Processing of personal information may only be carried out where one of the conditions of Article 6, GDPR has been satisfied. Processing of special category data may only be carried out if a condition in Article 9, GDPR is met as well as one in Article 6. See Appendix 1 for a list of the conditions.

- 8. Disclosure of Data

It is a criminal offence to knowingly or recklessly obtain or disclose information about an individual without legitimate cause. Relevant, confidential data should only be given to:

- • staff members on a need to know basis; • staff members on a need to know basis;
- • parents/guardians; • parents/guardians;

###### other organisations if it is necessary in the public interest, e.g. prevention of crime;

- • authorities, such as the Local Education Authority and schools to which a pupil may move, where there • authorities, such as the Local Education Authority and schools to which a pupil may move, where there are legal requirements
- • that collaborate with the school or that are part of an information sharing protocol • that collaborate with the school or that are part of an information sharing protocol

The school should not disclose anything on a pupil's record which would be likely to cause serious harm to their physical or mental health or that of anyone else.

Where there is doubt or statutory requirements conflict, advice should be sought.

When giving information to an individual, particularly by telephone, it is most important that the individual's identity is verified. If in doubt, questions should be asked of the individual, to which only he/she is likely to know the answers. Information should not be provided to other parties, even if they are related. For example: in the case of divorced parents it is important that information regarding one party is not given to the other party to which he/she is not entitled.

- 9. Individuals' rights

##### Access to information about themselves

Anyone has the right, to request a copy of all information retained about them by the school (or information about a child they are responsible for).

When a request is received, it must be dealt with promptly; an answer must be presented as soon as possible within a month. The period can be extended by up to two months if a request is complex or numerous.

No fee can be charged. However, if a request is unfounded, excessive and has been submitted previously, there is a right to charge an administrative fee.

When providing information, the school must also provide the same details to the individuals as those provided in a privacy notice.

See Appendix 2 for the procedure on how to deal with these requests.

Up to £50 (on a sliding scale for photocopying fees) can be charged for access to a pupil's educational record.

- (ii) Provision of data to children

In relation to the capacity of a child to make a request, guidance provided by the Information Commissioner's Office states that by the age of 12 a child can be expected to have sufficient maturity to understand the nature of the request. A child may of course reach sufficient maturity earlier; each child should be judged on a case by case basis.

Polisi Diogelu Data Ysgolion 2018 v1-0 47