News

Multi academy trusts, federations and groups of schools face a particular data protection challenge. Each school handles personal data every day, but accountability sits with the trust. The Initial Trust Plan is a checklist that gives your central team a clear, high-level picture of where the trust stands and what needs attention first.

This article is part of our Governance Week series. It brings together everything you need to know about the Initial Trust Plan: what it covers, who should own it, how it fits with the ICO Accountability Framework and how to get started.

Your school website is probably the most visited "front door" you have. Parents check it for term dates, prospective families browse it before an open evening, and pupils use it to find homework links. If that website carries a Facebook "Like" button, an embedded Instagram feed, a YouTube video or a tracking pixel, some of those visitors are being tracked by social media platforms before they have clicked on anything.

The National Cyber Security Centre (NCSC) published its Annual Review 2026 on 3 November. It looks back on the NCSC's tenth year, from September 2025 to August 2026, and ahead at the threats coming next.

Cyber security does not appear anywhere in the top 10 challenges governors and trustees named for their schools and trusts in 2026.

We recommend every multi academy trust we work with having a named Data Protection Governance Lead. We explain what the role involves, how it differs from the Data Protection Officer (DPO) and  the Data Protection Champion, the training we expect, and the new resources available to help you.

So, you've been asked to be the data protection champion/lead in your organisation!  We explain what that  role involves, how it works with Data Protection Education (DPE) as your Data Protection Officer (DPO), and the new resources we've added to help you.

This series opened by making the case that cyber security matters. Cyber resilience is an organisation's ability to anticipate, withstand, recover from and adapt to cyber attacks and disruptions while continuing to deliver essential business operations.

The worst time to work out who’s supposed to do what is during the incident itself. A cyber incident response plan only earns its name if it’s been read, agreed, and actually rehearsed before the day it’s needed.

A backup you’ve never tested isn’t a backup, it’s a hope. The only way to know a recovery plan actually works is to have tried it before the day it matters.

Most of this series has been about what happens on screen. This one’s about what happens when the screen is switched off: the old laptop in a cupboard waiting to be “sorted,” the printer in the corner nobody’s logged into in years, the server room door that’s been propped open since this morning’s delivery.

You cannot protect what you do not know you have. Every unmanaged device on a network is a gap nobody’s actively watching,  not because anyone decided to leave it unwatched, but because nobody wrote it down in the first place.

WhatsApp is one of the most common questions we're asked about. Staff want to know whether they can use WhatsApp groups for school messages, and it's easy to see why: it's familiar, free and quick. But using a personal messaging app for school business brings real data protection, safeguarding and security risks. This article sets out those risks, what the ICO and WhatsApp itself say, and what schools and trusts should do instead.

Hackers are always finding new ways to break into accounts, and password attacks remain one of the most successful routes into school and trust systems. Password security isn't just an IT job: everyone with a login has a part to play.

This article explains what a cyber incident is and what you should do if your school or trust experiences one. A cyber incident isn't necessarily a full-blown cyber attack, but it should still go through your reporting and risk management processes.

Antivirus software used to be something you installed once and forgot about. That’s no longer good enough,  not because the software changed, but because what it’s defending against did.

A single unpatched device rarely causes a breach on its own. It’s the one left running an outdated browser plugin, the printer firmware nobody’s touched in two years, the laptop still on last year’s operating system, sitting quietly until something finds it. Patching is the least exciting item on this list and the one that closes the most doors.

This week, we’re using “Cyber Career Week”, the name the wider world already knows it by, to look at cyber security through the lens of who’s actually responsible for what in a school or trust. Not generic career-pathway content, but the real division of labour: what each role is accountable for, where the handoffs happen, and where things go wrong when nobody’s sure whose job it was.

This week, we’re using “Cyber Career Week”, the name the wider world already knows it by, to look at cyber security through the lens of who’s actually responsible for what in a school or trust. Not generic career-pathway content, but the real division of labour: what each role is accountable for, where the handoffs happen, and where things go wrong when nobody’s sure whose job it was.

This week is National Cyber Security Career Week, and while most content for it focuses on getting new people into the profession, we’re taking a different angle. Cyber security in a school or trust isn’t a job for one person or one department; it’s a set of responsibilities spread across several roles, each with a different part to play.

This week is National Cyber Security Career Week,  and while most content for it focuses on getting new people into the profession, we’re taking a different angle. Cyber security in a school or trust isn’t a job for one person or one department; it’s a set of responsibilities spread across several roles, each with a different part to play.

This week is National Cyber Security Career Week, and while most content for it focuses on getting new people into the profession, we're taking a different angle. Cyber security in a school or trust isn't a job for one person or one department; it's a set of responsibilities spread across several roles, each with a different part to play.

This week is National Cyber Security Career Week, and while most content for it focuses on getting new people into the profession, we're taking a different angle. Cyber security in a school or trust isn't a job for one person or one department; it's a set of responsibilities spread across several roles, each with a different part to play.

Filtering and monitoring sit either side of the same boundary. Filtering is preventative, it stops users reaching illegal, inappropriate, or harmful content before they ever see it. Monitoring is reactive, it watches what's actually happening on your network and devices, so concerning activity doesn't go unnoticed. Together, they're one of the few controls that serve both cyber security and child safeguarding at once.

Day 16 looked at access control from the outside in: securing the connection when staff work beyond school walls. Today we go back to the perimeter itself: the firewall every one of those connections has to pass through, and the network behind it. A firewall that's switched on but never reviewed, or a network where one device can talk to everything else, undoes a lot of the good work covered so far this month. Perimeter and gateway security is less glamorous than ransomware or phishing, but it's the layer that decides whether an intrusion stays contained or spreads.

Cyber Security Awareness Month has spent the last two days on who has access and how it's controlled inside your school's own walls. But for most schools and trusts today, "inside the walls" is only part of the picture. Staff mark books at home, SLT reply to emails on the train, and admin teams log into finance systems from a kitchen table. Remote working isn't an edge case anymore; it's routine. Which means access control has to work just as hard outside the building as it does inside it.

Every attacker chasing a school network has the same goal once they're in: find an account with more power than it needs. A compromised standard user account is a nuisance. A compromised admin account is a takeover, it can touch every system, every dataset, and every piece of security infrastructure built to stop exactly this. It can probably reset passwords.

On 14 October 2026 the Department for Education (DfE) replaced the Data (Use and Access) Act chapter of its Data protection in schools guidance with a new, practical DUAA compliance checklist for schools. The previous chapter told schools to review their procedures and promised more information "in due course". This is that information: eight themed checklists setting out what changed and what schools are expected to do about it.

Cyber security policies and procedures set out clear rules, guidelines and processes for how information is handled across your school or trust. Done well, they're not a compliance exercise, they're the blueprint that reduces human error and makes accountability possible, because everyone knows what's expected before something goes wrong, not after.

Over the past two weeks, we've covered how attackers get in:  phishing, deepfakes, ransomware, and what to do when they do. Access control is about the layer that decides whether any of that actually works: even a perfectly crafted phishing email or a stolen password is useless to an attacker if the account behind it is properly protected. Today we look at the single most effective access control measure available, where it still falls short, and what's changing.

The NCSC advises: "there's no way to completely protect your organisation against malware infection." That's not a reason to give up, it's the reason defence-in-depth exists. Instead of relying on one control to stop everything, you build multiple layers, so that if one fails, the next one catches it, and if an attacker does get in, the damage is contained and recovery is fast.