Data Protection (GDPR) & Subject Access Requests
Data Protection Policy (GDPR)
Some elements of this document are yet to be confirmed. The following elements of this policy may be subject to change:
• Conditions for processing special categories of personal data
• Processing of criminal offence data
• The provision of 'online services' to children
• International transfers of data
• Subject access requests
Data Protection Policy (GDPR) June 2023
Privacy Notices
GDPR
Please be aware that we have several privacy notices in operation, depending on the nature of your connection with the school. The privacy notices currently in operation are:
Privacy Notice - Parents & Carers
Privacy Notice - Job Applicants
Privacy Notice - School Workforce
Privacy Notice - Governors and Other Volunteers
Subject Access Requests
Please use the form below to make a Subject Access Request.
Paper copies of the form are available from the School Office. Once a completed form is handed in to the School Office, it will be scanned and a PDF copy will be passed electronically to our Data Protection Officer, Martin Tubbs at RBWM. Should you not wish to use this form, we will still accept written requests in other formats.
When responding to requests, we:
• May ask the individual to provide 2 forms of identification
• May contact the individual via phone to confirm the request was made
• Will respond without delay and within 1 month of receipt of the request
• Will provide the information free of charge
• May tell the individual we will comply within 3 months of receipt of the request, where a request is complex or numerous. We will inform the individual of this within 1 month, and explain why the extension is necessary
We will not disclose information if it:
• Might cause serious harm to the physical or mental health of the pupil or another individual
• Would reveal that the child is at risk of abuse, where the disclosure of that information would not be in the child’s best interests
• Is contained in adoption or parental order records
• Is given to a court in proceedings concerning the child
If the request is unfounded or excessive, we may refuse to act on it, or charge a reasonable fee which takes into account administrative costs. A request will be deemed to be unfounded or excessive if it is repetitive, or asks for further copies of the same information. When we refuse a request, we will tell the individual why, and tell them they have the right to complain to the ICO.
The Department for Education, in its GDPR Toolkit for Schools, recognises that it may be difficult for schools to respond during the summer holidays. We are happy to help people access their information in a timely manner and will endeavour to respond within requisite timescales.