News

The Department for Education confirmed that hackers have accessed its internal helpdesk and the Turing Scheme portal, taking more than 600,000 records. Contact details belonging to headteachers, senior school leaders, government officials and university staff were among the data taken, and some of it has since appeared on the dark web.

Understandably, this has caused a lot of anxiety across the sector and, predictably, a lot of speculation. Was this preventable? Should the DfE have done more? Who's to blame?

A Management Information System (MIS) is the single most important data processing system a school operates. It holds pupil records, including special category data, safeguarding information, and family contact details. So when the Department for Education publishes guidance on choosing one, DPOs and data protection leads should pay attention, even when, as here, the guidance is framed in commercial rather than data protection terms.

The Academy Trust Handbook 2026 was published on 15 July 2026 and comes into effect on 1 October 2026. This year's edition strengthens the position on the DfE digital and technology standards and introduces new procurement requirements that have direct data protection implications, most notably around Management Information Systems (MIS).

On 15 July 2026, the Department for Education published How to reduce procurement risk: good practice guide for academy trusts. The guide is aimed at business managers, finance staff and others involved in procurement decision making, and follows the four phases of the procurement lifecycle: plan, define, procure and manage.

On 9 July 2026, the DfE added a new section to its Data Protection in Schools guidance: Procuring educational technology (EdTech). It sets out what schools should consider before, during and after procuring EdTech tools, and the questions to put to prospective suppliers. Significantly, it is the first DfE guidance to directly reference the ICO's EdTech Examined audit report, telling schools to take the ICO's findings into consideration when procuring EdTech tools.

A summary of the data protection changes in the new KCSIE guidance, including the Data (Use and Access) Act 2025, information sharing and child protection file transfers.

The Statutory Independent Inquiry into Grooming Gangs has issued a formal notice to preserve all documents potentially relevant to their investigation. As this is a formal statutory inquiry under the Inquiries Act 2005, schools may be required to produce relevant records to assist.

The ICO's edtech audit programme, covering 28 providers used across UK primary and secondary schools, has resulted in one of the most significant data protection reports to affect the education sector in years. Published in June 2025, the ICO's EdTech Examined report made 596 recommendations and found widespread compliance failures in how edtech providers handle children's personal data. This article sets out what was found and what schools and DPOs need to do about it.

The Department for Education (DfE) updated its Data protection in schools guidance on 17 June 2026, this refresh aligns the guidance with the wider expected KCSIE 2026 guidance and reinforces existing obligations that schools should already be acting on.

This article sets out what has changed, what it means for your school in practice, and the actions your data protection lead should be taking now.

The Keeping Children Safe in Education (KCSIE) document obliges schools and colleges in England to “ensure appropriate filters and appropriate monitoring systems are in place and regularly review their effectiveness”. This responsibility is now a standard, no just a technical tick box, but a core leadership and safeguarding function.

In May 2026, Shottermill Junior School in Haslemere, Surrey became the latest UK primary school to fall victim to a ransomware attack. The LockBit 5.0 group officially listed the school as a victim on 9 June 2026, with threat intelligence monitors detecting the initial network infiltration as far back as 20 May 2026. This means the attackers had approximately three weeks of dwell time inside school systems before the attack became public knowledge.

When a Multi-Academy Trust (MAT) accidentally leaks highly sensitive pupil data, it makes national headlines.

Earlier this year, we brought together schools and multi academy trusts from across the sector for a day focused on something that continues to challenge us all:  data protection in education.

The response was incredible.

What Happened?

On 4 June 2026, Powys County Council confirmed that a cyber security incident had resulted in the theft of personal data belonging to pupils, staff, and others connected to schools in mid-Wales. Thirteen schools were affected by the wider incident, with personal data specifically taken from at least one. The attack was first identified in April 2026 and, according to the council, was “quickly contained”, but not before unauthorised access to personal data had already occurred.

When we talk about environmental responsibility, we reach for the obvious symbols: carbon footprints, single-use plastic, recycling bins in the staffroom. But in schools and Multi-Academy Trusts, there’s another kind of clutter building up quietly and can carry its own consequence.

As your external Data Protection Officer, we are pleased to introduce the May 2026 updates to our suite of model privacy notices. These revisions ensure that the schools we support remain at the forefront of compliance, specifically addressing the requirements of the Data Use and Access Act (DUAA) and the Children's Wellbeing and Schools Act.

We present an article written by our Featured Guest Expert Ralph T O'Brien for our school and multi academy trust customers about the Data Use and Access Act where he breaks down what the latest legislative changes mean for the education sector.

📢 Thinking about your training for inset days in September? Then look no further and book onto our online training sessions.

ChatGPT, Gemini, Copilot and Data Protection

A Practical Guide for School Leaders and Data Protection Officers

This article combines guidance from the Guardians of Privacy series, produced by Data Protection Education in collaboration with Litus Digital, with urgent new advice issued in May 2026 following confirmed blackmail attempts against UK schools using AI-manipulated images of children. Key sources include the UK Safer Internet Centre (8 May 2026) and the Internet Watch Foundation.

Cyber attacks on schools are no longer a distant threat. The Department for Education (DfE) has just launched a dedicated Cyber Security Hub to help schools navigate this growing danger, and as a school leader, it's worth understanding exactly what it offers and why it matters.  If you were at our conference in February you were lucky enough to see a preview of the tool!

The main benefit of multi-factor authentication (MFA) is that it significantly enhances your organisation's security by requiring users to verify their identity using more than just a username and password.

🔒  World Password Day 2026

The Cyber Security Breaches Survey 2025/2026 was published on 30t April 2026 by DSIT and the Home Office.  We outline the current threat picture for schools.

What is this? A new law that came into force on 29 April 2026. It changes how schools, councils, health services and police work together to keep children safe. Several parts of it directly affect how schools handle children's information. Data Protection is now embedded within Safeguarding practice.

Navigating the entry requirements for educational settings can sometimes be confusing for both the school and the visitor.  To ensure a smooth, secure, and legally compliant process, it is essential to balance safeguarding requirements with data protection principles and DfE guidance.

Following the popularity of our recent CCTV webinar, we've published some pointers for headteachers, governance professionals, head of operations and estates managers about CCTV compliance.

We discuss the legal obligations and common pitfalls of CCTV surveillance under the UK GDPR and Data Protection law.

Legal Foundations for Organisations

To operate CCTV lawfully, organisations must move beyond just installing camera.

• Lawful basis - every camera must have a lawful basis.
• DPIA - is mandatory and should be completed before installation to prove the system is necessary and proportionate/
• Special category data - CCTV cameras capture sensitive information (i.e. race, health/disability), which requires a specific article 9 condition for processing.

High Risk Locations: Toilets & Changing Rooms

Placing cameras in or near private areas carries extreme legal risk under the Human Rights Act 1998.

• Expectation of Privacy: pupils and staff have a high expectation of privacy in toilets.
• Proportionality Test: you must prove that less intrusive methods failed before installing CCTV. This might include increased supervision, better lighting, vaping sensors for example.
• Criminal Liability: capturing intimate footage of minors can lead to criminal changes.

Top 10 CCTV Compliance Essentials

Summary Checklist

1. Appoint/Consult a DPO for all CCTV decisions.

2. Layer your notices: Short signs at entrances, full policy on the website.

3. Be transparent: Tell parents and staff why and where cameras are used.

4. Report Breaches: If footage is lost or misused, you must notify the ICO within 72 hours.

Contact for Support: Data Protection Education provides DPO services, DPIA templates, and redaction support. Email: This email address is being protected from spambots. You need JavaScript enabled to view it. | Phone: 0800 0862018

DPE Customers Resources

DPE customers have access to the CCTV Best Practice Area which includes signs, template policies and guidance. We can also do a review of the CCTV when visiting during our data walks (Making the Rounds) or we can come and do a full CCTV Audit.  Customers may also choose to complete the CCTV Checklist as part of their compliance documentation.

The DfE has announced a new update to the DfE Digital Cyber Security Standards for Schools and Colleges.