Schools & MATs

    You are here:  
  1. Home
  2. Schools & MATs
Graphic representing the Initial Trust Plan checklist for data protection in multi-academy trusts and schools.
Best Practice Updates

Multi academy trusts, federations and groups of schools face a particular data protection challenge. Each school handles personal data every day, but accountability sits with the trust. The Initial Trust Plan is a checklist that gives your central team a clear, high-level picture of where the trust stands and what needs attention first.

This article is part of our Governance Week series. It brings together everything you need to know about the Initial Trust Plan: what it covers, who should own it, how it fits with the ICO Accountability Framework and how to get started.

Illustration depicting social media icons and digital cookies, symbolizing online tracking and data privacy on a school website.
Best Practice Updates

Your school website is probably the most visited "front door" you have. Parents check it for term dates, prospective families browse it before an open evening, and pupils use it to find homework links. If that website carries a Facebook "Like" button, an embedded Instagram feed, a YouTube video or a tracking pixel, some of those visitors are being tracked by social media platforms before they have clicked on anything.

Cyber Career Week banner showing school staff roles and cybersecurity responsibilities.
Information/Cyber Security

This week, we’re using “Cyber Career Week”, the name the wider world already knows it by, to look at cyber security through the lens of who’s actually responsible for what in a school or trust. Not generic career-pathway content, but the real division of labour: what each role is accountable for, where the handoffs happen, and where things go wrong when nobody’s sure whose job it was.

Cyber security roles and responsibilities in a school during National Cyber Security Career Week.
Information/Cyber Security

This week is National Cyber Security Career Week, and while most content for it focuses on getting new people into the profession, we’re taking a different angle. Cyber security in a school or trust isn’t a job for one person or one department; it’s a set of responsibilities spread across several roles, each with a different part to play.

Visualizing cybersecurity planning, identifying weaknesses, and building a proactive security posture.
Information/Cyber Security

A well thought-out plan gives you a structured approach to improving your security posture, identifying weaknesses, and ensuring a rapid response when an incident occurs. The goal is moving from reactive panic to proactive preparedness, and that starts with understanding exactly where you stand today, before building the plan and risk register that gets you further.

Bromcom logo symbolizing the personal data breach impacting schools and trusts using their legacy SSO service.
Information/Cyber Security

Bromcom, one of the most widely used MIS providers in England, has confirmed a personal data breach affecting a legacy single sign-on (SSO) registration service. Bromcom is now contacting affected schools and trusts directly. If you use Bromcom, this article explains what we know so far, what you need to decide as a data controller, and the practical steps that reduce your risk, both from this incident and the next one.

  1. Handling Subject Access Requests (SARs) and Coerced Consent: Guidance for Schools | DPE
  2. What is Making the Rounds? What happens during a data walk?
  3. AI In Schools: Six Pillars for Getting it Right | Serious Privacy
  4. Back to School: Your Data Protection Checklist for the New Academic Year
  5. Payroll Fraud Alert: Schools Urged to Secure Staff Accounts After Thames Valley Attacks
  6. The DfE Cyber Attack: What Schools Should Look Out For Next Term
  7. Sharing Pupil Allergy Information Safely in Schools: A Practical Guidance & SSCIP Framework |DPE
  8. DfE Guidance: Choosing an MIS | The DPO lens on the commercial guidance
  9. Academy Trust Handbook 2026: What Data Protection Leads and Governors Need to Know
  10. DfE Procurement Risk Guide: Due Diligence and Data Protection for Trusts | DPE
  11. DfE Data Protection Advice for Schools
  12. KCSIE 2026 Data Protection Changes: What Schools Need to Know
  13. DfE Cyber Security Standards for Schools: June 2026 Update | DPE
  14. ICO EdTech Audit 2025: Key Findings for Schools | DPE
  15. DfE updates Data Protection in Schools guidance: what schools need to know
  16. The DSL’s Guide to Filtering and Monitoring
  17. Cyber Attack : LockBit 5.0 Targets a Primary School
  18. Human Error and High Stakes: What the Horizon Academy Trust Incident Teaches Us About School Data Breaches
  19. We’re Bringing It Back: Our Data Protection Conference Returns
  20. When Cyber Risk Becomes Reality: Lessons from the Powys School Attack
  21. What the Data (Use and Access) Act Means for Schools
  22. Can you use AI safely in schools?
  23. Guardians of Privacy: Social Media, Privacy, Children and the AI Threat
  24. What School Leaders Need to Know About the DfE's New Cyber Security Hub
  25. The Cyber Security Breaches Survey 2025/2026 - Key Advice for Schools
  26. The 2026 Mandate: Navigating the Children’s Wellbeing and Schools Act.
  27. Visitor Management: A Guide for Schools
  28. Update to the DfE Digital Cyber Security Standards for Schools and Colleges
  29. Wireless Network Standards for Schools & Colleges: What's New?
  30. How were schools and pupils affected by the C2K cyber attack?
  31. School Cyber Attack: St Anne's Catholic School
  32. Volunteer Acceptable Use Policy & Agreement
  33. Handling Subject Access Requests (SARs) - at the end of term
  34. Holiday Cheer or Cyber Fear? : Essential Pre-holiday Checks
  35. How should schools manage paper archives?
  36. Navigating the Redaction Divide: SAR or PEX?
  37. What type of request have you received? SAR? Educational Record? Or FOI?
  38. Leavers' Memorabilia
  39. Sharing photos on World Book Day: Privacy considerations
  40. The Danger of the 'Data Dump': Why more information isn't always better!
  41. Cyber Alert: Surrey and Sussex Schools Targeted by Phishing and Ransomware Attacks
  42. Parents and students covertly recording conversations
  43. New DfE AI Standards
  44. Is your IT Support Provider Compliant?
  45. The Government Cyber Action Plan
  46. School Cyber Attack: Higham Lane School Hit by Major Cyber Attack: Campus Remains Closed
  47. What does the technology in schools survey tell us?
  48. IT Support Standards for Schools and Colleges Guidance (DfE Digital Standards)
  49. Sharing information to safeguard children and young people in the education sector in the UK
  50. We've teamed up on a podcast with the Small Business Cyber Security Guy
  51. Time's Ticking: Windows 10 support ends in October 2025!
  52. Nursery Cyber attack
  53. Fraud awareness from the DfE
  54. The Classroom's Dark Side: Cyber crime from the Classroom
  55. Data Breach: School sends out names and contact details in a spreadsheet.
  56. KCSIE 2025: Data Protection, AI, and Cyber Security
  57. The Online SCR Data Breach: What You Need to Know
  58. Back to School Basics for Data Protection and Cyber Security Compliance
  59. The Latest Cyber Threat: The "Murky Panda"
  60. Building a Secure School: Using the ICO Accountability Framework to Meet DfE Digital Standards
  61. Why Physical and Data Security Must Go Hand-In-Hand
  62. Digital Safeguarding: DfE announces statutory DfE Digital Standards
  63. School closes for two days after cyber incident
  64. Social Media Day 2025
  65. How Ofsted looks at AI during inspection and regulation
  66. Data Breaches 2025 Report Highlights
  67. Not everyone needs access: The Key to Protecting Sensitive Data
  68. School cyber attack: Outwood Academy, Middlesbrough
  69. Alert: Schools receiving Microsoft File Sharing Phishing Emails
  70. School cyber attack: Framlingham College, Suffolk
  71. West Lothian Schools in Cyber Attack
  72. A Wake-Up Call for Cyber Vigilance - Danger in the Threat Landscape for Everyone
  73. New Governor Resources
  74. Are teachers using AI? 83% say its a time-saver
  75. DfE Digital Standards - narrowing the digital divide
  76. Arbor AI - On By Default
  77. DfE Guidance: Choosing a new MIS
  78. Short Guide to AI Video
  79. Safer Internet Day, Cyber Security & Data Protection
  80. The Cyber Resilience Championship
  81. The Multiple Dimensions of Supplier Due Diligence
  82. School shares sensitive pupil information as part of an FOI response
  83. Blacon High School Cyber Attack
  84. WhatsApp and FOI's: ICO Warnings
  85. New AI Guidance from the DfE
  86. What the proposed Government legislative proposal around cyber crime means
  87. DfE update to record keeping and management
  88. Update to data sharing for school immunisation programmes
  89. SLT Digital Lead Profile
  90. The role of governors in cyber security and data protection
  91. Navigating Privacy at the End of Term , Special Occasions and End of Year
  92. South East Technological University has experienced a cyber incident
  93. Safeguarding Identity in Microsoft 365: Protecting the UK Education Sector Against Cyber Threats
  94. Cyber Attack on a Special School
  95. Stealing children's data
  96. Ofqual highlights the value of cyber security training in schools
  97. Fylde Coast Academy Trust Cyber Attack This Week
  98. Calling all IT leads in schools and mult academy trusts!
  99. Ransomware cyber attack on a school in Bromley
  100. School hit by Cyber Attack
  101. DfE Digital Standards for Schools and Colleges Tracker
  102. Schools and Trusts Best Practice Area
  103. ESFA Cyber Essentials Requirement for Colleges from 2024/2025
  104. ICO Reprimands a School
  105. Out of date technology
  106. Data Retention and the Pupil File
  107. Have you assigned your SLT Digital Lead yet?
  108. Getting Started with AI (Artificial Intelligence)
  109. Cyber attack on a school during half term
  110. The rise of cyber attacks in schools are causing pupils to miss classes
  111. Cyber attack on a Trust; the aftermath
  112. School Focus: The Vale Federation | Aylesbury
  113. DfE Dealing with Subject Access Requests (SARs) Guidance
  114. Update to the Guidance on Information Sharing from the DfE
  115. Product Focus on Checklists : End of Term Checklist
  116. Product Focus on Checklists : Social Media
  117. Product Focus on Checklists : Lettings
  118. Milk Island: The secret location that allows children to view restricted content on Google Maps
  119. Free Cyber help, advice and training with the Cyber Resilience Centres
  120. The Perils of Paper: The Printing Vulnerability
  121. Product Focus on Checklists : Governors and Data
  122. Product Focus on Checklists : Site Moves
  123. Cyber attack on a University
  124. Product Focus on Checklists : Bring your own device
  125. Product Focus on Checklists : Working out of school/offsite
  126. Cyber Attack on a School
  127. Major cyber-criminal gang Lockbit brought down by UK Law Enforcement
  128. Product Focus on Checklists : Photos and video
  129. Safer Internet Day 2024
  130. Kent Councils Data Breach
  131. Free cyber training for staff
  132. DfE Digital Standards Update
  133. ClassCharts Possible Data Breach
  134. School Focus: St Bernadette's Catholic Primary School | Brighton
  135. Guardians of Privacy: 16. Social Media Checklist
  136. Guardians of Privacy: 15. Navigating Social Media in Educational Settings Summary
  137. Guardians of Privacy: 14. Social Media and Cyber Bullying
  138. Guardians of Privacy: 13. Social Media, Copyright and Intellectual Property
  139. Guardians of Privacy: 12. Social Media and Going Viral
  140. Guardians of Privacy: 11. Staff Social Media Accounts
  141. Guardians of Privacy: 9. Social Media and Morality
  142. New Resources for Schools from the ICO
  143. Guardians of Privacy: 8. Social Media Policies
  144. Guardians of Privacy: 7. Social Media Data Retention
  145. Guardians of Privacy: 6. Posting Safely
  146. Guardians of Privacy: 5. Social Media and Consent
  147. Guardians of Privacy: 4. Social Media Access Control
  148. Guardians of Privacy: 3. Social Media Channels
  149. Guardians of Privacy: 2. Law and Regulations
  150. Phishing attacks targeting schools - alert from City of London Police
  151. The ICO reprimands a Multi Academy Trust
  152. Guidance for the use of school email and applying email retention in schools
  153. Data Protection Tips for Early Years Settings
  154. Update on Advisory for Rhysida Ransomware
  155. Google for Education Resources: Helping IT Admins meet DfE digital and technology standards
  156. Lettings Best Practice and Guidance
  157. The UK Online Safety Bill becomes an Act (Law)
  158. Considerations when migrating to a new MIS
  159. The importance of software updates (PaperCut vulnerability and Rhysida ransomware)
  160. Public bodies and sensitive data
  161. ICO: 10 Step guide to sharing information to safeguard children
  162. Email and Security: ICO recent guidance
  163. Social Media Policy
  164. Data Protection and Cyber Security (Inset Day) Training Ideas
  165. Changes to Microsoft Free Licensing for Schools
  166. What to do in the event of a Cyber Attack
  167. How KCSIE is linked to Cyber Strategy
  168. VICE SOCIETY - Ransomware attacks on schools
  169. Using Tags if you are a group of organisations in the DPE Knowledge Bank
  170. Cyber Insurance in the Public Sector
  171. Cyber Attack: Leytonstone School
  172. The ICO Reprimands a school
  173. Cyber Attack: Dorchester School
  174. Knowledge Bank Role Types: Admin, Staff and Trustee
  175. Cyber Attack: Wiltshire School
  176. Types of Cyber Attacks: The Insider Threat
  177. Why your data is profitable to cyber criminals
  178. Striking Data Breach
  179. January Cyber update - How Can Schools Help Prevent Cyber Attacks?
  180. FOI: Vaccination Justifications
  181. The Education sector now at highest risk of cyber attacks
  182. Schools Blocked from Using Facial Recognition Systems
  183. The Children's Code
  184. Cyber Attacks
  185. Protocol for Setting Up and Delivery of Online Teaching and Learning
  186. Class Dojo International Data Sharing
  187. Secure file transfer of files using Royal Mail
  188. Emergency contacts and consent
  189. Best Practice for Managing Photos and Video
  190. Headteacher fined for breach of data protection legislation

General news

Information/Cyber Security

Knowledge Bank Updates

Best Practice Updates

Legal

Events & Podcasts

©2026 Data Protection Education Ltd.

Search