Data Protection at Work (GDPR)
Strictly Education HR joined together with Judicium HR & Employment Law on 1 April 2025.
You are now able to access a much wider range of expert support to keep your school compliant and protected in the sphere of Data Protection from Judicium Education Data Protection Services.
In recent years, schools have seen a significant rise in Subject Access Requests (SARs) and data breaches, driven largely by growing public awareness of data rights.
As more individuals become informed about their rights under data protection laws, schools are facing increased scrutiny and compliance challenges.
Our comprehensive Data Protection service is designed to strengthen your data protection strategy, ensuring ensuring compliance with data protection legislation, as regulated by the Information Commissioner's Office (ICO) creating a secure environment for pupils and staff alike.
From annual audits and policy development to tailored training for employees, we provide expert guidance, advise on best practices, and support robust data management practices.
Click here to explore our offer.
What is the GDPR?
In January 2012, the European Commission announced its intention to reform data protection rules. The Commission proposed that the existing Directive would be replaced by a Regulation, binding on every member state. Since the implementation date of 25th May 2018 fell prior to the date the UK exited the EU all UK organisations and all foreign companies processing the data of EU residents had to be compliant with the General Data Protection Regulation (GDPR) from this date.
The UK government published the Data Protection Bill in September 2017 and this received Royal Assent as the Data Protection Act 2018. The Act should be read in conjunction with the GDPR and contains additional provisions relating to, amongst other things, special categories of data, criminal convictions and offences and subject access requests.
The provisions of the GDPR were incorporated into UK data protection law as the UK GDPR at the end of the BREXIT transition period. The UK GDPR sits alongside the DPA 2018, in practice there is little difference between the core data protection principles, rights and obligations found in the EU GDPR and the UK GDPR.
What about HR data?
Data protection law, including the GDPR, covers the processing of 'personal data' which means any information relating to an identifiable person. Schools and other education establishments will be processing personal data relating to staff, but also to others, such as pupils/students.
What should I be doing to ensure that our HR data processing is compliant with the GDPR?
GDPR implementation did not end on 25th May 2018 as compliance is not a one-off exercise. Many of the changes brought in by the GDPR are about ensuring organisations incorporate data protection principles into day-to-day processes and practices so that considering the implications for personal data becomes the norm.