Cyber security and data protection sit side by side. Cyber security protects the systems; data protection governs what happens to the personal data inside them. In a school, that data is mostly about children, so the stakes are higher than in most sectors.
Yesterday we looked at why cyber security matters. Today we look at the people who protect personal data every day, and why an annual training module on its own rarely changes what they do.
October is Cyber Security Awareness Month, and this year's theme is "Don't Make It Easy for Them".
We don't think cyber security awareness is something to cover just once a year, but this month gives us a focus. Every day in October we'll share a short topic and one practical action you can take straight away.
Annual data protection training works well for core staff, but it often misses the people who arrive at short notice or whose roles don't look like "data" jobs: supply teachers, cleaners, caretakers and contractors. These staff still see personal data every day, and they share their own with your organisation too. Our new training pack is built for them, including a free Quick Guide for Emergency & Supply Teaching Staff developed with Garth Hill College.
Most organisations will ask us to come and do a data walk at some point, when one of our consultants will visit your site and walk around with your data protection lead. If you are a DPO Assure customer, it is included as part of your SLA, but it is also possible to purchase a visit from one of our school consultants.
Understanding "making the rounds" audits, the 12-point compliance framework, and what schools should expect from a report
It's been a busy summer behind the scenes of the DPE Knowledge Bank. Alongside the new academic year checklists and cyber alerts you'll have seen in our regular articles, we've been steadily updating of the portal: new courses, new guidance documents, a reorganised menu structure, and upgrades to several of the compliance tools you use every day. Here's a full round-up of what's changed.
We've published a new e-learning module for 2026 data protection training.
Schools across the Thames Valley area are being targeted by criminals attempting to access staff payroll accounts, according to a warning issued by the South East Cyber Crime Unit's Cyber Protect team. In several confirmed cases, the attacks have succeeded, leaving affected staff without their pay after criminals diverted their salaries elsewhere.
The Department for Education confirmed that hackers have accessed its internal helpdesk and the Turing Scheme portal, taking more than 600,000 records. Contact details belonging to headteachers, senior school leaders, government officials and university staff were among the data taken, and some of it has since appeared on the dark web.
Understandably, this has caused a lot of anxiety across the sector and, predictably, a lot of speculation. Was this preventable? Should the DfE have done more? Who's to blame?
Cyber attacks on schools are no longer a distant threat. The Department for Education (DfE) has just launched a dedicated Cyber Security Hub to help schools navigate this growing danger, and as a school leader, it's worth understanding exactly what it offers and why it matters. If you were at our conference in February you were lucky enough to see a preview of the tool!
The main benefit of multi-factor authentication (MFA) is that it significantly enhances your organisation's security by requiring users to verify their identity using more than just a username and password.
©2026 Data Protection Education Ltd.