Best Practice Update

    You are here:  
  1. Home
  2. Best Practice Update
  3. The ICO Reprimands a school
Official DfE Data Protection Guidance banner for schools, featuring the new DUAA compliance checklist.
Best Practice Updates

On 14 October 2026 the Department for Education (DfE) replaced the Data (Use and Access) Act chapter of its Data protection in schools guidance with a new, practical DUAA compliance checklist for schools. The previous chapter told schools to review their procedures and promised more information "in due course". This is that information: eight themed checklists setting out what changed and what schools are expected to do about it.

Consultant and school data protection lead discussing compliance during a "making the rounds" audit.
Best Practice Updates

Most organisations will ask us to come and do a data walk at some point, when one of our consultants will visit your site and walk around with your data protection lead.  If you are a DPO Assure customer, it is included as part of your SLA, but it is also possible to purchase a visit from one of our school consultants. 

Understanding "making the rounds" audits, the 12-point compliance framework, and what schools should expect from a report

Professional portrait of Ralph T O'Brien, expert on AI and data protection for schools and multi
Best Practice Updates

We present an article written by our Featured Guest Expert Ralph T O'Brien for our school and multi academy trust customers about using AI in schools and trusts. Ralph O’Brien is a global privacy and data protection professional with over 25 years’ experience helping organisations manage data protection and privacy risk, prevent data harms, and build practical, trustworthy information governance programmes

Artificial Intelligence is shorthand for more automation.  Less humans, more machines.  AI is already in schools, and not because the headteacher has approved an AI strategy. Not because the governors have discussed it.

Digital graphic displaying a cyber security alert, warning schools about sophisticated payroll fraud and online threats.
Best Practice Updates

Schools across the Thames Valley area are being targeted by criminals attempting to access staff payroll accounts, according to a warning issued by the South East Cyber Crime Unit's Cyber Protect team. In several confirmed cases, the attacks have succeeded, leaving affected staff without their pay after criminals diverted their salaries elsewhere.

Graphic promoting the KCSIE 2026 online course, essential annual training for education staff
Best Practice Updates

Keeping Children Safe in Education is the statutory guidance every school, college and MAT must work to, and every member of staff needs to understand it, every year, without exception. Our new KCSIE 2026 course is now live in your DPE training portal, built to make that annual refresh straightforward, accurate, and genuinely useful, not just a box-ticking exercise.

Digital screen interface representing a school Management Information System (MIS) handling pupil records and DfE
Best Practice Updates

A Management Information System (MIS) is the single most important data processing system a school operates. It holds pupil records, including special category data, safeguarding information, and family contact details. So when the Department for Education publishes guidance on choosing one, DPOs and data protection leads should pay attention, even when, as here, the guidance is framed in commercial rather than data protection terms.

  1. DfE Procurement Risk Guide: Due Diligence and Data Protection for Trusts | DPE
  2. DfE Data Protection Advice for Schools
  3. KCSIE 2026 Data Protection Changes: What Schools Need to Know
  4. Important Guidance for Schools: Record Retention and the Statutory Independent Inquiry into Grooming Gangs
  5. DfE Cyber Security Standards for Schools: June 2026 Update | DPE
  6. ICO EdTech Audit 2025: Key Findings for Schools | DPE
  7. DfE updates Data Protection in Schools guidance: what schools need to know
  8. The DSL’s Guide to Filtering and Monitoring
  9. Human Error and High Stakes: What the Horizon Academy Trust Incident Teaches Us About School Data Breaches
  10. Reducing risk on World Environment Day and Beyond
  11. Navigating the Future: 2026 Privacy Updates, Data Access, and Student Wellbeing
  12. Can you use AI safely in schools?
  13. Guardians of Privacy: Social Media, Privacy, Children and the AI Threat
  14. Visitor Management: A Guide for Schools
  15. Under surveillance: Why your organisation's CCTV might not be compliant
  16. Update to the DfE Digital Cyber Security Standards for Schools and Colleges
  17. Wireless Network Standards for Schools & Colleges: What's New?
  18. World Backup Day: Backups - Your Safety Net
  19. School Cyber Attack: St Anne's Catholic School
  20. Volunteer Acceptable Use Policy & Agreement
  21. Handling Subject Access Requests (SARs) - at the end of term
  22. How should schools manage paper archives?
  23. Navigating the Redaction Divide: SAR or PEX?
  24. Records Management Toolkit: Where do I start with records management?
  25. What type of request have you received? SAR? Educational Record? Or FOI?
  26. SAR Extension Template
  27. Leavers' Memorabilia
  28. Sharing photos on World Book Day: Privacy considerations
  29. Make sure DPE is your registered DPO with the ICO
  30. Supplier Due Diligence Step by Step: Are you sharing personal data with a third party organisation?
  31. Time to kick-start your Clear Desk and Screen policy?
  32. Are Governors the Frontline of Cyber Security? (February 12th is Governors Awareness Day)
  33. DPE Webinar Schedule
  34. The Danger of the 'Data Dump': Why more information isn't always better!
  35. Introducing our new Recording and Transcription Policy
  36. Parents and students covertly recording conversations
  37. New DfE AI Standards
  38. Shareable Snippet: Office Security Best Practices for the Holidays
  39. CCTV Policy update: retention
  40. Shareable Snippet: Confidential waste
  41. Sharing information to safeguard children and young people in the education sector in the UK
  42. Fraud awareness from the DfE
  43. Complaints vs. Data Rights: A Guide
  44. Data Breach: School sends out names and contact details in a spreadsheet.
  45. September 2025 Policy and Document Updates
  46. KCSIE 2025: Data Protection, AI, and Cyber Security
  47. The Online SCR Data Breach: What You Need to Know
  48. Back to School Basics for Data Protection and Cyber Security Compliance
  49. Building a Secure School: Using the ICO Accountability Framework to Meet DfE Digital Standards
  50. Why Physical and Data Security Must Go Hand-In-Hand
  51. Digital Safeguarding: DfE announces statutory DfE Digital Standards
  52. The Data Protection Lead/Champion Role
  53. Changes to the Academy Trust Handbook 2025
  54. Social Media Day 2025
  55. How Ofsted looks at AI during inspection and regulation
  56. Preschool Employment tribunal for the use of WhatsApp
  57. Data Breaches 2025 Report Highlights
  58. Not everyone needs access: The Key to Protecting Sensitive Data
  59. West Lothian Schools in Cyber Attack
  60. National Honesty Day: Transparency
  61. FOI Request - BBC News
  62. Social Media and Marketing Guidelines and Training
  63. New Governor Resources
  64. Does stress lead to more data breaches?
  65. Are teachers using AI? 83% say its a time-saver
  66. DfE Digital Standards - narrowing the digital divide
  67. Arbor AI - On By Default
  68. DfE Guidance: Choosing a new MIS
  69. HCRG Care Group data breach
  70. The Importance of AI literacy and training staff
  71. Short Guide to AI Video
  72. Safer Internet Day, Cyber Security & Data Protection
  73. The Cyber Resilience Championship
  74. The Multiple Dimensions of Supplier Due Diligence
  75. School shares sensitive pupil information as part of an FOI response
  76. Blacon High School Cyber Attack
  77. WhatsApp and FOI's: ICO Warnings
  78. New AI Guidance from the DfE
  79. What the proposed Government legislative proposal around cyber crime means
  80. ICO report on AI tools in recruitment
  81. DfE update to record keeping and management
  82. Update to data sharing for school immunisation programmes
  83. Early Years Settings and Cyber Security
  84. SLT Digital Lead Profile
  85. The role of governors in cyber security and data protection
  86. Navigating Privacy at the End of Term , Special Occasions and End of Year
  87. Contracts Register
  88. DfE Digital Standards Autumn Update
  89. The importance of knowing how to access your CCTV footage!
  90. Cyber Attack on a Special School
  91. Stealing children's data
  92. What is dark data? (and why does it matter?)
  93. Ofqual highlights the value of cyber security training in schools
  94. Searching for data when you receive a Subject Access Request
  95. Fylde Coast Academy Trust Cyber Attack This Week
  96. Calling all IT leads in schools and mult academy trusts!
  97. Ransomware cyber attack on a school in Bromley
  98. Join Our Social Media Family!
  99. School hit by Cyber Attack
  100. Cyber Security Best Practice Area
  101. DfE Digital Standards for Schools and Colleges Tracker
  102. New Policies, Documents, Letters and Posters page
  103. Schools and Trusts Best Practice Area
  104. The DPE Retention Schedule
  105. ESFA Cyber Essentials Requirement for Colleges from 2024/2025
  106. ICO Reprimands a School
  107. Out of date technology
  108. Data Retention and the Pupil File
  109. Have you assigned your SLT Digital Lead yet?
  110. Getting Started with AI (Artificial Intelligence)
  111. Cyber attack on a school during half term
  112. The rise of cyber attacks in schools are causing pupils to miss classes
  113. ICO: Learning from the mistakes of others report
  114. Cyber attack on a Trust; the aftermath
  115. School Focus: The Vale Federation | Aylesbury
  116. DfE Dealing with Subject Access Requests (SARs) Guidance
  117. Update to the Guidance on Information Sharing from the DfE
  118. FOI Requests generated by Artificial Intelligence
  119. Social Media Best Practice Area
  120. Lettings Best Practice Area
  121. MFA Bombing - What is it?
  122. Protecting your Social Media Accounts
  123. Checklists - Are They Your Most Powerful Compliance Tool?
  124. Product Focus on Checklists : Initial Trust Plan
  125. Product Focus on Checklists : End of Term Checklist
  126. Product Focus on Checklists : Information and Cyber Security
  127. Product Focus on Checklists : Social Media
  128. Product Focus on Checklists : Lettings
  129. Product Focus on Checklists : Record of Processing
  130. Milk Island: The secret location that allows children to view restricted content on Google Maps
  131. Why Data Should Stay Put: Benefits of Keeping Data in Its Original System
  132. Product Focus on Checklists : Data Retention and Destruction
  133. Product Focus on Checklists : Data Migration
  134. Product Focus on Checklists : Biometrics
  135. Product Focus on Checklists : Supplier Due Diligence
  136. Free Cyber help, advice and training with the Cyber Resilience Centres
  137. The Perils of Paper: The Printing Vulnerability
  138. Product Focus on Checklists : FOI
  139. Product Focus on Checklists : Governors and Data
  140. Product Focus on Checklists : DPIA
  141. Product Focus on Checklists : Site Moves
  142. Product Focus on Checklists : Data Breaches
  143. Product Focus on Checklists : Subject Access Requests
  144. Product Focus on Checklists : Bring your own device
  145. Product Focus on Checklists : Working out of school/offsite
  146. Cyber Attack on a School
  147. Product Focus on Checklists : Redaction
  148. Why Due Diligence is Important: Fake apps
  149. Product Focus on Checklists : CCTV
  150. Product Focus on Checklists : Clear desk
  151. Product Focus on Checklists : Commitment to compliance
  152. Product Focus on Checklists : Photos and video
  153. Product Focus on Checklists : Passwords
  154. Product Focus on Checklists : Information Classification
  155. Free cyber training for staff
  156. DfE Digital Standards Update
  157. The Mother of all Breaches
  158. International Data Transfers (part 1): Navigating Cross-Border Data Transfers: Understanding EU SCCs, UK Addendum, and UK IDTA
  159. ClassCharts Possible Data Breach
  160. Where is your data stored?
  161. IAPP looks at AI privacy risks
  162. If you suspect a financial scam .....
  163. School Focus: St Bernadette's Catholic Primary School | Brighton
  164. Guardians of Privacy: 16. Social Media Checklist
  165. Guardians of Privacy: 15. Navigating Social Media in Educational Settings Summary
  166. Guardians of Privacy: 14. Social Media and Cyber Bullying
  167. Guardians of Privacy: 13. Social Media, Copyright and Intellectual Property
  168. Guardians of Privacy: 12. Social Media and Going Viral
  169. Guardians of Privacy: 11. Staff Social Media Accounts
  170. Guardians of Privacy: 10. Social Media and Cookies
  171. Guardians of Privacy: 9. Social Media and Morality
  172. New Resources for Schools from the ICO
  173. Guardians of Privacy: 8. Social Media Policies
  174. Guardians of Privacy: 7. Social Media Data Retention
  175. Guardians of Privacy: 6. Posting Safely
  176. Guardians of Privacy: 5. Social Media and Consent
  177. Guardians of Privacy: 4. Social Media Access Control
  178. Guardians of Privacy: 3. Social Media Channels
  179. Guardians of Privacy: 2. Law and Regulations
  180. The ICO reprimands a Multi Academy Trust
  181. Guidance for the use of school email and applying email retention in schools
  182. Data Protection Tips for Early Years Settings
  183. Children's Privacy around the world is a puzzle
  184. Trust Initial Plan Checklist Update
  185. Records Management Best Practice Update
  186. What do I need to redact?
  187. Trust Initial Plan for Data Protection Compliance (for Multi Academy Trusts)
  188. Google for Education Resources: Helping IT Admins meet DfE digital and technology standards
  189. Lettings Best Practice and Guidance
  190. Considerations when migrating to a new MIS
  191. Public bodies and sensitive data
  192. Get a DPE Badge for your website!
  193. ICO: 10 Step guide to sharing information to safeguard children
  194. Help after a Cyber Attack/Incident
  195. Data Protection and Cyber Security (Inset Day) Training Ideas
  196. How KCSIE is linked to Cyber Strategy
  197. Handling Freedom of Information Requests the right way
  198. Where's Harry the Hacker?
  199. The ICO Reprimands a school
  200. Redaction Guidelines Updated
  201. Using WhatsApp in Schools
  202. How to contact us for support, subject access requests, data breaches and FOI's
  203. FOI: Reinforced Autoclaved Aerated Concrete
  204. FOI: Henry Jackson Society
  205. FOI: Vaccination Justifications
  206. How the Record of Processing Can Help You
  207. What does a Data Protection Officer Do?
  208. Carrying out Supplier Due Diligence
  209. How Long Should You Keep Personal Data For?
  210. B&H FoI: Racist/religious incidents/bullying
  211. Protocol for Setting Up and Delivery of Online Teaching and Learning
  212. Class Dojo International Data Sharing
  213. Model Publication Scheme: Amendments, Improvements and Updates
  214. Transparency
  215. Research projects and GDPR
  216. Secure file transfer of files using Royal Mail
  217. Emergency contacts and consent
  218. Key elements of a successful DPIA
  219. FOI Publication Schemes
  220. Best Practice for Managing Photos and Video
  221. New Drip Feeds: Recognise and Respond to Subject Access Request
  222. When to contact the Data Protection Officer?
  223. National child measurement programme
  224. Headteacher fined for breach of data protection legislation
  225. Acceptable Use Policy

©2026 Data Protection Education Ltd.

Search