Data Protection

Privacy Notice (How we use pupil information)

All schools


Why do we collect and use pupil information?


We collect and use pupil information under:

Data Protection Act 1998 (until 25th May 2018)

  • Schedule 2(5)(b) - The processing is necessary for the exercise of any functions conferred on any person by or under any enactment
  • Schedule 2(5)(d) – The processing is necessary for the exercise of any other functions of a public nature exercised in the public interest by any person
  • Schedule 3(7)(b) - The processing is necessary for the exercise of any functions conferred on any person by or under any enactment

General Data Protection Regulation (EU) 2016/679 (from 25th May 2018)

  • Article 6(1)(e) – the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
  • Article 9(2)(g) – the processing is necessary for reasons of substantial public interest

General Data Protection Regulation (EU) 2016/679 (from 25th May 2018)

  • Article 6(1)(e) – the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller for example:
  • Education Act 2002
  • Children’s Act 1989
  • Children and Adoption Act 2006
  • Education Act 1996
  • The Education (Pupil Information) (England) Regulations 2005
  • The Registration (Pupil Registration) Regulations 2006


  • Article 9(2)(g) – the processing is necessary for reasons of substantial public interest

We use the pupil data:


  • to support pupil learning
  • to monitor, track and report on pupil progress
  • to provide appropriate pastoral care
  • to assess the quality of our services
  • to comply with the law regarding data sharing


The categories of pupil information that we collect, hold and share include:


  • Personal information (such as name, unique pupil number, contact information and address)
  • Characteristics (such as ethnicity, language, nationality, country of birth and free school meal eligibility)
  • Attendance information (such as sessions attended, number of absences and absence reasons)
  • Academic progress / assessment data
  • Relevant medical information
  • Special educational needs information
  • Exclusions / behavioural information
  • Safeguarding and pastoral information (such as collection information and digital media consent)


Collecting pupil information


Whilst the majority of pupil information you provide to us is mandatory, some of it is provided to us on a voluntary basis in support of exercising our official tasks. In order to comply with the General Data Protection Regulation, we will inform you whether you are required to provide certain pupil information to us or if you have a choice in this.

Storing pupil data


The local authority will hold pupil data in accordance with its Retention Schedule:


The school will hold pupil data as outlined in the LA Retention schedule above.


Data is stored in both paper and electronic format. When stored electronically information is stored on a secure server and wherever possible is encrypted for added security. Paper based data is stored as securely as is practicably possible.


Who do we share pupil information with?


We routinely share pupil information with:


  • Schools / other education providers
  • our local authority
  • the Department for Education (DfE)
  • the NHS
  • other local authorities


For further details, please see “Why do we collect and use pupil information?”, above.


We also share information on necessary occasions with:

  • 3rd parties that provide services which support school functions and services (listed at the end of this document)


Why we share pupil information


We do not share information about our pupils with anyone without consent unless the law and our policies allow us to do so.


We share pupils’ data with the Department for Education (DfE) on a statutory basis. This data sharing underpins school funding and educational attainment policy and monitoring.


We are required to share information about our pupils with our local authority (LA) and the Department for Education (DfE) under section 3 of The Education (Information About Individual Pupils) (England) Regulations 2013.


We also share pupil information to:


  • Meet our statutory duty to create and maintain an admission register under the Education (Pupil Registration) (England) Regulations 2006 and subsequent amendments, without which schools are unable to enrol a pupil.


  • Support teaching and learning.  In order to facilitate this, we may share information with the software suppliers (listed at the end of this document) to set up the systems needed for pupils and parent/carers to access.


  • Monitor, track and report on academic progress.


  • Provide appropriate pastoral care, including sharing with our school counsellor with your consent (Keeping Children Safe in Education 2016).


  • Assess how well we, as an education provider, are doing.



  • Share information with Southampton City Council and external partners to support the duty to safeguard and promote the welfare of children, under the Children Act 1989, Section 17.  Working Together to Safeguard Children (2015)


  • Share data with professionals commissioned by the school or working with a pupil such as the School Nurse or health services.


  • Comply with our statutory duty under the Education (Pupil Information) (England) Regulations 2005 Statutory Instrument and subsequent amendments in The Education (Pupil Information) (England) (Amendment) 2008 to create a Common Transfer File when a child ceases to be registered at a school and becomes a registered pupil at another school in England or Wales.  This would also apply to pupils who are dually registered at more than one school.  If a Common Transfer File cannot be sent to a new school when a pupil leaves, one must be sent to the DfE Lost Pupil Database .



  • Send pupil information to Southampton City Council on a regular basis in accordance with our information sharing agreement to enable the local authority to meet its duty under data protection legislation to ensure that the data it holds is accurate and also to carry out its official functions, or a task, in the public interest.


  • Notify Southampton City Council on a termly basis of all pupils on a reduced timetable so that the local authority can comply with statutory Ofsted requests for data at the time of inspection.


  • Comply with the statutory requirements of the Education (Pupil Registration) (England) Regulations 2006 and subsequent amendments, notifying Southampton City Council if a child leaves the school and providing forwarding details.  A failure to provide this information will result in pupils being recorded as a “Child Missing Education”, in accordance with the government definition.


  • Provide attendance information to Southampton City Council so that it’s duties under the Anti-Social Behaviour Act 2003,  Section 444 of the Education Act 1996 and Section 36 of the Children Act 1989 (Education Supervision Orders) can be met.


  • Provide exclusion information to Southampton City Council so that its duty Under Section 19 of the Education Act 1996 can be met.


  • Meet our duty to provide information about any exclusions within the last 12 months to the Secretary of State and (in the case of maintained schools and PRUs) the local authority, in accordance with The Education (Information About Individual Pupils) (England) Regulations 2006.


  • When your child applies for further education or training, the school / LA may forward information to colleges or providers in order to aid your child’s transition into further education or training


Data collection requirements:


To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go to



The National Pupil Database (NPD)


The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies.


We are required by law, to provide information about our pupils to the DfE as part of statutory data collections such as the school census and early years’ census. Some of this information is then stored in the NPD. The law that allows this is the Education (Information About Individual Pupils) (England) Regulations 2013.


To find out more about the pupil information we share with the department, for the purpose of data collections, go to


To find out more about the NPD, go to


The department may share information about our pupils from the NPD with third parties who promote the education or well-being of children in England by:


  • conducting research or analysis
  • producing statistics
  • providing information, advice or guidance


The Department has robust processes in place to ensure the confidentiality of our data is maintained and there are stringent controls in place regarding access and use of the data. Decisions on whether DfE releases data to third parties are subject to a strict approval process and based on a detailed assessment of:


  • who is requesting the data
  • the purpose for which it is required
  • the level and sensitivity of data requested: and
  • the arrangements in place to store and handle the data


To be granted access to pupil information, organisations must comply with strict terms and conditions covering the confidentiality and handling of the data, security arrangements and retention and use of the data.


For more information about the department’s data sharing process, please visit:


For information about which organisations the department has provided pupil information, (and for which project), please visit the following website:


To contact DfE:



We use CCTV in various locations around the school site for health and safety, the detection, prevention and investigation of crime and also for the safeguarding of stakeholders. We will adhere to the ICO’s code of practice for the use of CCTV.

We do not need to ask individuals’ permission to use CCTV, but we make it clear where individuals are being recorded. Security cameras are clearly visible and accompanied by prominent signs explaining that CCTV is in use. Our system retains footage for 34 days and then this is overwritten.

In some instances, the footage may be shared with law enforcement agencies and for the purposes of safeguarding our pupils and other stakeholders.

Any enquiries about the CCTV system should be directed to Mrs Stephanie Bryant via the school contact details. Telephone: 023 8077 2968. E-mail: Address: St. Mark’s CE Primary School, Stafford Road, Shirley, Southampton. SO15 5TE.


Requesting access to your personal data


Under data protection legislation, parents and pupils have the right to request access to information about them that we hold. To make a request for your personal information, or be given access to your child’s educational record, contact our Data Protection Officer: Miss D Loveridge in writings (Contact details are at the end of the document) or complete a Subject Access Request, which can be found at the end of this web page. 


We are happy to people access their information in a timely manner when requested, but may find it difficult to respond during the holiday periods.


You also have the right to:

  • object to processing of personal data that is likely to cause, or is causing, damage or distress
  • prevent processing for the purpose of direct marketing
  • object to decisions being taken by automated means
  • in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
  • claim compensation for damages caused by a breach of the Data Protection regulations


If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner’s Office at



If you would like to discuss anything in this privacy notice, please contact:


  • Stephanie Bryant (Headteacher)

If you require more information about how the Local Authority (LA) and/or DfE store and use your information, then please go to the following websites:  and


  • If you are unable to access these websites we can send you a copy of this information. Please contact the LA or DfE as follows:


  • Solicitor for Education: Legal Services, Southampton City Council, Ground Floor, Civic Centre, SO14 7LY


  • Public Communications Unit: Department for Education, Sanctuary Buildings, Great Smith Street, London, SW1P 3BT
  • Website:



School postal address


St Mark’s Church of England Primary School

Stafford Road


Southampton SO15 5TE


School e-mail address


School telephone number



023 8077 2968


Supplier Information and Data Processors


Staff, Pupil and Contact Database : Arbor and Capita SIMS

Parent Engagement Tool: Marvellous Me

Library System : Libresoft

School Counsellor (As requested): Mrs Christine Seed

Online Office Suite (inc email, calendar, storage): GSuite for Education (inc. Hapara)

Dinners including electronic payment: Tucasi and Southampton City Catering

Software Suppliers: Purple Mash, Bug Club, SumDog, Soft Egg, Tapestry, CPOMS

Secure File Transfer: Dfe S2S, AVCO Anycomms

Secure Shredding: Premiere Shredding

After School Club Suppliers:  MKG Southampton and Team Spirit.

School Photography: Hallett’s Photography (Hampshire)

Diocese:  The Diocese of Winchester

Data Protection Officer

Name: Miss D Loveridge

Address: St Mark’s Church of England Primary School

Stafford Road


Southampton SO15 5TE

Telephone: 023 8077 2968



Subject Access Request (SAR) Form (Referred to in the above Privacy Notice)

You are entitled to submit subject access requests all year round, but please bear in mind that it may be necessary for us to extend the response period when requests are submitted over the summer holidays. This is in accordance with article 12(3) of the GDPR, and will be the case where the request is complex – for example, where we need multiple staff to collect the data.

Please use this SAR Form to lodge a request.

Please also include details of how you would like to recieve your response (i.e. via E-mail or in person).