What is the UK GDPR?
The GDPR is a piece of UK legislation which will determine how people's personal data is processed and kept safe, and the legal rights individuals have in relation to their own data. It applies to organisations that process or handle personal data, including schools.
Information Commissioner's Office (ICO)
The ICO is the UK's independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals. If you click here you can visit the ICO's website to read in depth information about all aspects of the UK GDPR.
Key Terminology
Below is an overview with definitions to provide clarity over what is meant by certain types of data and the different roles involved in the handling of data.
- Personal data - The UK GDPR only applies to organisations' use of personal data. This is any information relating to an "identified, or identifiable, living individual" - as set out in the Data Protection Act 2018. This may include information such as the person's name, contact details, identification number and online identifier, such as a username.
- Special categories of personal data - personal data which is more sensitive and so needs more protection. It includes information about a person's race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometrics (such as fingerprints, retina and iris patterns) where used for identification purposes, health – physical or mental, and sex life or sexual orientation.
- Data subject - the person whose personal data is held or processed (eg all pupils and staff are data subjects)
- Data controller - a person or organisation who determines how and why personal data is used (Horizons Specialist Academy Trust is a data controller)
- Data processor - an external person or organisation, who is not employed by the Trust, who processes the personal data on our behalf (eg payroll provider)
- Processing - anything done to personal data, such as collecting, recording, organising, structuring, storing, adapting, altering, retrieving, using, disseminating, erasing or destroying.
- Data Protection Officer - an appointed person who takes responsibility for monitoring data protection compliance.
Privacy Notices
Under data protection law, individuals have a right to be informed about how we, Horizons Specialist Academy Trust, use any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (previously called ‘fair processing notices’) to individuals where we are processing their personal data.
These privacy notices explain how we collect, store and use personal data about pupils, parents/carers, staff and those involved in governance, and can be downloaded below:
