01244 261 379 enquiries@e2e-education.co.uk Portal login
E2E Education Data Protection Services
Ages 11–16

Data protection for secondary schools

Secondary is where pupils start exercising their own rights, where the systems multiply, and where biometrics and CCTV bring rules that do not apply anywhere else in the sector. The competence question needs an answer before a request lands, not after.

What we solve

The problems that actually come up in secondary settings

Pupils old enough to ask for their own file

Once a pupil understands the right, it is theirs — and a parent asking on their behalf may not be entitled to the same disclosure. Competence is judged individually rather than by birthday, and the assessment needs recording at the time.

Biometrics carry their own statute

Cashless catering and fingerprint entry sit under the Protection of Freedoms Act as well as UK GDPR: written parental notification, the right for the pupil themselves to refuse, and a workable alternative for anyone who does. Many schools inherited a system without ever seeing that paperwork.

CCTV, and where it is pointed

Corridors are one thing. Cameras covering toilets, changing areas or a sixth form common room are another, and retention periods are usually whatever the installer set by default years ago.

Sprawl across systems

MIS, safeguarding platform, cashless catering, library, careers software, three learning platforms and a parent app. Nobody has a complete list, which means nobody can answer a request properly first time.

What’s included

Everything you get, from day one

Every school is different. A ten-minute call is usually enough to tell you where you stand.

  • A written approach to pupil competence, applied consistently across the school
  • Review of biometric systems against the statutory consent and refusal requirements
  • CCTV siting, signage and retention reviewed and documented
  • A complete record of systems holding pupil data, kept current as things change
  • Subject access request handling for pupil and parental requests alike

Built for secondary, not adapted to it.

The same DPO service everywhere would miss what makes your setting different. This is the version that fits.

Talk to a specialist
Get in touch

Ready to take data protection off your plate?

No obligation — most questions are answered in a ten-minute call.

Send us a message