Latest updates

Updated 17 July 2020

As more information is available from local authorities, DfE and Public Health England, we are only updating this section with data protection related content.

As such, we have updated our Privacy Policy to include the following:

Data collected for the purposes of public health (including visitor contact data for COVID-19) will be kept as long as required. Contact data for visitors will be kept for 21 days after the most recent visit, with information on visitors kept as per standard retention requirements. Public Health data may be shared with third-parties as required including, but not limited to:

  • National Health Service (including NHS Test and Trace)
  • Public Health England
  • Other local health authorities 

Data collected and processed for public health purposes is done so under GDPR Article 9(2)(i) which states: (in part) "processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health..." and Recital 54 which includes: "The processing of special categories of personal data may be necessary for reasons of public interest in the areas of public health without consent of the data subject."

Collection and processing of visitor data will be documented in the privacy notices and in a statement available to visitors at the time of data collection to include the following information:

"We collect the following visitor information for the purposes of security, safety and public health:

  • Name
  • Organisation
  • Date and time of visit
  • [Car registration]
  • Contact details

These are kept for six years in case of any claims by students, staff or visitors under the Limitations Act (1980).

Contact details will be deleted after 21 days.

Should a positive test for COVID-19 be identified, relevant visitor data will be shared with the required public health authorities. [Ensure you sign and display a COVID Secure Notice confirming you have an active risk assessment for visitors]

For further details, please see the Data Protection Policy, or contact the Data Protection Officer" 

Please download the latest privacy policy, or add the relevant information to your existing policy and privacy notices and add the COVID-19 statements to visitor sign-in desks and systems.

Model Privacy Policy

Model Privacy Notice


Updated 20 March 2020

In these ever-changing and concerning times I wanted to inform you of Data Protection Education's support related to the coronavirus outbreak.

Protecting data has never been more important as we explore new ways of working, in different locations using new and existing technology in new ways.

We understand that this might not be your priority at this moment in time and data protection should not be a barrier to these new ways of working and delivering teaching and learning; rather, we need to ensure that these new ways of working support your standards and policies in relation to data security.

We would encourage all organisations to complete the questionnaire - this forms the basis of risk assessments for data processing in the event of school closures.

We will be adding additional resources to many areas of the website to provide advice and guidance on many further areas of data processing.

Additionally, as we move visits to online consultations, we'll be providing more information on how that will work as we support you with:

  • Record of processing
  • Data protection impact assessments
  • Prioritising data risk
  • Personalised learning and training
  • Using GDPR to create efficiencies and help school improvement

We'll be sending regular updates - it has never been more important to think about the security of data.

As always, if you have any questions or concerns that we can help with, please contact

spreadsheet DPE Return to school Covid-19 Risk Assessment Template (113 KB)

Department for Education

Actions for education and childcare settings to prepare for wider opening from 1 June 2020Actions for education and childcare settings to prepare for wider opening from 1 June 2020
Opening schools and educational settings to more pupils from 1 June: guidance for parents and carers
Coronavirus (COVID-19): implementing protective measures in education and childcare settings


DPE Best Practice 

document Work out of school policy
(52 KB)
document Working at Home Checklist
(22 KB)
Working out of School Best Practice
Acceptable Use Best Practice


DPE Articles


Information Commissioner's Office


DfE Guidance for educational settings

DfE Guidance on maintaining educational provision and key workers,T0TU,1831KB,3HU2C,1 guidance for households with possible coronavirus infection


Public Health England: Coronavirus resources

Stay Home, Save lives - Public Information Materials:
Handwashing advice:
Isolation advice:


Every Mind Matters

Advice and Guidance on looking after your mental wellbeing when staying at home:


Public Health England: School Zone

Stop germs spreading with our fun e-Bug resources



pdf NHS COVID19 Message For Parents (537 KB)


DFE/BESA: Access to quality learning resources

Have a question about data protection and coronavirus? Ask it here.
Invalid Input

(ICO FAQ) During the pandemic, we are worried that our data protection practices might not meet our usual standard or our response to information rights requests will be longer. Will the ICO take regulatory action against us?

(ICO FAQ) As a healthcare organisation, can we contact individuals in relation to COVID-19 without having prior consent?

(ICO FAQ) As a healthcare organisation, can we contact individuals in relation to COVID-19 without having prior consent? (copy)

(ICO FAQ) More of our staff will be home working during the pandemic. What kind of security measures should my organisation have in place for homeworking during this period? (copy)

(ICO FAQ) Can I tell my staff that a colleague may have potentially contracted COVID-19? (copy)

(ICO FAQ) Can I share employees’ health information to authorities for public health purposes?

Can I contact an employer to confirm key worker status?

(EDPB) Can an employer require visitors or employees to provide specific health information in the context of COVID-19?

(EDPB) Is an employer allowed to perform medical check-ups on employees?

(EDPB) Can an employer disclose that an employee is infected with COVID-19 to his colleagues or to externals?

(EDPB) What information processed in the context of COVID-19 can be obtained by the employers?


The following e-learning modules are available for staff working from home:

Working at Home elearning module. This module covers guidance for staff when working from home, specifically looking at data risks and requirements relating to:

  • Environment
  • Hardware
  • Systems
  • Behaviour

It takes less than 30 minutes to complete.

Stay Safe Online elearning module. Produced by the National Cyber Security Centre this module: 'Stay Safe Online: Top Tips for Staff' takes less than 30 minutes to complete. The training introduces why cybersecurity is important and how attacks happen, and then covers four key areas:

  • defending yourself against phishing
  • using strong passwords
  • securing your devices
  • reporting incidents ('if in doubt, call it out')

Have a question about data and coronavirus? Ask it here.

Invalid Input
©2020 Data Protection Education Ltd.