The Challenge: Moving Away from "Scatter-Gun" Displays

For years, many schools have displayed pupil medical lists on open staffroom noticeboards, corridor walls, or classroom walls.

Displaying sensitive health information in public or semi-public areas is not only an outdated practice, it is likely to be a personal data breach under UK GDPR. Conversely, withholding health details out of fear of data privacy laws creates severe safeguarding risks.

Data protection law does not prevent sharing: it is the framework for doing it safely.

---

1. The Core Solution: The SSCIP Framework

The guide introduces the SSCIP (Secure Safe Care Information Point): a designated, controlled space that holds accurate allergy and medical information for pupils. The SSCIP replaces scattered displays across staffrooms, classrooms, and offices by consolidating health data into a secure, managed location.

What the SSCIP Looks Like:

• Located in a secure, staff-only area (never an unlocked staffroom or public corridor).
• Holds current, accurate medical information for named pupils.
• May be a secure board or a locked folder depending on location safety.
• Reviewed and updated every term and whenever a pupil's information changes.
• Inaccessible to visitors, supply staff, or contractors without a clear reason to view it.

What the SSCIP is NOT:

• ❌ Not a noticeboard or general display area.
• ❌ Not accessible to visitors, contractors, or lettings providers without a lawful basis.
• ❌ Not a substitute for allergy awareness training or individual child information packs.

---

2. UK GDPR Myth-Busting: Lawful Basis for Health Data

A widespread misconception in school administration is that parental consent is required to process and share pupil allergy details.

Because allergy data is classified as Special Category health data under UK GDPR, schools require two legal bases to process it: an Article 6 lawful basis and an Article 9 condition for processing special category data.

• The Primary Basis: Public Task (Article 6 / Article 9). Parental consent is not the legal basis for processing health data in a school context.
• Emergency Handovers: When transferring data to paramedics during a emergency, the legal basis is Vital Interests (consent is not required).
• Medical Apps & Software: If your school uses third-party platforms or apps (e.g., CPOMS, Medical Tracker, MyConcern) to log allergy data, a Data Protection Impact Assessment (DPIA) and a formal Data Processing Agreement are required prior to deployment.

---

3. Role-Based Data Sharing Matrix

Under the principle of data minimisation, staff members should receive only the specific information necessary to perform their role safely.

Staff Role	What They Receive	How It Is Shared	Lawful Basis
All Staff (Teachers, Admin, TAs)	Allergy Action Plan & Individual Healthcare Plan (IHP)	Secure MIS, locked class file, or SSCIP. List owned by school office.	Public Task
Catering & Kitchen Staff	Name, photo, and allergens only (not full medical history)	Kitchen SSCIP. Reprinted each term or change. Secure destruction.	Public Task (DfE Data Protection Toolkit confirmed)
Cover & Supply Teachers	Daily cover sheet: Name, allergen, & Adrenaline Device (AD) location	Printed on cover sheet by office. Shredded at end of day.	Public Task (Data minimisation applies)
Lunchtime Supervisors	Photo alert card (name, photo, allergens, immediate response) or app access	Laminated card in folder or PIN-protected school device (read-only).	Public Task (DPIA & Data Processing Agreement required)
Paramedics on Arrival	Full medical info: Allergens, medication given, dose, and time	Hand over IHP in person. Verbally confirm key facts.	Vital Interests (Consent not required)

---

4. Mobile Data Safety: Grab Bags & Off-Site Trips

Pupil medical information doesn't remain inside the building. The guidance details how mobile packs carry exact copies of the information held in your central SSCIP so data remains accurate during evacuations and off-site activities.

Essential Mobile Rules:

1. Ownership: A named member of staff (typically the First Aid Lead, SENCo, or Office Lead) must own and maintain both packs.
2. Synchronised Updates: Grab bags and trip packs must be updated simultaneously with the SSCIP.
3. Third-Party Security: Never disclose pupil health information to venue staff, activity providers, or contractors without a lawful basis and appropriate data-sharing agreement.
4. Physical Security: Bags must never be left unattended or accessible to unauthorized individuals.

---

5. Compliance & Policy Checklist for September 2026

To ensure your school meets statutory safety and data protection standards ahead of the new academic year, confirm the following requirements:

• Allergy Safety Policy: Published on the school website and reviewed annually. Governors must ensure it is in place, with a named Governor recommended.
• Named Allergy Lead: A designated Senior Leader must be appointed as the school Allergy Lead.
• Spare Adrenaline Devices (ADs): Stocked, never locked away, and reachable within 5 minutes from anywhere on the school site.
• Whole-Staff Training: Training completed for all staff (not just first aiders) and training records maintained as evidence of compliance.
• Lessons Learned Reviews: A formal review process established to document and review any allergic reaction or near-miss.
• Lettings & Clubs: External lettings operators briefed on emergency procedures at the start of every term with data-sharing agreements in place.

---

📄 Download the Official Guidance Document

Access the complete 3-page guide co-authored by Data Protection Education and Anaphylaxis UK:

📥 Download "Sharing Pupil Allergy Data Safely Guidance" (PDF)

📽️Watch a Short Video about Sharing Pupil Allergy Information Safely