Schools & MATs

    You are here:  
  1. Home
  2. Schools & MATs
ICO EdTech Examined report graphic, highlighting data protection audit findings for UK schools and children'
Best Practice Updates

The ICO's edtech audit programme, covering 28 providers used across UK primary and secondary schools, has resulted in one of the most significant data protection reports to affect the education sector in years. Published in June 2025, the ICO's EdTech Examined report made 596 recommendations and found widespread compliance failures in how edtech providers handle children's personal data. This article sets out what was found and what schools and DPOs need to do about it.

Graphic representing the Department for Education (DfE) Data Protection in Schools guidance update from June
Best Practice Updates

The Department for Education (DfE) updated its Data protection in schools guidance on 17 June 2026, this refresh aligns the guidance with the wider expected KCSIE 2026 guidance and reinforces existing obligations that schools should already be acting on.

This article sets out what has changed, what it means for your school in practice, and the actions your data protection lead should be taking now.

 

DfE Filtering and Monitoring Core Standard graphic for schools and colleges, essential for safeguarding children.
Best Practice Updates

The Keeping Children Safe in Education (KCSIE) document obliges schools and colleges in England to “ensure appropriate filters and appropriate monitoring systems are in place and regularly review their effectiveness”. This responsibility is now a standard, no just a technical tick box, but a core leadership and safeguarding function.

Shottermill Junior School building in Haslemere, Surrey, recently impacted by a
Information/Cyber Security

In May 2026, Shottermill Junior School in Haslemere, Surrey became the latest UK primary school to fall victim to a ransomware attack. The LockBit 5.0 group officially listed the school as a victim on 9 June 2026, with threat intelligence monitors detecting the initial network infiltration as far back as 20 May 2026. This means the attackers had approximately three weeks of dwell time inside school systems before the attack became public knowledge.

 

Illustration depicting a cyber attack impacting Powys County Council, symbolizing the theft of personal data from schools in
Information/Cyber Security

What Happened?

On 4 June 2026, Powys County Council confirmed that a cyber security incident had resulted in the theft of personal data belonging to pupils, staff, and others connected to schools in mid-Wales. Thirteen schools were affected by the wider incident, with personal data specifically taken from at least one. The attack was first identified in April 2026 and, according to the council, was “quickly contained”, but not before unauthorised access to personal data had already occurred.

AI-manipulated images of smiling children, symbolizing the urgent online safety risks for schools
Best Practice Updates

This article combines guidance from the Guardians of Privacy series, produced by Data Protection Education in collaboration with Litus Digital, with urgent new advice issued in May 2026 following confirmed blackmail attempts against UK schools using AI-manipulated images of children. Key sources include the UK Safer Internet Centre (8 May 2026) and the Internet Watch Foundation.

Department for Education's Cyber Security Hub graphic, showing digital protection for schools against cyber threats.
Information/Cyber Security

Cyber attacks on schools are no longer a distant threat. The Department for Education (DfE) has just launched a dedicated Cyber Security Hub to help schools navigate this growing danger, and as a school leader, it's worth understanding exactly what it offers and why it matters.  If you were at our conference in February you were lucky enough to see a preview of the tool!

  1. The Cyber Security Breaches Survey 2025/2026 - Key Advice for Schools
  2. The 2026 Mandate: Navigating the Children’s Wellbeing and Schools Act.
  3. Visitor Management: A Guide for Schools
  4. Update to the DfE Digital Cyber Security Standards for Schools and Colleges
  5. Wireless Network Standards for Schools & Colleges: What's New?
  6. How were schools and pupils affected by the C2K cyber attack?
  7. School Cyber Attack: St Anne's Catholic School
  8. Volunteer Acceptable Use Policy & Agreement
  9. Handling Subject Access Requests (SARs) - at the end of term
  10. Holiday Cheer or Cyber Fear? : Essential Pre-holiday Checks
  11. How should schools manage paper archives?
  12. Navigating the Redaction Divide: SAR or PEX?
  13. What type of request have you received? SAR? Educational Record? Or FOI?
  14. Leavers' Memorabilia
  15. Sharing photos on World Book Day: Privacy considerations
  16. The Danger of the 'Data Dump': Why more information isn't always better!
  17. Cyber Alert: Surrey and Sussex Schools Targeted by Phishing and Ransomware Attacks
  18. Parents and students covertly recording conversations
  19. New DfE AI Standards
  20. Is your IT Support Provider Compliant?
  21. The Government Cyber Action Plan
  22. School Cyber Attack: Higham Lane School Hit by Major Cyber Attack: Campus Remains Closed
  23. What does the technology in schools survey tell us?
  24. IT Support Standards for Schools and Colleges Guidance (DfE Digital Standards)
  25. Sharing information to safeguard children and young people in the education sector in the UK
  26. We've teamed up on a podcast with the Small Business Cyber Security Guy
  27. Time's Ticking: Windows 10 support ends in October 2025!
  28. Nursery Cyber attack
  29. Fraud awareness from the DfE
  30. The Classroom's Dark Side: Cyber crime from the Classroom
  31. Data Breach: School sends out names and contact details in a spreadsheet.
  32. KCSIE 2025: Data Protection, AI, and Cyber Security
  33. The Online SCR Data Breach: What You Need to Know
  34. Back to School Basics for Data Protection and Cyber Security Compliance
  35. The Latest Cyber Threat: The "Murky Panda"
  36. Building a Secure School: Using the ICO Accountability Framework to Meet DfE Digital Standards
  37. Why Physical and Data Security Must Go Hand-In-Hand
  38. Digital Safeguarding: DfE announces statutory DfE Digital Standards
  39. School closes for two days after cyber incident
  40. Social Media Day 2025
  41. How Ofsted looks at AI during inspection and regulation
  42. Data Breaches 2025 Report Highlights
  43. Not everyone needs access: The Key to Protecting Sensitive Data
  44. School cyber attack: Outwood Academy, Middlesbrough
  45. Alert: Schools receiving Microsoft File Sharing Phishing Emails
  46. School cyber attack: Framlingham College, Suffolk
  47. West Lothian Schools in Cyber Attack
  48. A Wake-Up Call for Cyber Vigilance - Danger in the Threat Landscape for Everyone
  49. New Governor Resources
  50. Are teachers using AI? 83% say its a time-saver
  51. DfE Digital Standards - narrowing the digital divide
  52. Arbor AI - On By Default
  53. DfE Guidance: Choosing a new MIS
  54. Short Guide to AI Video
  55. Safer Internet Day, Cyber Security & Data Protection
  56. The Cyber Resilience Championship
  57. The Multiple Dimensions of Supplier Due Diligence
  58. School shares sensitive pupil information as part of an FOI response
  59. Blacon High School Cyber Attack
  60. WhatsApp and FOI's: ICO Warnings
  61. New AI Guidance from the DfE
  62. What the proposed Government legislative proposal around cyber crime means
  63. DfE update to record keeping and management
  64. Update to data sharing for school immunisation programmes
  65. SLT Digital Lead Profile
  66. The role of governors in cyber security and data protection
  67. Navigating Privacy at the End of Term , Special Occasions and End of Year
  68. South East Technological University has experienced a cyber incident
  69. Safeguarding Identity in Microsoft 365: Protecting the UK Education Sector Against Cyber Threats
  70. Cyber Attack on a Special School
  71. Stealing children's data
  72. Ofqual highlights the value of cyber security training in schools
  73. Fylde Coast Academy Trust Cyber Attack This Week
  74. Calling all IT leads in schools and mult academy trusts!
  75. Ransomware cyber attack on a school in Bromley
  76. School hit by Cyber Attack
  77. DfE Digital Standards for Schools and Colleges Tracker
  78. Schools and Trusts Best Practice Area
  79. ESFA Cyber Essentials Requirement for Colleges from 2024/2025
  80. ICO Reprimands a School
  81. Out of date technology
  82. Data Retention and the Pupil File
  83. Have you assigned your SLT Digital Lead yet?
  84. Getting Started with AI (Artificial Intelligence)
  85. Cyber attack on a school during half term
  86. The rise of cyber attacks in schools are causing pupils to miss classes
  87. Cyber attack on a Trust; the aftermath
  88. School Focus: The Vale Federation | Aylesbury
  89. DfE Dealing with Subject Access Requests (SARs) Guidance
  90. Update to the Guidance on Information Sharing from the DfE
  91. Product Focus on Checklists : End of Term Checklist
  92. Product Focus on Checklists : Social Media
  93. Product Focus on Checklists : Lettings
  94. Milk Island: The secret location that allows children to view restricted content on Google Maps
  95. Free Cyber help, advice and training with the Cyber Resilience Centres
  96. The Perils of Paper: The Printing Vulnerability
  97. Product Focus on Checklists : Governors and Data
  98. Product Focus on Checklists : Site Moves
  99. Cyber attack on a University
  100. Product Focus on Checklists : Bring your own device
  101. Product Focus on Checklists : Working out of school/offsite
  102. Cyber Attack on a School
  103. Major cyber-criminal gang Lockbit brought down by UK Law Enforcement
  104. Product Focus on Checklists : Photos and video
  105. Safer Internet Day 2024
  106. Kent Councils Data Breach
  107. Free cyber training for staff
  108. DfE Digital Standards Update
  109. ClassCharts Possible Data Breach
  110. School Focus: St Bernadette's Catholic Primary School | Brighton
  111. Guardians of Privacy: 16. Social Media Checklist
  112. Guardians of Privacy: 15. Navigating Social Media in Educational Settings Summary
  113. Guardians of Privacy: 14. Social Media and Cyber Bullying
  114. Guardians of Privacy: 13. Social Media, Copyright and Intellectual Property
  115. Guardians of Privacy: 12. Social Media and Going Viral
  116. Guardians of Privacy: 11. Staff Social Media Accounts
  117. Guardians of Privacy: 9. Social Media and Morality
  118. New Resources for Schools from the ICO
  119. Guardians of Privacy: 8. Social Media Policies
  120. Guardians of Privacy: 7. Social Media Data Retention
  121. Guardians of Privacy: 6. Posting Safely
  122. Guardians of Privacy: 5. Social Media and Consent
  123. Guardians of Privacy: 4. Social Media Access Control
  124. Guardians of Privacy: 3. Social Media Channels
  125. Guardians of Privacy: 2. Law and Regulations
  126. Phishing attacks targeting schools - alert from City of London Police
  127. The ICO reprimands a Multi Academy Trust
  128. Guidance for the use of school email and applying email retention in schools
  129. Data Protection Tips for Early Years Settings
  130. Update on Advisory for Rhysida Ransomware
  131. Google for Education Resources: Helping IT Admins meet DfE digital and technology standards
  132. Lettings Best Practice and Guidance
  133. The UK Online Safety Bill becomes an Act (Law)
  134. Considerations when migrating to a new MIS
  135. The importance of software updates (PaperCut vulnerability and Rhysida ransomware)
  136. Public bodies and sensitive data
  137. ICO: 10 Step guide to sharing information to safeguard children
  138. Email and Security: ICO recent guidance
  139. Social Media Policy
  140. Data Protection and Cyber Security (Inset Day) Training Ideas
  141. Changes to Microsoft Free Licensing for Schools
  142. What to do in the event of a Cyber Attack
  143. How KCSIE is linked to Cyber Strategy
  144. VICE SOCIETY - Ransomware attacks on schools
  145. Using Tags if you are a group of organisations in the DPE Knowledge Bank
  146. Cyber Insurance in the Public Sector
  147. Cyber Attack: Leytonstone School
  148. The ICO Reprimands a school
  149. Cyber Attack: Dorchester School
  150. Knowledge Bank Role Types: Admin, Staff and Trustee
  151. Cyber Attack: Wiltshire School
  152. Types of Cyber Attacks: The Insider Threat
  153. Why your data is profitable to cyber criminals
  154. Striking Data Breach
  155. January Cyber update - How Can Schools Help Prevent Cyber Attacks?
  156. FOI: Vaccination Justifications
  157. The Education sector now at highest risk of cyber attacks
  158. Schools Blocked from Using Facial Recognition Systems
  159. The Children's Code
  160. Cyber Attacks
  161. Protocol for Setting Up and Delivery of Online Teaching and Learning
  162. Class Dojo International Data Sharing
  163. Secure file transfer of files using Royal Mail
  164. Emergency contacts and consent
  165. Best Practice for Managing Photos and Video
  166. Headteacher fined for breach of data protection legislation

General news

Information/Cyber Security

Knowledge Bank Updates

Best Practice Updates

Legal

Events & Podcasts

©2026 Data Protection Education Ltd.

Search