sheet.

We know the jargon can be confusing. As can the timelines for responding to the various requests that you receive. Whether it’s an email from a disgruntled parent or a letter from a solicitor, the clock starts ticking the moment it hits your inbox. But before you start pulling files, you must answer one critical question: What exactly are you looking at?

We've uploaded a Subject Access Request Extension Template to the SAR Best Practice Library.

We're already seeing the leavers' hoodies when we're visiting schools and our help desk has received tickets asking about year book administration, so here's some best practice about 'Leaver's Memorabilia'.

📸✅ It's World Book Day on the 5th March when most schools will be celebrating reading and capturing photos of staff and students in their costumes.   Given this is one of many significant photographic events in the calendar, we thought it was a good opportunity to remind everyone of photo and video best practice so there are no data protection slip ups.

Please ensure that you register DPE as your DPO with the Information Commissioner's Office.  Please note we have updated our registered address!

Sharing personal data with a third-party organisation?

Supplier due diligence is about the contracts between controllers and processors.  As a controller you determine the purpose and means of the processing (Article 4 (7)) and are responsible for ensuring processors  (i.e. suppliers and third-parties) have implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk for any data processed. 

One of the simplest ways to reduce the risk of a data breach on your organisation's premises is to establish a Clear Desk and Screen Policy. Beyond just tidy classrooms and offices, this initiative protects sensitive student data and staff privacy.

🛡️Are your School's Digital Gates Secure?  Governors are the gate keepers to cyber security. Today, as we celebrate School Governor's Day, it's the perfect time to ask the question that is critical right now: how do we protect our schools in a digital world?

📢📢 Come and register for our new Data Protection Education webinars for 2026! 

The Data (Use and Access) Act is already law and It received Royal Assent on June 19, 2025. While it is legally an Act of Parliament, its various provisions are being "commenced" (brought into legal effect) in a phased approach that will continue throughout 2026.

Join us for our latest podcast episode breaking down the key changes introduced by the UK's new Data (Use and Access) Act (DUAA), explaining its phased rollout and objectives.  The DUAA becomes law on Thursday 5th February 2026.

A recent ICO reprimand for the Staines Health Group, shows the importance of how special category deserves specific protection. This article highlights the risks associated with 'data dumping' when organisations overshare sensitive information excessively - when the sharing of sensitive safeguarding becomes the safeguarding issue.

The SEROCU (South East Organised Crime Unit) has advised schools across Surrey and Sussex to be aware of a rise in M365 phishing emails.

In a world of hybrid work and virtual meetings, the ability to record and transcribe discussions has become an essential tool for productivity.  However, with this convenience comes a responsibility to protect privacy, maintain security and consider your lawful basis for recording/transcribing.  To provide clear guidance we are introducing our new Recording and Transcription Policy Template.

We've had a few questions recently about parents and students recording conversations with members of staff, both covertly or overtly without seeking permission. This article only covers recordings made by external individuals, not organisations or individuals acting on behalf of an organisation.

The DfE previously issued training and guidance about the use of AI in Education - this has now changed to standards.  Standards define minimum requirements that must be met, whereas a guideline offers recommended best practice or advice. The standards outline the safety standards that generative AI products and systems should meet to be used in educational settings.

Finding the right IT partner and support provider is a big decision.  Due diligence for IT Support isn't just about who can 'fix computers', it's about ensuring standards are followed and they work with you to meet your organisation's strategy. Data Protection Education has a DfE IT Support Tracker and Supplier Due Diligence Directory to provide support and guidance as well as tracking your progress.