We recommend every multi academy trust we work with having a named Data Protection Governance Lead. We explain what the role involves, how it differs from the Data Protection Officer (DPO) and  the Data Protection Champion, the training we expect, and the new resources available to help you.

What is a Data Protection Governance Lead?

The Data Protection Governance Lead is the named person who makes data protection happen across a whole trust. They keep practice consistent in every academy, coordinate the Data Protection Champions and report to senior leaders and the board.

The role goes by many titles, including Information Governance Manager, Data Protection Lead, Governance Professional or Head of Governance. The title matters less than three things: the person is named, they have the time and authority to do the job, and they are not also acting as the trust's DPO.

The Governance Lead is not a role set out in law, but in our experience no trust can evidence compliance without one.

What the Governance Lead does

• ✅ Is the main point of contact between the trust and Data Protection Education (DPE)
• ✅ Coordinates the Data Protection Champions in each academy, so practice is consistent across the trust
• ✅ Makes sure policies are adopted, reviewed on schedule and published
• ✅ Keeps the Record of Processing Activities and supplier information current across the trust
• ✅ Makes sure DPIAs and supplier checks happen before new systems or AI tools are bought
• ✅ Oversees subject access requests and breaches, so they are logged and handled consistently
• ✅ Tracks compliance against the ICO Accountability Framework and works with IT on the DfE Digital and Technology Standards
• ✅ Puts data protection on the board agenda and takes DPO reports to trustees

The Governance Lead and the DPO

Every academy trust is a public authority and must appoint a DPO. DPE fulfils that role for our customers. The two roles work closely together, but they are different:

• ✅ The trust decides. The Governance Lead makes and records decisions on the trust's behalf.
• ✅ The DPO advises. DPE gives independent advice on the trust's obligations under data protection law.
• ✅ The DPO checks. DPE monitors compliance and reports directly to the highest level of management.

Because the Governance Lead makes decisions about how personal data is used, they should not also be the trust's DPO. A DPO can only take on other duties if they do not create a conflict of interest, otherwise they would be advising on, and monitoring, their own decisions. The ICO's guidance on data protection officers explains this in more detail.

In short: the trust owns compliance, the Governance Lead makes it happen, and the DPO tells the board honestly whether it is working.

Training and qualifications

As a minimum, DPE suggests every Data Protection Governance Lead to complete the ICO's free Data Protection Essentials training. Beyond that, we suggest training in proportion to the size and complexity of the trust:

• ✅ Part of a wider role, in a small trust: DPE's Governance Lead onboarding and e-learning
• ✅ A significant part of the role, in a medium trust: a practitioner-level qualification, such as the BCS Practitioner Certificate in Data Protection or the Act Now UK GDPR Practitioner Certificate
• ✅ A dedicated post, in a large or growing trust: a practitioner-level qualification as above, or the IAPP CIPP/E and CIPM

A qualification is a starting point, not a finish line. We expect Governance Leads to complete annual refresher training and to keep up with DPE updates each term.

What DPE asks of the trust

Our independence as your DPO depends on the trust doing its part. Our Data Protection Governance Lead Charter sets out the commitments we ask every trust to make, including:

• ✅ Name a Governance Lead with a senior sponsor, a deputy for cover and protected time for the role
• ✅ Involve the DPO early, before new systems, suppliers or AI tools are bought
• ✅ Report breaches promptly and log them on the Knowledge Bank, so we can advise in time
• ✅ Keep a direct route to the board, so DPO reports reach trustees in full
• ✅ Run a champions network, with a trained Data Protection Champion in each academy

In return, DPE provides independent advice, regular reviews with the Governance Lead, and reports the board can take straight into its papers. The DPE Knowledge Bank gives the Governance Lead one best practice platform for the whole trust, with the guidance, tools and training they need in one place. We also advise on subject access requests, and trusts that have added our full SAR management and redaction service can pass the full request to us.

How it fits together

1. Staff raise questions and concerns with their Data Protection Champion.
2. The Data Protection Champion handles routine matters in their academy and logs issues (operational).
3. The Data Protection Governance Lead keeps practice consistent across the trust and reports to the board (strategic).
4. DPE, as your DPO, gives independent advice and checks it is working (advisory).

Read more about the champion role in The Data Protection Champion Role. In a single school, a member of the senior leadership team usually takes on the Governance Lead's strategic responsibilities.

If you are recruiting

Trusts are increasingly creating dedicated posts for this role. Before you advertise, check that the job description:

• ✅ says whether the post works alongside an external DPO, and doesn't designate it as the DPO if it also chooses systems or runs operational processes
• ✅ states the training or qualification expected, or a commitment to gain it within an agreed time
• ✅ includes protected time, a CPD budget and responsibility for the champions network
• ✅ sets out the reporting line, and confirms the DPO keeps a separate direct route to the board

If you already use DPE as your DPO, talk to us before the role is advertised. We can help shape the job description so the new post and our service fit together.

New resources for customers

We have added a Data Protection Governance Lead area to the Best Practice Area. It includes:

• ✅ Data Protection Governance Lead: Role Description Purpose, responsibilities, person specification and training, ready to adapt for a job pack
• ✅ Who is your data protection governance lead? A poster to add your champion's name and display in the staffroom and school office
• ✅ Which DPE tools does each role use? An at-a-glance guide to the Knowledge Bank tools for the Governance Lead and the champion

You don't have to do it alone

The Governance Lead runs data protection across the trust, but they are not on their own. Your DPO is there to advise, and your champions handle the day-to-day in each academy. If you're not sure where to start, This email address is being protected from spambots. You need JavaScript enabled to view it..