News

Checklists in navy text by Data Protection Education. Data Protection Services badge. The DPE Knowledge Bank on a laptop screen

All of our customers have access to the DPE Knowledge Bank which has a Best Practice Checklist area.  Each checklist is designed to help you walk through all aspects of data protection.
Checklists in navy text by Data Protection Education. Data Protection Services badge. The DPE Knowledge Bank on a laptop screen

All of our customers have access to the DPE Knowledge Bank which has a Best Practice Checklist area.  Each checklist is designed to help you walk through all aspects of data protection.
Safer Internet Day in blue text, Tuesday 6 February 2024 in orange text, saferinternetday.org.uk in black text

We couldn't let today go by without mentioning Safer Internet Day when so many of our customers are schools and trusts.  Educators, social workers and other professionals working with children and young people play a key role in supporting children to learn about how to stay safe online.
Data breach in orange text on a computer screen with computer text in blue

The ICO has confirmed a data breach from Kent councils.  The breach was reported by three Kent councils who share the same IT support provider.  Canterbury, Dover and Thanet councils continue to be hampered by the disruptions of onlines services following a cyber incident.
Girl smilitng, children working, some children working on a laptop. Text says Meeting Digital Standards in Schools and Colleges

Did you know that annual cyber security training for school staff is a requirement in the DfE Digital Standards for Schools and Colleges Cyber Security Standards Document?

Data breach in orange text on a computer screen with computer data behind it

Security researchers and computing blogs are reporting 'the mother of all breaches' in reference to a data breach where billions of records have been breached.  The dataset doesn't come from one single breach but a compilation of multiple data breaches.  
Data breach in orange text in computing font on a computer screen with computer code in blue text

A number of schools have reported a data breach by ClassCharts this week.  ClassCharts is school management software that allows teachers to create a customisable classroom seating chart.  It can also be used to track student behaviour, reading levels and other student data.
Robot wearing an orange hoodie holding a piece of paper with the words Data Protection education is transparent text

This week the IAPP published a set of AI privacy risks in the wake of concerns over how AI should be regulated.  There are moves to regulate AI, such as the EU AI Act, however  because AI remains quite an unknown quantity, there is a lot of unease and uncertainty around it's use, ethics, privacy and intellectual property.
Hacker wearing an orange hoodie leaning over a laptop with money raining down behind on a blue background. Data Protection Education logo on the right hand side

If you think someone is trying to trick you into handing over money, personal details or a change of salary information........ there is a way to report this with Stop Scams UK.
hand holding a mobile phone with social media icons on it. Litus Digital logo and Data Protection Education logo. Guardians of Privacy: Navigating social media in educational settings in blue text. A series of articles about social media, privacy and schools in black text. Coloured pencils at the bottom

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

hand holding a mobile phone with social media icons on it. Litus Digital logo and Data Protection Education logo. Guardians of Privacy: Navigating social media in educational settings in blue text. A series of articles about social media, privacy and schools in black text. Coloured pencils at the bottom

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

hand holding a mobile phone with social media icons on it. Litus Digital logo and Data Protection Education logo. Guardians of Privacy: Navigating social media in educational settings in blue text. A series of articles about social media, privacy and schools in black text. Coloured pencils at the bottom

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting. 

hand holding a mobile phone with social media icons on it. Litus Digital logo and Data Protection Education logo. Guardians of Privacy: Navigating social media in educational settings in blue text. A series of articles about social media, privacy and schools in black text. Coloured pencils at the bottom

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

hand holding a mobile phone with social media icons on it. Litus Digital logo and Data Protection Education logo. Guardians of Privacy: Navigating social media in educational settings in blue text. A series of articles about social media, privacy and schools in black text. Coloured pencils at the bottom

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

hand holding a mobile phone with social media icons on it. Litus Digital logo and Data Protection Education logo. Guardians of Privacy: Navigating social media in educational settings in blue text. A series of articles about social media, privacy and schools in black text. Coloured pencils at the bottom

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

hand holding a mobile phone with social media icons on it. Litus Digital logo and Data Protection Education logo. Guardians of Privacy: Navigating social media in educational settings in blue text. A series of articles about social media, privacy and schools in black text. Coloured pencils at the bottom

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

hand holding a mobile phone with social media icons on it. Litus Digital logo and Data Protection Education logo. Guardians of Privacy: Navigating social media in educational settings in blue text. A series of articles about social media, privacy and schools in black text. Coloured pencils at the bottom

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

Yellow background. Young child in front of a laptop with their hands over their face

The ICO has recently published a new set of resources for schools.  They are for teachers to use when discussing privacy issues and the value of personal data.  The kit includes lesson plans which explain what counts as personal data and why it is valuable and how to keep it safe.  The resources are free to download and use.
hand holding a mobile phone with social media icons on it. Litus Digital logo and Data Protection Education logo. Guardians of Privacy: Navigating social media in educational settings in blue text. A series of articles about social media, privacy and schools in black text. Coloured pencils at the bottom

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

hand holding a mobile phone with social media icons on it. Litus Digital logo and Data Protection Education logo. Guardians of Privacy: Navigating social media in educational settings in blue text. A series of articles about social media, privacy and schools in black text. Coloured pencils at the bottom

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

hand holding a mobile phone with social media icons on it. Litus Digital logo and Data Protection Education logo. Guardians of Privacy: Navigating social media in educational settings in blue text. A series of articles about social media, privacy and schools in black text. Coloured pencils at the bottom

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

hand holding a mobile phone with social media icons on it. Litus Digital logo and Data Protection Education logo. Guardians of Privacy: Navigating social media in educational settings in blue text. A series of articles about social media, privacy and schools in black text. Coloured pencils at the bottom

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

hand holding a mobile phone with social media icons on it. Litus Digital logo and Data Protection Education logo. Guardians of Privacy: Navigating social media in educational settings in blue text. A series of articles about social media, privacy and schools in black text. Coloured pencils at the bottom

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

hand holding a mobile phone with social media icons on it. Litus Digital logo and Data Protection Education logo. Guardians of Privacy: Navigating social media in educational settings in blue text. A series of articles about social media, privacy and schools in black text. Coloured pencils at the bottom

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

hand holding a mobile phone with social media icons on it. Litus Digital logo and Data Protection Education logo. Guardians of Privacy: Navigating social media in educational settings in blue text. A series of articles about social media, privacy and schools in black text. Coloured pencils at the bottom

This article is one of a series written by Data Protection Education in collaboration with Litus Digital, a social media management company.  The articles came about from questions asked by Data Protection Education's customers, our own experience of working in education,  as school governors, parents and data protection professionals.  The articles raise questions about how social media can be used as safely as possible in a school environment,  security considerations, the law and protecting children.  It is not possible to cover every aspect of social media, but the articles aim to provide guidance, raise privacy questions and provide some support for safe posting.

Latest ICO Reprimand. Mr. S. Claus, Chief Executive Officer, North Pole Enterprises

REPRIMAND

To: Mr. S. Claus, Chief Executive Officer, North Pole Enterprises

Of: North Pole
The Information Commissioner (the Commissioner) issues a reprimand to North Pole Enterprises (‘Santa Claus’) in accordance with Article 58(2)(b) of the UK General Data Protection Regulation in respect of certain alleged infringements of the UK GDPR. 

The reprimand
The Commissioner has decided to issue a reprimand to North Pole Enterprises in respect of the following alleged infringements of the UK GDPR:
  • Article 5(1)(f) which states:
“personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’)”.
  • Article 32(1) which states:
“taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.” 

The reasons for the Commissioner’s findings are set out below. 

Article 5(1)(f) and Article 32(1)(b)
Technical and Organisational Measures

  • You have been collecting and storing vast amounts of personal information without proper consent from the data subjects. This includes but is not limited to, names, addresses, wish lists, and even behavioral assessments of children across the globe. While we acknowledge the festive nature of your endeavors, it is crucial to remember that the General Data Protection Regulation (GDPR) applies universally, even in the magical realm of the North Pole.
  • The use of "naughty" and "nice" lists to categorize children based on their behavior raises serious concerns about profiling and discrimination. We would like to remind you that individuals have the right to fair and transparent processing of their personal data, and labeling a child as "naughty" without providing clear criteria for such judgment falls short of these principles.
  • Your mode of data transfer, namely the use of reindeer-drawn sleighs and chimneys, lacks the necessary encryption measures, posing a significant risk to the confidentiality and integrity of the information you handle. We highly recommend a thorough review of your information security protocols to ensure compliance with contemporary standards.

Aggravating factors

Moreover, your recent practice of leaving such information unattended in sacks labelled "Happy Christmas" whilst eating mince pies and drinking sherry is alarming. Not only does this constitute improper disposal of sensitive information, but it also raises questions about the security of your data handling processes as it blatantly encourages the investigation of the contents of the sack. We recommend implementing secure and GDPR-compliant disposal methods, such as shredding or incineration, to safeguard the confidentiality of the information you collect. Or at a minimum, use bags labelled "Confidential Waste" and keep them in a securely locked cabinet.

Decision to issue a reprimand

Taking into account all the circumstances of this case, including the aggravating factors and remedial steps, the Commissioner has decided to issue a reprimand to North Pole Enterprises in relation to the alleged infringements of Article 5(1)(f) and Article 32(1) of the UK GDPR set out above.

Please provide a written response outlining the steps you intend to take to rectify these concerns by no later than January 15, 2024. Failure to do so will leave us with no choice but to escalate this matter and consider further enforcement actions.

We wish you a Merry Christmas and a GDPR-compliant New Year.

Yours sincerely,

D. P. Adi-Humbug
Chief Information Commissioner
Information Commissioner's Office North Pole Division

  1. Phishing attacks targeting schools - alert from City of London Police
  2. The ICO reprimands a Multi Academy Trust
  3. Guidance for the use of school email and applying email retention in schools
  4. CISA and UK NCSC Announce Joint Guidelines for Secure AI System Development
  5. Data Protection Tips for Early Years Settings
  6. Children's Privacy around the world is a puzzle
  7. Trust Initial Plan Checklist Update
  8. Update on Advisory for Rhysida Ransomware
  9. Records Management Best Practice Update
  10. The Crime in a Cyber Attack and a Data Breach
  11. What do I need to redact?
  12. NCSC Annual Review is published for 2023
  13. Learning from Data Breaches
  14. Windows 11 security ineffective against attacks on old devices
  15. Trust Initial Plan for Data Protection Compliance (for Multi Academy Trusts)
  16. International Counter Ransomware Initiative 2023 Joint Statement
  17. Google for Education Resources: Helping IT Admins meet DfE digital and technology standards
  18. Top Ten Cyber Security Misconfigurations
  19. Lettings Best Practice and Guidance
  20. ICO Reprimand: company suffered a ransomware attack
  21. The UK Online Safety Bill becomes an Act (Law)
  22. Considerations when migrating to a new MIS
  23. The importance of software updates (PaperCut vulnerability and Rhysida ransomware)
  24. Public bodies and sensitive data
  25. Adding offline bulk training using the Certificates function
  26. Ransomware, extortion and the cyber crime ecosystem
  27. Get a DPE Badge for your website!
  28. ICO: 10 Step guide to sharing information to safeguard children
  29. Cyber Resource: The Cyber Resilience Centre Group
  30. Email and Security: ICO recent guidance
  31. Help after a Cyber Attack/Incident
  32. Social Media Policy
  33. Data Protection and Cyber Security (Inset Day) Training Ideas
  34. Changes to Microsoft Free Licensing for Schools
  35. What to do in the event of a Cyber Attack
  36. Cyber Crime: AI Generated Phishing Attacks
  37. Handling Freedom of Information Requests the right way
  38. Cyber Attack: Exam Boards
  39. VICE SOCIETY - Ransomware attacks on schools
  40. Using Tags if you are a group of organisations in the DPE Knowledge Bank
  41. Where's Harry the Hacker?
  42. Be Cyber Aware: USB Sticks
  43. Cyber Insurance in the Public Sector
  44. Types of Cyber Attacks: DDos Attack (Microsoft DDoS Attack in June)
  45. Cyber Attack: Leytonstone School
  46. The ICO Reprimands a school
  47. Be Cyber Aware: Firewalls
  48. Be Cyber Aware: Cyber attacks and transparency. A no blame culture
  49. Cyber Attack: Dorchester School
  50. Knowledge Bank Role Types: Admin, Staff and Trustee
  51. Types of Cyber Attacks: Password Attacks
  52. Be Cyber Aware: Why regular software updates are important
  53. Cyber Attack: Wiltshire School
  54. Keeping your IT systems safe and secure
  55. Types of Cyber Attacks: DDoS Attacks
  56. Types of Cyber Attacks: Phishing
  57. Types of Cyber Attacks: The Insider Threat
  58. Why your data is profitable to cyber criminals
  59. Using WhatsApp in Schools
  60. The Changes to Data Protection in the UK
  61. Knowledge Bank Updates
  62. Types of malware and how they are linked to data protection
  63. Striking Data Breach
  64. IPR Protection Email Scam
  65. Windows Server 2012 & 2012 R2 Retirement
  66. How to contact us for support, subject access requests, data breaches and FOI's
  67. YouTube breached child protection laws
  68. How a school fought back after a cyberattack
  69. Types of Cyber Attacks - Credential Stuffing
  70. January Cyber update - How Can Schools Help Prevent Cyber Attacks?
  71. Assigning courses to staff using to-dos
  72. How the Record of Processing Can Help You
  73. Information Security Basics: What are VPN's?
  74. What does a Data Protection Officer Do?
  75. Are you ready for a Data Breach?
  76. Carrying out Supplier Due Diligence
  77. How Long Should You Keep Personal Data For?
  78. The Education sector now at highest risk of cyber attacks
  79. How to Assess your Data Security
  80. Schools Blocked from Using Facial Recognition Systems
  81. The Children's Code
  82. B&H FoI: Racist/religious incidents/bullying
  83. Cyber Attacks
  84. Protocol for Setting Up and Delivery of Online Teaching and Learning
  85. Class Dojo International Data Sharing
  86. Model Publication Scheme: Amendments, Improvements and Updates
  87. Child friendly privacy notices
  88. Transparency
  89. Secure file transfer of files using Royal Mail
  90. Emergency contacts and consent
  91. Key elements of a successful DPIA
  92. FOI Publication Schemes
  93. SHARE: Avoid disinformation online
  94. Best Practice for Managing Photos and Video
  95. New Drip Feeds: Recognise and Respond to Subject Access Request
  96. When to contact the Data Protection Officer?
  97. National child measurement programme
  98. Compliance Manager released
  99. Headteacher fined for breach of data protection legislation
  100. Emails – good practice and minimising the risk of a data breach

Subcategories

General news

Information/Cyber Security

Knowledge Bank Updates

Best Practice Updates

Legal

Events & Podcasts

©2026 Data Protection Education Ltd.

Search

Keep in the Know!

Get our latest news directly to your inbox

Privacy notice