Data Protection Privacy Notice


Benenden School (the “School”) needs to process personal data about the following people:

  • Its current, former and prospective pupils and their parents,
  • Its current, former and prospective employees,
  • Its suppliers/contractors,
  • Its current and prospective supporters and advisers, and
  • Other individuals as part of the everyday life of the School.

The School is committed to protecting the rights and freedoms of all user groups in accordance with the provisions of the Data Protection Act 1998 (the DPA).

The Data Protection Officer

The Director of Finance and Operations, Martin Lander is the Data Protection Officer. He is responsible for:

  • Notifying the ICO that the School processes personal data and keeping the notification up-to-date
  • Ensuring that personal data is processed in compliance with this Privacy Notice
  • Arranging appropriate training for staff to ensure compliance
  • The enforcement and monitoring of this notice in conjunction with other members of the Senior Management Team.

He can be contacted on 01580 240592 or

The Data Protection Principles

Data Protection is based on eight principles, or rules for good information handling.

  1. Data must be processed fairly and lawfully.
  2. Personal data shall be obtained only for one or more specific and lawful purposes.
  3. Personal data shall be adequate, relevant and not excessive in relation to the purpose(s) for which they are processed.
  4. Personal data shall be accurate and where necessary kept up to date.
  5. Personal data processed for any purpose(s) shall not be kept for longer than is necessary for that purpose.
  6. Personal data shall be processed in accordance with the rights of data subjects under the 1998 Data Protection Act.
  7. Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
  8. Personal data shall not be transferred to a country outside the EEA, unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

Processing includes obtaining, recording, retaining, storing, disclosing, destroying or otherwise using data. Fair processing means being clear and transparent about how personal information will be used.

Personal Data processed by the School

Personal data is any paper-based or electronically stored information about an individual from which that person can be identified. It may be factual (exam results), an expression of opinion (a school report), images or other recorded information from which that individual is identifiable.

The School processes the following personal data:

  1. For pupils:
    • Admissions, attendance and absence, academic, pastoral, disciplinary, special education needs, welfare, health and medical information
    • Contact details
    • Passport and visa images
    • Travel details
    • CCTV images for 30 days
    • References or reports from previous schools as well as references for future schools/universities/employers
    • Photographic images
    • Biometric data for use in the Fitness Suite
    • Correspondence including notes of phone calls from parents about their daughters
    • Emails between staff
    • Notes of tutor/tutee meetings
    • Attendance and absence registers
    • Examination scripts, results or marks of school work or other academic information including School reports
    • Baseline testing information
    • Screening and Educational psychologist reports
    • Girls of concern records and House concerns logs
    • Rewards and sanctions information
    • Concerns and complaints information
    • Pastoral plans including medical protocols, welfare information and bereavement notifications
    • House daily logs
    • House dispense records
    • School medical records including BMI charts
    • Food allergies and intolerances
    • Child protection information
    • Registers and roll calls
    • Accident information
    • Information about pupil achievements including named work on display
    • Minutes of House team, Tutor team, Department and Staff meetings

  2. For parents, carers and guardians:
    • Home addresses, email addresses and telephone numbers for pupils and their parents
    • Bank details and means-testing information
    • Employment details
    • Family and welfare information including parental responsibility
    • Health and welfare information about family members if the pupil is likely to be affected by this (only where this is given by the family)
    • Marital status
    • Court order pertaining to their children
    • Photographic images
    • CCTV/ANPR (automatic number plate recognition) images for 30 days
    • Information about their daughter’s previous school and previous examination marks and scripts (for prospective parents)
    • Confidential references (for prospective parents)
    • Interview notes (for prospective parents

  3. For employees, suppliers, contractors, advisers, Council members and any other users:
    • Contact details including next of kin
    • Financial information
    • Staff concerns, grievance and disciplinary records
    • Appraisal records and lesson observation feedback
    • Employment information (contracts, applications, references)
    • Training records
    • Photographic images
    • CCTV/ANPR (automatic number plate recognition) images for 30 days
    • Work and personal information including medical forms and absences

  4. For Seniors and Donors
    • Contact details and family information
    • Employment information and interests
    • Higher education details
    • Event attendances
    • Financial information including bank details and donations

The School also holds sensitive personal information for the above groups such as:

  • Ethnic group
  • Religion
  • Relevant medical information
  • Criminal records and proceedings

The School collects the data directly from pupils, parents, carers, guardians and staff as well as third parties (e.g. referees and the DBS – Disclosure and Barring Service)

Purposes for which Personal Data may be processed

Personal data is used for the following general purposes:

  • For the provision of education to support pupils in their learning, to monitor and report on progress; to record attendance and absence; for administration of the curriculum, trips and activities and for the provision of careers and higher education services
  • For the promotion of pupil welfare: to provide pastoral, welfare, health and medical support for the care of individuals and groups of pupils; to monitor appropriate use of email and internet (following the guidance in the Acceptable Use of ICT and E-Safety Policy);
  • For Boarding House and School Office administration including compiling pupil records
  • To fulfil the requirements to publish exam data placed on the school by external organisations
  • To complete census/other information requests required by external authorities such as ISI
  • To inform prep schools of their former pupils’ successes in public exams
  • To promote the School and its activities (where specific permission has been given for this to happen
  • For the management of School property including security and safety
  • For the general running of the School including the administration of invoices, fees and accounts; for the administration of School policies and procedures and for other reasonable purpose related to the School’s operation
  • For the protection and promotion of the School’s legitimate interests and objectives including marketing, development initiatives, print publications, fundraising and communicating with former pupils, parents and staff
  • For the administration of staff, contractors and suppliers including recruitment of staff and engagement of contractors’ administration of payroll, pensions and sick leave
  • For the maintenance of appropriate HR records for current and former staff including supplying references
  • Organisation of alumni associations and events
  • Fundraising
  • Publicity
  • Preventing and investigating crime
  • Support and management of staff

Processing of Personal Data

The School will only process data for the purpose(s) for which it was obtained unless the data subject gives permission for it to be used for another purpose or the DPA permits the use of the personal data without specific permission

Personal data will only be disclosed to those members of staff or contractors who need access to personal data to carry out the purpose for which it was acquired. The School adopts appropriate security measures to ensure that personal data is kept secure and not processed without proper authority. Personal data will only be kept for as long as is legislatively allowed and as best educational practice dictates.

The School will not transfer personal data outside of the EEA unless it is satisfied that the data subject’s rights under the DPA will be adequately protected.

When processing personal data, the School may communicate by post, email and SMS and may make use of cloud computing services and virtual servers outside of the School. The School will only transfer personal data outside of the EEA provided that it is satisfied that the data subject’s rights under the DPA will be adequately protected.

It may be necessary to pass personal data on to third parties including: public authorities, other public bodies such as the Independent Schools Inspectorate, HM Revenue and Customs, UK Border Agency, Department for Education, Department for Work and Pensions, Independent Schools Council health professionals and the School’s professional advisers.

The information will be used:

  • To safeguard pupils’ welfare and provide appropriate pastoral, medical and health care
  • To give a confidential reference to another school, university or employer
  • To obtain professional advice and insurance for the School
  • To enable pupils to take part safely in activities and trips on and off site
  • To assist with a pupil wishing to transfer to another school
  • For fundraising, marketing, or promotional purposes (e.g. through using photographs if parents have given permission for this)
  • Where specifically requested by pupils, parents/carers or guardians
  • To enable current pupils to be in contact with former pupils for work experience and university and career advice
  • To enable the Inspection authorities to monitor the School’s progress
  • To compile statistical information (normally used anonymously)
  • Where otherwise required by law
  • Where reasonably necessary for the operation of the School and the employment of staff

Rights of Access

All data subjects have certain rights under the DPA, including a general right to see the personal data held about them by a Data Protection Officer. The ICO suggests that pupils over the age of 12 are able to understand their rights and may make a subject access request for themselves. However, this should be considered on a case by case basis taking into account maturity and understanding.

If individuals wish to access their personal data held by the School, or in the case of parents, if they wish to access data about their daughter or a pupil for whom they have parental responsibility, a request should be submitted to the Data Protection Officer. The School may charge an administration fee of £10 and will respond as quickly as possible, certainly within the 40 days required by the DPA, unless there is an exemption from the right of access under DPA rules.

Parents do not have an automatic right to see the information on their daughter if their daughter withholds consent, however, the School will try to work with the parent and pupil to resolve this matter.

There are restrictions on access to data. These include:

  • Information which will reveal the personal data of others and which might cause damage of distress
  • Information which might cause serious harm to the physical or mental health of a pupil or other individual
  • Cases where the disclosure would reveal that a child is at risk of abuse
  • Information contained in adoption or parental order records
  • Copies of examination scripts
  • Providing examination marks before they are officially announced
  • References which, if disclosed, will reveal the source of the reference

The above are examples only of some of the exemptions under the Act.

Security, Accuracy and Concerns

The School will take the necessary steps to ensure that the personal data it holds is kept securely and only used for the purposes for which it was given. Access to personal data will be restricted to authorised staff.

All staff will be made aware of their responsibilities with regard to Data Protection and will be given regular training to ensure their practice remains up to date.

The School will endeavour to ensure that all personal data is accurate and up to date. Individuals must notify the School of any changes to information held about them and of any inaccuracies of which they become aware.

If an individual has concerns that the School has not followed this Notice, that individual should contact the Data Protection Officer or use the School Complaints’ Procedure.

Benenden School March 2016