Cyber security and data protection sit side by side. Cyber security protects the systems; data protection governs what happens to the personal data inside them. In a school, that data is mostly about children, so the stakes are higher than in most sectors.
Yesterday we looked at why cyber security matters. Today we look at the people who protect personal data every day, and why an annual training module on its own rarely changes what they do.
October is Cyber Security Awareness Month, and this year's theme is "Don't Make It Easy for Them".
We don't think cyber security awareness is something to cover just once a year, but this month gives us a focus. Every day in October we'll share a short topic and one practical action you can take straight away.
Bromcom, one of the most widely used MIS providers in England, has confirmed a personal data breach affecting a legacy single sign-on (SSO) registration service. Bromcom is now contacting affected schools and trusts directly. If you use Bromcom, this article explains what we know so far, what you need to decide as a data controller, and the practical steps that reduce your risk, both from this incident and the next one.
On 30th September 2026, the Information Commissioner's Office formally became the Information Commission under the Data (Use and Access) Act 2025. The Commission is now run by a Board rather than a single Commissioner, but it will still be known as the ICO.
Handling Subject Access Requests (SARs) (Knowledge Bank subscribers) involving pupils is rarely straightforward. A recent helpdesk scenario put a school in a particularly difficult position: a 14-year-old pupil disclosed that her parents had pressured her into signing a form authorising them to request her personal records.
Annual data protection training works well for core staff, but it often misses the people who arrive at short notice or whose roles don't look like "data" jobs: supply teachers, cleaners, caretakers and contractors. These staff still see personal data every day, and they share their own with your organisation too. Our new training pack is built for them, including a free Quick Guide for Emergency & Supply Teaching Staff developed with Garth Hill College.
Most organisations will ask us to come and do a data walk at some point, when one of our consultants will visit your site and walk around with your data protection lead. If you are a DPO Assure customer, it is included as part of your SLA, but it is also possible to purchase a visit from one of our school consultants.
Understanding "making the rounds" audits, the 12-point compliance framework, and what schools should expect from a report
We present an article written by our Featured Guest Expert Ralph T O'Brien for our school and multi academy trust customers about using AI in schools and trusts. Ralph O’Brien is a global privacy and data protection professional with over 25 years’ experience helping organisations manage data protection and privacy risk, prevent data harms, and build practical, trustworthy information governance programmes
Artificial Intelligence is shorthand for more automation. Less humans, more machines. AI is already in schools, and not because the headteacher has approved an AI strategy. Not because the governors have discussed it.
It's been a busy summer behind the scenes of the DPE Knowledge Bank. Alongside the new academic year checklists and cyber alerts you'll have seen in our regular articles, we've been steadily updating of the portal: new courses, new guidance documents, a reorganised menu structure, and upgrades to several of the compliance tools you use every day. Here's a full round-up of what's changed.
A new academic year brings a full inbox of statutory guidance, policy refreshes and operational pressure — often all landing in the same first few weeks of term. Before the pace picks up, it's worth pausing to check that the key data protection foundations are in place. Here's what should be on your radar this September.
We've published a new e-learning module for 2026 data protection training.
Schools across the Thames Valley area are being targeted by criminals attempting to access staff payroll accounts, according to a warning issued by the South East Cyber Crime Unit's Cyber Protect team. In several confirmed cases, the attacks have succeeded, leaving affected staff without their pay after criminals diverted their salaries elsewhere.
The DfE doesn't tell you which standard to start with. Here's the reasoning we would use in your position.
Twelve standards, no prescribed sequence, and a 2030 deadline that still feels comfortably far away until it isn't. That's the position most schools and trusts are in with the DfE Digital and Technology Standards.
The integration of Artificial Intelligence (AI) into the educational landscape is moving faster than ever. While AI offers transformative potential for lesson planning, administration, and student learning, it brings with it significant data protection and safeguarding responsibilities.
Keeping Children Safe in Education is the statutory guidance every school, college and MAT must work to, and every member of staff needs to understand it, every year, without exception. Our new KCSIE 2026 course is now live in your DPE training portal, built to make that annual refresh straightforward, accurate, and genuinely useful, not just a box-ticking exercise.
The Department for Education confirmed that hackers have accessed its internal helpdesk and the Turing Scheme portal, taking more than 600,000 records. Contact details belonging to headteachers, senior school leaders, government officials and university staff were among the data taken, and some of it has since appeared on the dark web.
Understandably, this has caused a lot of anxiety across the sector and, predictably, a lot of speculation. Was this preventable? Should the DfE have done more? Who's to blame?
As schools prepare for term and statutory obligations under Benedict’s Law (taking effect from September 2026), leadership teams face a critical operational question: How do we share life-saving pupil allergy data quickly without committing a personal data breach?
A Management Information System (MIS) is the single most important data processing system a school operates. It holds pupil records, including special category data, safeguarding information, and family contact details. So when the Department for Education publishes guidance on choosing one, DPOs and data protection leads should pay attention, even when, as here, the guidance is framed in commercial rather than data protection terms.
The Academy Trust Handbook 2026 was published on 15 July 2026 and comes into effect on 1 October 2026. This year's edition strengthens the position on the DfE digital and technology standards and introduces new procurement requirements that have direct data protection implications, most notably around Management Information Systems (MIS).
On 15 July 2026, the Department for Education published How to reduce procurement risk: good practice guide for academy trusts. The guide is aimed at business managers, finance staff and others involved in procurement decision making, and follows the four phases of the procurement lifecycle: plan, define, procure and manage.
On 9 July 2026, the DfE added a new section to its Data Protection in Schools guidance: Procuring educational technology (EdTech). It sets out what schools should consider before, during and after procuring EdTech tools, and the questions to put to prospective suppliers. Significantly, it is the first DfE guidance to directly reference the ICO's EdTech Examined audit report, telling schools to take the ICO's findings into consideration when procuring EdTech tools.
A summary of the data protection changes in the new KCSIE guidance, including the Data (Use and Access) Act 2025, information sharing and child protection file transfers.
The Statutory Independent Inquiry into Grooming Gangs has issued a formal notice to preserve all documents potentially relevant to their investigation. As this is a formal statutory inquiry under the Inquiries Act 2005, schools may be required to produce relevant records to assist.
The ICO's edtech audit programme, covering 28 providers used across UK primary and secondary schools, has resulted in one of the most significant data protection reports to affect the education sector in years. Published in June 2025, the ICO's EdTech Examined report made 596 recommendations and found widespread compliance failures in how edtech providers handle children's personal data. This article sets out what was found and what schools and DPOs need to do about it.
The Department for Education (DfE) updated its Data protection in schools guidance on 17 June 2026, this refresh aligns the guidance with the wider expected KCSIE 2026 guidance and reinforces existing obligations that schools should already be acting on.
This article sets out what has changed, what it means for your school in practice, and the actions your data protection lead should be taking now.
The Keeping Children Safe in Education (KCSIE) document obliges schools and colleges in England to “ensure appropriate filters and appropriate monitoring systems are in place and regularly review their effectiveness”. This responsibility is now a standard, no just a technical tick box, but a core leadership and safeguarding function.
In May 2026, Shottermill Junior School in Haslemere, Surrey became the latest UK primary school to fall victim to a ransomware attack. The LockBit 5.0 group officially listed the school as a victim on 9 June 2026, with threat intelligence monitors detecting the initial network infiltration as far back as 20 May 2026. This means the attackers had approximately three weeks of dwell time inside school systems before the attack became public knowledge.
When a Multi-Academy Trust (MAT) accidentally leaks highly sensitive pupil data, it makes national headlines.
©2026 Data Protection Education Ltd.