Best Practice Update

    You are here:  
  1. Home
  2. Best Practice Update
  3. Data Retention and the Pupil File
Graphic representing the Initial Trust Plan checklist for data protection in multi-academy trusts and schools.
Best Practice Updates

Multi academy trusts, federations and groups of schools face a particular data protection challenge. Each school handles personal data every day, but accountability sits with the trust. The Initial Trust Plan is a checklist that gives your central team a clear, high-level picture of where the trust stands and what needs attention first.

This article is part of our Governance Week series. It brings together everything you need to know about the Initial Trust Plan: what it covers, who should own it, how it fits with the ICO Accountability Framework and how to get started.

Illustration depicting social media icons and digital cookies, symbolizing online tracking and data privacy on a school website.
Best Practice Updates

Your school website is probably the most visited "front door" you have. Parents check it for term dates, prospective families browse it before an open evening, and pupils use it to find homework links. If that website carries a Facebook "Like" button, an embedded Instagram feed, a YouTube video or a tracking pixel, some of those visitors are being tracked by social media platforms before they have clicked on anything.

WhatsApp logo on a smartphone screen, representing its use for school communication and data protection concerns.
Best Practice Updates

WhatsApp is one of the most common questions we're asked about. Staff want to know whether they can use WhatsApp groups for school messages, and it's easy to see why: it's familiar, free and quick. But using a personal messaging app for school business brings real data protection, safeguarding and security risks. This article sets out those risks, what the ICO and WhatsApp itself say, and what schools and trusts should do instead.

Official DfE Data Protection Guidance banner for schools, featuring the new DUAA compliance checklist.
Best Practice Updates

On 14 October 2026 the Department for Education (DfE) replaced the Data (Use and Access) Act chapter of its Data protection in schools guidance with a new, practical DUAA compliance checklist for schools. The previous chapter told schools to review their procedures and promised more information "in due course". This is that information: eight themed checklists setting out what changed and what schools are expected to do about it.

Consultant and school data protection lead discussing compliance during a "making the rounds" audit.
Best Practice Updates

Most organisations will ask us to come and do a data walk at some point, when one of our consultants will visit your site and walk around with your data protection lead.  If you are a DPO Assure customer, it is included as part of your SLA, but it is also possible to purchase a visit from one of our school consultants. 

Understanding "making the rounds" audits, the 12-point compliance framework, and what schools should expect from a report

Professional portrait of Ralph T O'Brien, expert on AI and data protection for schools and multi
Best Practice Updates

We present an article written by our Featured Guest Expert Ralph T O'Brien for our school and multi academy trust customers about using AI in schools and trusts. Ralph O’Brien is a global privacy and data protection professional with over 25 years’ experience helping organisations manage data protection and privacy risk, prevent data harms, and build practical, trustworthy information governance programmes

Artificial Intelligence is shorthand for more automation.  Less humans, more machines.  AI is already in schools, and not because the headteacher has approved an AI strategy. Not because the governors have discussed it.

Digital graphic displaying a cyber security alert, warning schools about sophisticated payroll fraud and online threats.
Best Practice Updates

Schools across the Thames Valley area are being targeted by criminals attempting to access staff payroll accounts, according to a warning issued by the South East Cyber Crime Unit's Cyber Protect team. In several confirmed cases, the attacks have succeeded, leaving affected staff without their pay after criminals diverted their salaries elsewhere.

  1. A Risk-Led Order for the DfE Digital Standards: Step by step guidance
  2. Staying Ahead: Why We've Updated Our AI Policy Template
  3. New Course: Keeping Children Safe in Education (KCSIE 2026)
  4. Sharing Pupil Allergy Information Safely in Schools: A Practical Guidance & SSCIP Framework |DPE
  5. DfE Guidance: Choosing an MIS | The DPO lens on the commercial guidance
  6. Academy Trust Handbook 2026: What Data Protection Leads and Governors Need to Know
  7. DfE Procurement Risk Guide: Due Diligence and Data Protection for Trusts | DPE
  8. DfE Data Protection Advice for Schools
  9. KCSIE 2026 Data Protection Changes: What Schools Need to Know
  10. Important Guidance for Schools: Record Retention and the Statutory Independent Inquiry into Grooming Gangs
  11. DfE Cyber Security Standards for Schools: June 2026 Update | DPE
  12. ICO EdTech Audit 2025: Key Findings for Schools | DPE
  13. DfE updates Data Protection in Schools guidance: what schools need to know
  14. The DSL’s Guide to Filtering and Monitoring
  15. Human Error and High Stakes: What the Horizon Academy Trust Incident Teaches Us About School Data Breaches
  16. Reducing risk on World Environment Day and Beyond
  17. Navigating the Future: 2026 Privacy Updates, Data Access, and Student Wellbeing
  18. Can you use AI safely in schools?
  19. Guardians of Privacy: Social Media, Privacy, Children and the AI Threat
  20. Visitor Management: A Guide for Schools
  21. Under surveillance: Why your organisation's CCTV might not be compliant
  22. Update to the DfE Digital Cyber Security Standards for Schools and Colleges
  23. Wireless Network Standards for Schools & Colleges: What's New?
  24. World Backup Day: Backups - Your Safety Net
  25. School Cyber Attack: St Anne's Catholic School
  26. Volunteer Acceptable Use Policy & Agreement
  27. Handling Subject Access Requests (SARs) - at the end of term
  28. How should schools manage paper archives?
  29. Navigating the Redaction Divide: SAR or PEX?
  30. Records Management Toolkit: Where do I start with records management?
  31. What type of request have you received? SAR? Educational Record? Or FOI?
  32. SAR Extension Template
  33. Leavers' Memorabilia
  34. Sharing photos on World Book Day: Privacy considerations
  35. Make sure DPE is your registered DPO with the ICO
  36. Supplier Due Diligence Step by Step: Are you sharing personal data with a third party organisation?
  37. Time to kick-start your Clear Desk and Screen policy?
  38. Are Governors the Frontline of Cyber Security? (February 12th is Governors Awareness Day)
  39. DPE Webinar Schedule
  40. The Danger of the 'Data Dump': Why more information isn't always better!
  41. Introducing our new Recording and Transcription Policy
  42. Parents and students covertly recording conversations
  43. New DfE AI Standards
  44. Shareable Snippet: Office Security Best Practices for the Holidays
  45. CCTV Policy update: retention
  46. Shareable Snippet: Confidential waste
  47. Sharing information to safeguard children and young people in the education sector in the UK
  48. Fraud awareness from the DfE
  49. Complaints vs. Data Rights: A Guide
  50. Data Breach: School sends out names and contact details in a spreadsheet.
  51. September 2025 Policy and Document Updates
  52. KCSIE 2025: Data Protection, AI, and Cyber Security
  53. The Online SCR Data Breach: What You Need to Know
  54. Back to School Basics for Data Protection and Cyber Security Compliance
  55. Building a Secure School: Using the ICO Accountability Framework to Meet DfE Digital Standards
  56. Why Physical and Data Security Must Go Hand-In-Hand
  57. Digital Safeguarding: DfE announces statutory DfE Digital Standards
  58. Social Media Day 2025
  59. How Ofsted looks at AI during inspection and regulation
  60. Preschool Employment tribunal for the use of WhatsApp
  61. Data Breaches 2025 Report Highlights
  62. Not everyone needs access: The Key to Protecting Sensitive Data
  63. West Lothian Schools in Cyber Attack
  64. National Honesty Day: Transparency
  65. FOI Request - BBC News
  66. Social Media and Marketing Guidelines and Training
  67. New Governor Resources
  68. Does stress lead to more data breaches?
  69. Are teachers using AI? 83% say its a time-saver
  70. DfE Digital Standards - narrowing the digital divide
  71. Arbor AI - On By Default
  72. DfE Guidance: Choosing a new MIS
  73. HCRG Care Group data breach
  74. The Importance of AI literacy and training staff
  75. Short Guide to AI Video
  76. Safer Internet Day, Cyber Security & Data Protection
  77. The Cyber Resilience Championship
  78. The Multiple Dimensions of Supplier Due Diligence
  79. School shares sensitive pupil information as part of an FOI response
  80. Blacon High School Cyber Attack
  81. WhatsApp and FOI's: ICO Warnings
  82. New AI Guidance from the DfE
  83. What the proposed Government legislative proposal around cyber crime means
  84. ICO report on AI tools in recruitment
  85. DfE update to record keeping and management
  86. Update to data sharing for school immunisation programmes
  87. Early Years Settings and Cyber Security
  88. SLT Digital Lead Profile
  89. The role of governors in cyber security and data protection
  90. Navigating Privacy at the End of Term , Special Occasions and End of Year
  91. Contracts Register
  92. DfE Digital Standards Autumn Update
  93. The importance of knowing how to access your CCTV footage!
  94. Cyber Attack on a Special School
  95. Stealing children's data
  96. What is dark data? (and why does it matter?)
  97. Ofqual highlights the value of cyber security training in schools
  98. Searching for data when you receive a Subject Access Request
  99. Fylde Coast Academy Trust Cyber Attack This Week
  100. Calling all IT leads in schools and mult academy trusts!
  101. Ransomware cyber attack on a school in Bromley
  102. Join Our Social Media Family!
  103. School hit by Cyber Attack
  104. Cyber Security Best Practice Area
  105. DfE Digital Standards for Schools and Colleges Tracker
  106. New Policies, Documents, Letters and Posters page
  107. Schools and Trusts Best Practice Area
  108. The DPE Retention Schedule
  109. ESFA Cyber Essentials Requirement for Colleges from 2024/2025
  110. ICO Reprimands a School
  111. Out of date technology
  112. Data Retention and the Pupil File
  113. Have you assigned your SLT Digital Lead yet?
  114. Getting Started with AI (Artificial Intelligence)
  115. Cyber attack on a school during half term
  116. The rise of cyber attacks in schools are causing pupils to miss classes
  117. ICO: Learning from the mistakes of others report
  118. Cyber attack on a Trust; the aftermath
  119. School Focus: The Vale Federation | Aylesbury
  120. DfE Dealing with Subject Access Requests (SARs) Guidance
  121. Update to the Guidance on Information Sharing from the DfE
  122. FOI Requests generated by Artificial Intelligence
  123. Social Media Best Practice Area
  124. Lettings Best Practice Area
  125. MFA Bombing - What is it?
  126. Protecting your Social Media Accounts
  127. Checklists - Are They Your Most Powerful Compliance Tool?
  128. Product Focus on Checklists : End of Term Checklist
  129. Product Focus on Checklists : Information and Cyber Security
  130. Product Focus on Checklists : Social Media
  131. Product Focus on Checklists : Lettings
  132. Product Focus on Checklists : Record of Processing
  133. Milk Island: The secret location that allows children to view restricted content on Google Maps
  134. Why Data Should Stay Put: Benefits of Keeping Data in Its Original System
  135. Product Focus on Checklists : Data Retention and Destruction
  136. Product Focus on Checklists : Data Migration
  137. Product Focus on Checklists : Biometrics
  138. Product Focus on Checklists : Supplier Due Diligence
  139. Free Cyber help, advice and training with the Cyber Resilience Centres
  140. The Perils of Paper: The Printing Vulnerability
  141. Product Focus on Checklists : FOI
  142. Product Focus on Checklists : Governors and Data
  143. Product Focus on Checklists : DPIA
  144. Product Focus on Checklists : Site Moves
  145. Product Focus on Checklists : Data Breaches
  146. Product Focus on Checklists : Subject Access Requests
  147. Product Focus on Checklists : Bring your own device
  148. Product Focus on Checklists : Working out of school/offsite
  149. Cyber Attack on a School
  150. Product Focus on Checklists : Redaction
  151. Why Due Diligence is Important: Fake apps
  152. Product Focus on Checklists : CCTV
  153. Product Focus on Checklists : Clear desk
  154. Product Focus on Checklists : Commitment to compliance
  155. Product Focus on Checklists : Photos and video
  156. Product Focus on Checklists : Passwords
  157. Product Focus on Checklists : Information Classification
  158. Free cyber training for staff
  159. DfE Digital Standards Update
  160. The Mother of all Breaches
  161. International Data Transfers (part 1): Navigating Cross-Border Data Transfers: Understanding EU SCCs, UK Addendum, and UK IDTA
  162. ClassCharts Possible Data Breach
  163. Where is your data stored?
  164. IAPP looks at AI privacy risks
  165. If you suspect a financial scam .....
  166. School Focus: St Bernadette's Catholic Primary School | Brighton
  167. Guardians of Privacy: 16. Social Media Checklist
  168. Guardians of Privacy: 15. Navigating Social Media in Educational Settings Summary
  169. Guardians of Privacy: 14. Social Media and Cyber Bullying
  170. Guardians of Privacy: 13. Social Media, Copyright and Intellectual Property
  171. Guardians of Privacy: 12. Social Media and Going Viral
  172. Guardians of Privacy: 11. Staff Social Media Accounts
  173. Guardians of Privacy: 9. Social Media and Morality
  174. New Resources for Schools from the ICO
  175. Guardians of Privacy: 8. Social Media Policies
  176. Guardians of Privacy: 7. Social Media Data Retention
  177. Guardians of Privacy: 6. Posting Safely
  178. Guardians of Privacy: 5. Social Media and Consent
  179. Guardians of Privacy: 4. Social Media Access Control
  180. Guardians of Privacy: 3. Social Media Channels
  181. Guardians of Privacy: 2. Law and Regulations
  182. The ICO reprimands a Multi Academy Trust
  183. Guidance for the use of school email and applying email retention in schools
  184. Data Protection Tips for Early Years Settings
  185. Children's Privacy around the world is a puzzle
  186. Records Management Best Practice Update
  187. What do I need to redact?
  188. Google for Education Resources: Helping IT Admins meet DfE digital and technology standards
  189. Lettings Best Practice and Guidance
  190. Considerations when migrating to a new MIS
  191. Public bodies and sensitive data
  192. Get a DPE Badge for your website!
  193. ICO: 10 Step guide to sharing information to safeguard children
  194. Help after a Cyber Attack/Incident
  195. Data Protection and Cyber Security (Inset Day) Training Ideas
  196. How KCSIE is linked to Cyber Strategy
  197. Handling Freedom of Information Requests the right way
  198. Where's Harry the Hacker?
  199. The ICO Reprimands a school
  200. Redaction Guidelines Updated
  201. How to contact us for support, subject access requests, data breaches and FOI's
  202. FOI: Reinforced Autoclaved Aerated Concrete
  203. FOI: Henry Jackson Society
  204. FOI: Vaccination Justifications
  205. How the Record of Processing Can Help You
  206. What does a Data Protection Officer Do?
  207. Carrying out Supplier Due Diligence
  208. How Long Should You Keep Personal Data For?
  209. B&H FoI: Racist/religious incidents/bullying
  210. Protocol for Setting Up and Delivery of Online Teaching and Learning
  211. Class Dojo International Data Sharing
  212. Model Publication Scheme: Amendments, Improvements and Updates
  213. Transparency
  214. Research projects and GDPR
  215. Secure file transfer of files using Royal Mail
  216. Emergency contacts and consent
  217. Key elements of a successful DPIA
  218. FOI Publication Schemes
  219. Best Practice for Managing Photos and Video
  220. New Drip Feeds: Recognise and Respond to Subject Access Request
  221. When to contact the Data Protection Officer?
  222. National child measurement programme
  223. Headteacher fined for breach of data protection legislation
  224. Acceptable Use Policy

©2026 Data Protection Education Ltd.

Search