A new academic year brings a full inbox of statutory guidance, policy refreshes and operational pressure — often all landing in the same first few weeks of term. Before the pace picks up, it's worth pausing to check that the key data protection foundations are in place. Here's what should be on your radar this September.
Schools across the Thames Valley area are being targeted by criminals attempting to access staff payroll accounts, according to a warning issued by the South East Cyber Crime Unit's Cyber Protect team. In several confirmed cases, the attacks have succeeded, leaving affected staff without their pay after criminals diverted their salaries elsewhere.
The integration of Artificial Intelligence (AI) into the educational landscape is moving faster than ever. While AI offers transformative potential for lesson planning, administration, and student learning, it brings with it significant data protection and safeguarding responsibilities.
Keeping Children Safe in Education is the statutory guidance every school, college and MAT must work to, and every member of staff needs to understand it, every year, without exception. Our new KCSIE 2026 course is now live in your DPE training portal, built to make that annual refresh straightforward, accurate, and genuinely useful, not just a box-ticking exercise.
As schools prepare for term and statutory obligations under Benedict’s Law (taking effect from September 2026), leadership teams face a critical operational question: How do we share life-saving pupil allergy data quickly without committing a personal data breach?
A Management Information System (MIS) is the single most important data processing system a school operates. It holds pupil records, including special category data, safeguarding information, and family contact details. So when the Department for Education publishes guidance on choosing one, DPOs and data protection leads should pay attention, even when, as here, the guidance is framed in commercial rather than data protection terms.
The Academy Trust Handbook 2026 was published on 15 July 2026 and comes into effect on 1 October 2026. This year's edition strengthens the position on the DfE digital and technology standards and introduces new procurement requirements that have direct data protection implications, most notably around Management Information Systems (MIS).
On 15 July 2026, the Department for Education published How to reduce procurement risk: good practice guide for academy trusts. The guide is aimed at business managers, finance staff and others involved in procurement decision making, and follows the four phases of the procurement lifecycle: plan, define, procure and manage.
On 9 July 2026, the DfE added a new section to its Data Protection in Schools guidance: Procuring educational technology (EdTech). It sets out what schools should consider before, during and after procuring EdTech tools, and the questions to put to prospective suppliers. Significantly, it is the first DfE guidance to directly reference the ICO's EdTech Examined audit report, telling schools to take the ICO's findings into consideration when procuring EdTech tools.
A summary of the data protection changes in the new KCSIE guidance, including the Data (Use and Access) Act 2025, information sharing and child protection file transfers.
The Statutory Independent Inquiry into Grooming Gangs has issued a formal notice to preserve all documents potentially relevant to their investigation. As this is a formal statutory inquiry under the Inquiries Act 2005, schools may be required to produce relevant records to assist.
©2026 Data Protection Education Ltd.