Annual data protection training works well for core staff, but it often misses the people who arrive at short notice or whose roles don't look like "data" jobs: supply teachers, cleaners, caretakers and contractors. These staff still see personal data every day, and they share their own with your organisation too. Our new training pack is built for them, including a free Quick Guide for Emergency & Supply Teaching Staff developed with Garth Hill College.
Most schools build their data protection compliance around an annual rhythm. In September, staff complete e-learning, sign to confirm they've read the policies, and the training record is updated ready for audit. That works well for the core teaching and office team. It works much less well for the people who arrive at 8.15am to cover a lesson they found out about at 7.30, the agency cleaner who started last week, the contractor on site over half term, or the site team whose working day is spent in corridors and plant rooms rather than at a desk.
These people are often left out of the annual cycle. Sometimes that's because of how short their contract is. Sometimes it's because their job doesn't look like a "data" role. The law doesn't make that distinction. Under UK GDPR, anyone acting under the school's authority who has access to personal data may only process it on the school's instructions. The school also has to show that its organisational security measures, including staff awareness, are appropriate to the risk. A supply teacher holding a register is inside that obligation just as much as the office manager running the MIS.
You don't have to handle personal data to see it
A common response from operational staff is "I don't deal with data." In practice, schools are full of personal data in plain sight, and the people who move around the building out of hours often see more of it than anyone.
A cleaner emptying bins may come across printouts that should have gone in confidential waste. At the end of the day they may see desks with safeguarding notes left out, or class lists and medical information pinned to staffroom walls. A caretaker holds the keys to the filing cabinets and the offices where records are kept, and may be the person who lets contractors into those spaces. Site staff pass unlocked screens, uncollected prints on shared printers, and whiteboards still showing pupil names or seating plans. A supply teacher may be handed a register with SEN or medical flags, may overhear a conversation about a pupil, or may be the adult a child chooses to tell something important.
None of this makes these staff "data handlers" in the traditional sense. It does mean they are well placed to spot a problem and contain it early, or to cause one without realising. Integrity and confidentiality is the principle that matters most for them. They don't need to understand lawful bases in depth. They need to know what personal data looks like on paper and on screen, to know what to do when they find it somewhere it shouldn't be, and to know who to tell.
They are data subjects too
It's easy to forget that short-term and operational staff are also sharing their own personal data with the school. Before they start, someone will usually have collected or checked right-to-work documents, DBS information, references, bank details, emergency contacts, and possibly health information. For agency staff, the school will record confirmation of the agency's checks on its single central record. Once they're on site, they may appear on CCTV, in a visitor or sign-in system, or on an ID badge with a photograph.
That brings obligations the school owes to them. The workforce privacy notice should cover temporary, agency and contract staff, not just employees on the payroll. They should know where to find it. Their information should be kept only as long as the retention schedule allows. They have the same rights as anyone else, including the right to make a subject access request.
It's also a useful way to open the conversation. Most people understand data protection far better when they think about their own passport scan or bank details sitting on a desk. Starting there makes the case for protecting pupil and family information without needing much explanation.
The resources
With this in mind, we've built a short training pack for staff whose roles or contracts don't fit the annual cycle.
The "Back to Basics" training video is aimed at estates managers, cleaners, caretakers and other support staff. It covers what personal data and special category data are, and shows why paper records matter as much as digital ones. It covers physical security, clear desk and clear screen, and confidential waste. It also explains the phishing and "vishing" tactics that increasingly target whoever answers the phone. It explains roles and responsibilities, including who the Data Protection Champion is and why every concern should reach them.
The knowledge check quiz is a 14-question multiple-choice sheet that follows the video. The questions are practical and scenario-based. For example, one asks what to do when you find confidential paperwork left out overnight. Another covers the data protection responsibilities of a keyholder, and another asks how to respond to a suspicious call asking for a password reset. A completed quiz also gives the school a simple, evidenced training record for staff who aren't on the e-learning platform.
The Data Protection Quick Guide for Emergency & Supply Teaching Staff is a short companion document for staff covering lessons at short notice. It opens with a "Who to Contact Today" table for the office to complete: the DSL, the school office, the Data Protection Champion and IT support. It sets out key principles. These are: no access to school systems without training or a briefing and supply login, printed registers only, nothing leaves the premises, and everything goes back to the office before the end of the day. It walks through the same Contain, Secure, Report approach used across the school, with emergency examples such as a fire alarm while holding a register or a pupil disclosure mid-lesson. It also says what a short verbal briefing should cover when there hasn't been time for full induction, and makes clear that the briefing supplements full training rather than replacing it. The guide ends with an acknowledgement for the member of staff to sign. This means a school can evidence that even same-day cover received data protection guidance.
With thanks to Garth Hill College
The emergency and supply staff guide exists because Garth Hill College asked for it. They identified the gap: staff arriving for same-day cover with no realistic chance of completing full induction first. They also produced an initial version for us to build on. Their practical, on-the-ground view of how emergency cover actually works shaped the final guide. We're grateful to the team there for raising it and for sharing their work so that other schools can benefit.
Making it work in practice
The resources work best when they're built into the routines that already exist around these staff:
- Keep printed copies of the quick guide at reception or in the cover supervisor's pack, with the contact table already completed.
- Ask supply agencies to share the guide as part of their booking confirmation.
- Show the video during site team and cleaning contractor inductions, not only at September INSET.
- File signed acknowledgements and completed quizzes alongside your other training records, so an auditor can see that coverage extends beyond the core workforce.
- Check that your workforce privacy notice explicitly includes temporary, agency and contract staff.
Annual training is still the foundation. The aim is to make sure that the people who fall outside it aren't also left outside the school's data protection culture.
How this works with Making the Rounds
The training pack deals with the same risks that a data walk is designed to find. During a Making the Rounds visit, a DPE consultant walks the site with your data protection lead, checking how personal data is actually handled rather than how the policy says it should be. In practice, many of the findings come from exactly the places where operational staff work: unlocked offices and cabinets, keys left in locks, uncollected printing, confidential waste mixed with general recycling, unlocked screens, and information displayed on walls and whiteboards. The walk also looks at lettings and who has access to the building once the school day ends. Cleaners, site teams and contractors are usually the people on site at that time.
The two work best together. A data walk gives you a snapshot of what is visible on the day. The training helps the people who are in the building every day, and every evening, recognise the same risks for themselves and act on them between walks. Several points in the 12-point compliance framework depend directly on these staff: clear desk and wall displays, secure disposal of confidential waste, device locking, and staff awareness. The final point, regular audits with documented feedback to staff, is much easier to evidence when your site and support team have had training they can relate the findings to.
Some ways to connect the two:
- Involve your site manager or caretaker in the walk. They know which rooms are left unlocked, where the confidential waste goes and who is in the building after hours. They often spot things that others walk past.
- Use your walk findings to focus the training. If the report flags uncollected printing or overflowing waste bins, open your next support staff briefing with that example before showing the video.
- Share the outcome with the whole team. Feedback from a walk often stays with SLT and the office. Letting cleaners and site staff know what was found, and what has improved, shows them that their part matters.
- Run your own walks between visits. Customers can carry out their own data walk using the Making the Rounds guide and record it on the Knowledge Bank. Support staff can be part of this, especially for end-of-day checks.
Find out more about what happens during a data walk in What is Making the Rounds? What happens during a data walk?
The Data Protection Quick Guide for Emergency & Supply Teaching Staff is free to download and share. DPE subscribers can access the full training pack, including the "Back to Basics" video and knowledge check quiz, through the Knowledge Bank training course page. If you have questions about supporting short-term or operational staff, log a ticket or contact us at