Schools & MATs

    You are here:  
  1. Home
  2. Schools & MATs
Digital graphic symbolizing a cyber attack and data breach at the Department for Education (DfE).
Information/Cyber Security

The Department for Education confirmed that hackers have accessed its internal helpdesk and the Turing Scheme portal, taking more than 600,000 records. Contact details belonging to headteachers, senior school leaders, government officials and university staff were among the data taken, and some of it has since appeared on the dark web.

Understandably, this has caused a lot of anxiety across the sector and, predictably, a lot of speculation. Was this preventable? Should the DfE have done more? Who's to blame?

Digital screen interface representing a school Management Information System (MIS) handling pupil records and DfE
Best Practice Updates

A Management Information System (MIS) is the single most important data processing system a school operates. It holds pupil records, including special category data, safeguarding information, and family contact details. So when the Department for Education publishes guidance on choosing one, DPOs and data protection leads should pay attention, even when, as here, the guidance is framed in commercial rather than data protection terms.

Graphic representing new DfE guidance on EdTech procurement for schools, focusing on data protection.
Best Practice Updates

On 9 July 2026, the DfE added a new section to its Data Protection in Schools guidance: Procuring educational technology (EdTech). It sets out what schools should consider before, during and after procuring EdTech tools, and the questions to put to prospective suppliers. Significantly, it is the first DfE guidance to directly reference the ICO's EdTech Examined audit report, telling schools to take the ICO's findings into consideration when procuring EdTech tools.

ICO EdTech Examined report graphic, highlighting data protection audit findings for UK schools and children'
Best Practice Updates

The ICO's edtech audit programme, covering 28 providers used across UK primary and secondary schools, has resulted in one of the most significant data protection reports to affect the education sector in years. Published in June 2025, the ICO's EdTech Examined report made 596 recommendations and found widespread compliance failures in how edtech providers handle children's personal data. This article sets out what was found and what schools and DPOs need to do about it.

Graphic representing the Department for Education (DfE) Data Protection in Schools guidance update from June
Best Practice Updates

The Department for Education (DfE) updated its Data protection in schools guidance on 17 June 2026, this refresh aligns the guidance with the wider expected KCSIE 2026 guidance and reinforces existing obligations that schools should already be acting on.

This article sets out what has changed, what it means for your school in practice, and the actions your data protection lead should be taking now.

 

DfE Filtering and Monitoring Core Standard graphic for schools and colleges, essential for safeguarding children.
Best Practice Updates

The Keeping Children Safe in Education (KCSIE) document obliges schools and colleges in England to “ensure appropriate filters and appropriate monitoring systems are in place and regularly review their effectiveness”. This responsibility is now a standard, no just a technical tick box, but a core leadership and safeguarding function.

Shottermill Junior School building in Haslemere, Surrey, recently impacted by a
Information/Cyber Security

In May 2026, Shottermill Junior School in Haslemere, Surrey became the latest UK primary school to fall victim to a ransomware attack. The LockBit 5.0 group officially listed the school as a victim on 9 June 2026, with threat intelligence monitors detecting the initial network infiltration as far back as 20 May 2026. This means the attackers had approximately three weeks of dwell time inside school systems before the attack became public knowledge.

 

  1. Human Error and High Stakes: What the Horizon Academy Trust Incident Teaches Us About School Data Breaches
  2. We’re Bringing It Back: Our Data Protection Conference Returns
  3. When Cyber Risk Becomes Reality: Lessons from the Powys School Attack
  4. What the Data (Use and Access) Act Means for Schools
  5. September Inset Day Online Training!
  6. Can you use AI safely in schools?
  7. Guardians of Privacy: Social Media, Privacy, Children and the AI Threat
  8. What School Leaders Need to Know About the DfE's New Cyber Security Hub
  9. The Cyber Security Breaches Survey 2025/2026 - Key Advice for Schools
  10. The 2026 Mandate: Navigating the Children’s Wellbeing and Schools Act.
  11. Visitor Management: A Guide for Schools
  12. Update to the DfE Digital Cyber Security Standards for Schools and Colleges
  13. Wireless Network Standards for Schools & Colleges: What's New?
  14. How were schools and pupils affected by the C2K cyber attack?
  15. School Cyber Attack: St Anne's Catholic School
  16. Volunteer Acceptable Use Policy & Agreement
  17. Handling Subject Access Requests (SARs) - at the end of term
  18. Holiday Cheer or Cyber Fear? : Essential Pre-holiday Checks
  19. How should schools manage paper archives?
  20. Navigating the Redaction Divide: SAR or PEX?
  21. What type of request have you received? SAR? Educational Record? Or FOI?
  22. Leavers' Memorabilia
  23. Sharing photos on World Book Day: Privacy considerations
  24. The Danger of the 'Data Dump': Why more information isn't always better!
  25. Cyber Alert: Surrey and Sussex Schools Targeted by Phishing and Ransomware Attacks
  26. Parents and students covertly recording conversations
  27. New DfE AI Standards
  28. Is your IT Support Provider Compliant?
  29. The Government Cyber Action Plan
  30. School Cyber Attack: Higham Lane School Hit by Major Cyber Attack: Campus Remains Closed
  31. What does the technology in schools survey tell us?
  32. IT Support Standards for Schools and Colleges Guidance (DfE Digital Standards)
  33. Sharing information to safeguard children and young people in the education sector in the UK
  34. October 31. On the road to improving cyber resilience
  35. October 30. Cyber Support
  36. October 29. Admin Controls & Accounts
  37. October 28. Phishing: Don't Take the Bait!
  38. October 27. Passwords
  39. October 26. Physical Security of Digital Assets
  40. October 25. Server Security: Protecting Your Digital Core
  41. October 24. Backups: Your Recovery Safety Net
  42. October 23. Filtering and Monitoring
  43. October 22. Hardware: Printers
  44. October 21. Hardware: Asset Management
  45. October 20. Hardware: Safe disposal
  46. October 19. Anti-virus/anti-malware
  47. October 18. Regular Updates: Patching Against Threats
  48. October 17. Access Control: Managing User Privileges
  49. October 16. Access Control: Securing Your Digital Gateways (Wi-Fi & Networks)
  50. October 15. Access Control: Securing Your Home Office (Working From Home)
  51. October 14. Access Control : (Multi-factor authentication)
  52. We've teamed up on a podcast with the Small Business Cyber Security Guy
  53. October 13. Cyber Security Awareness
  54. October 12. Training: Empowering your human firewall
  55. October 11. Policies and Procedures: Cyber Blueprint
  56. October 10. Understanding Your Cyber Posture
  57. Time's Ticking: Windows 10 support ends in October 2025!
  58. October 9. A Guide for Education Providers
  59. October 8. How Can Your Organisation Prevent Ransomware Attacks?
  60. October 7: Under Attack: The Reality of Ransomware
  61. October 6: Cyber Action Plan and A Roadmap to Resilience
  62. October 5: Cyber Responsibilities - We're All in This Together
  63. October 4: When a Cyber Attack Hits
  64. October 3: Data Security, the Core of Protection
  65. October 2: Privacy Protection & Safeguarding Personal Data
  66. October 1: Welcome to Cyber Security Awareness Month!
  67. Nursery Cyber attack
  68. Fraud awareness from the DfE
  69. The Classroom's Dark Side: Cyber crime from the Classroom
  70. Data Breach: School sends out names and contact details in a spreadsheet.
  71. KCSIE 2025: Data Protection, AI, and Cyber Security
  72. The Online SCR Data Breach: What You Need to Know
  73. Back to School Basics for Data Protection and Cyber Security Compliance
  74. The Latest Cyber Threat: The "Murky Panda"
  75. Building a Secure School: Using the ICO Accountability Framework to Meet DfE Digital Standards
  76. Why Physical and Data Security Must Go Hand-In-Hand
  77. Digital Safeguarding: DfE announces statutory DfE Digital Standards
  78. The Data Protection Lead/Champion Role
  79. Changes to the Academy Trust Handbook 2025
  80. School closes for two days after cyber incident
  81. Social Media Day 2025
  82. How Ofsted looks at AI during inspection and regulation
  83. Data Breaches 2025 Report Highlights
  84. Not everyone needs access: The Key to Protecting Sensitive Data
  85. School cyber attack: Outwood Academy, Middlesbrough
  86. Alert: Schools receiving Microsoft File Sharing Phishing Emails
  87. School cyber attack: Framlingham College, Suffolk
  88. West Lothian Schools in Cyber Attack
  89. A Wake-Up Call for Cyber Vigilance - Danger in the Threat Landscape for Everyone
  90. New Governor Resources
  91. Are teachers using AI? 83% say its a time-saver
  92. DfE Digital Standards - narrowing the digital divide
  93. Arbor AI - On By Default
  94. DfE Guidance: Choosing a new MIS
  95. Short Guide to AI Video
  96. Safer Internet Day, Cyber Security & Data Protection
  97. The Cyber Resilience Championship
  98. The Multiple Dimensions of Supplier Due Diligence
  99. School shares sensitive pupil information as part of an FOI response
  100. Blacon High School Cyber Attack
  101. WhatsApp and FOI's: ICO Warnings
  102. New AI Guidance from the DfE
  103. What the proposed Government legislative proposal around cyber crime means
  104. DfE update to record keeping and management
  105. Update to data sharing for school immunisation programmes
  106. SLT Digital Lead Profile
  107. The role of governors in cyber security and data protection
  108. Navigating Privacy at the End of Term , Special Occasions and End of Year
  109. South East Technological University has experienced a cyber incident
  110. Safeguarding Identity in Microsoft 365: Protecting the UK Education Sector Against Cyber Threats
  111. Cyber Attack on a Special School
  112. Stealing children's data
  113. Ofqual highlights the value of cyber security training in schools
  114. Fylde Coast Academy Trust Cyber Attack This Week
  115. Calling all IT leads in schools and mult academy trusts!
  116. Ransomware cyber attack on a school in Bromley
  117. School hit by Cyber Attack
  118. DfE Digital Standards for Schools and Colleges Tracker
  119. Schools and Trusts Best Practice Area
  120. ESFA Cyber Essentials Requirement for Colleges from 2024/2025
  121. ICO Reprimands a School
  122. Out of date technology
  123. Data Retention and the Pupil File
  124. Have you assigned your SLT Digital Lead yet?
  125. What's a Cyber Incident and what should we do?
  126. Getting Started with AI (Artificial Intelligence)
  127. Cyber attack on a school during half term
  128. The rise of cyber attacks in schools are causing pupils to miss classes
  129. Cyber attack on a Trust; the aftermath
  130. School Focus: The Vale Federation | Aylesbury
  131. DfE Dealing with Subject Access Requests (SARs) Guidance
  132. Update to the Guidance on Information Sharing from the DfE
  133. Product Focus on Checklists : Initial Trust Plan
  134. Product Focus on Checklists : End of Term Checklist
  135. Product Focus on Checklists : Social Media
  136. Product Focus on Checklists : Lettings
  137. Milk Island: The secret location that allows children to view restricted content on Google Maps
  138. Free Cyber help, advice and training with the Cyber Resilience Centres
  139. The Perils of Paper: The Printing Vulnerability
  140. Product Focus on Checklists : Governors and Data
  141. Product Focus on Checklists : Site Moves
  142. Cyber attack on a University
  143. Product Focus on Checklists : Bring your own device
  144. Product Focus on Checklists : Working out of school/offsite
  145. Cyber Attack on a School
  146. Major cyber-criminal gang Lockbit brought down by UK Law Enforcement
  147. Product Focus on Checklists : Photos and video
  148. Safer Internet Day 2024
  149. Kent Councils Data Breach
  150. Free cyber training for staff
  151. DfE Digital Standards Update
  152. ClassCharts Possible Data Breach
  153. School Focus: St Bernadette's Catholic Primary School | Brighton
  154. Guardians of Privacy: 16. Social Media Checklist
  155. Guardians of Privacy: 15. Navigating Social Media in Educational Settings Summary
  156. Guardians of Privacy: 14. Social Media and Cyber Bullying
  157. Guardians of Privacy: 13. Social Media, Copyright and Intellectual Property
  158. Guardians of Privacy: 12. Social Media and Going Viral
  159. Guardians of Privacy: 11. Staff Social Media Accounts
  160. Guardians of Privacy: 10. Social Media and Cookies
  161. Guardians of Privacy: 9. Social Media and Morality
  162. New Resources for Schools from the ICO
  163. Guardians of Privacy: 8. Social Media Policies
  164. Guardians of Privacy: 7. Social Media Data Retention
  165. Guardians of Privacy: 6. Posting Safely
  166. Guardians of Privacy: 5. Social Media and Consent
  167. Guardians of Privacy: 4. Social Media Access Control
  168. Guardians of Privacy: 3. Social Media Channels
  169. Guardians of Privacy: 2. Law and Regulations
  170. Phishing attacks targeting schools - alert from City of London Police
  171. The ICO reprimands a Multi Academy Trust
  172. Guidance for the use of school email and applying email retention in schools
  173. Data Protection Tips for Early Years Settings
  174. Trust Initial Plan Checklist Update
  175. Update on Advisory for Rhysida Ransomware
  176. Trust Initial Plan for Data Protection Compliance (for Multi Academy Trusts)
  177. Google for Education Resources: Helping IT Admins meet DfE digital and technology standards
  178. Lettings Best Practice and Guidance
  179. The UK Online Safety Bill becomes an Act (Law)
  180. Considerations when migrating to a new MIS
  181. The importance of software updates (PaperCut vulnerability and Rhysida ransomware)
  182. Public bodies and sensitive data
  183. ICO: 10 Step guide to sharing information to safeguard children
  184. Email and Security: ICO recent guidance
  185. Social Media Policy
  186. Data Protection and Cyber Security (Inset Day) Training Ideas
  187. Changes to Microsoft Free Licensing for Schools
  188. What to do in the event of a Cyber Attack
  189. How KCSIE is linked to Cyber Strategy
  190. VICE SOCIETY - Ransomware attacks on schools
  191. Using Tags if you are a group of organisations in the DPE Knowledge Bank
  192. Cyber Insurance in the Public Sector
  193. Cyber Attack: Leytonstone School
  194. The ICO Reprimands a school
  195. Cyber Attack: Dorchester School
  196. Knowledge Bank Role Types: Admin, Staff and Trustee
  197. Cyber Attack: Wiltshire School
  198. Types of Cyber Attacks: The Insider Threat
  199. Why your data is profitable to cyber criminals
  200. Striking Data Breach
  201. January Cyber update - How Can Schools Help Prevent Cyber Attacks?
  202. FOI: Vaccination Justifications
  203. The Education sector now at highest risk of cyber attacks
  204. Schools Blocked from Using Facial Recognition Systems
  205. The Children's Code
  206. Cyber Attacks
  207. Protocol for Setting Up and Delivery of Online Teaching and Learning
  208. Class Dojo International Data Sharing
  209. Secure file transfer of files using Royal Mail
  210. Emergency contacts and consent
  211. Best Practice for Managing Photos and Video
  212. Headteacher fined for breach of data protection legislation

General news

Information/Cyber Security

Knowledge Bank Updates

Best Practice Updates

Legal

Events & Podcasts

©2026 Data Protection Education Ltd.

Search