QUICK LINKS MENU Home Current Parents GDPR Share this page GDPR What is GDPR? In the UK, GDPR replaced the Data Protection Act 1998, which was brought into law as a way to implement the 1995 EU Data Protection Directive. GDPR seeks to give people more control over how organisations use their data, and introduced hefty penalties for organisations that fail to comply with the rules. It also ensures data protection law is almost identical across the EU. The Data Protection Act 1998 (‘DPA 1998’) applied to the way schools and trusts handled personal data. Most schools and trusts were familiar with the general requirements of the DPA 1998, for example, the circumstances when they could disclose personal data and what to do if a person submitted a subject access request. In May 2018, the DPA 1998 was replaced by the General Data Protection Regulations which is often referred to as the ‘GDPR’. Although many of the principles remain the same as the DPA 1998, there are some important changes which affect the way we process data. In general terms, the GDPR places more emphasis on transparency, accountability and record keeping. Why do we need it? The update to Data Protection legislation in many ways was long overdue as the 1998 Act pre-dates Facebook, Twitter and all social media. It is hard to remember, or believe, that in 1998 mobile phones were limited to making and receiving calls, and text messaging that was charged by each character. Email was being used, but not every organisation had email addresses and hard copy documents were the mainstay of storage and records. iPhones, Blackberry’s, smart phones, tablets were yet to come. Access to the internet was limited and actually required a physical dial up. There was no 3G or wireless hotspots for casting communication and Google went live in 1998 - the same year as the DPA. The Data Protection Act was fit for purpose then, but all of the changes in the last 19 years mean that a new framework was essential. Compliance with the Data Protection Act principles in the UK is largely the responsibility of the Information Commissioner. The Information Commissioner’s Office (ICO) is the regulatory and supervisory authority. The ICO has the ability to provide advice, undertake audits, access information, impose sanctions and penalties. What does this mean for Schools? Schools process a lot of personal data relating to pupils and staff in order to carry out its functions. They also acquire personal data relating to other people including, for example, parents / carers, local governors, trustees, members of the local community, suppliers, contractors and consultants. It is therefore important that all schools ensure they handle personal data carefully and legally. Our Multi-Academy Trust’s View The SDBE MAT and our schools are committed to protecting the privacy and security of personal information and being transparent about the way in which we use the information we hold. It is our responsibility to make sure we, and our schools, are handling and treating information carefully and legally. The SDBE MAT has a dedicated page on the website that covers the Trust’s approach to GDPR and how, as a group of schools, we ensure compliance and develop a culture of data security and awareness. To access this information, please visit: https://gdpr.sdbemat.org Our School Our school collects a lot of data and information about our pupils, staff parents and carers so that we can run effectively as a school. In our documentation, we explain how and why we collect certain data, what we do with it and what rights parents and pupils have. Key Information This Academy is an academy within the SDBE Multi-Academy Trust (“SDBE MAT”). The SDBE MAT is a charitable company limited by guarantee (registration number 10385920) whose registered office is 48 Union Street, London, United Kingdom, SE1 1TD. The SDBE MAT is the Data Controller for all the academies within the Trust. The Data Protection Officers for the SDBE MAT are: Mark Burnett Chief Operating Officer dpo@sdbemat.org Thomas Scrace HR Business Partner dpo@sdbemat.org The Data Protection Lead at this school is: Kate Penfold Deputy Head dpo.stmatthews@sdbemat.org DOCUMENTS GDPR Date GDPR Privacy Notice - Primary Aged Pupils 01st Sep 2021 GDPR Privacy Notice - Parents and Carers 01st Sep 2021 GDPR Privacy Notice - Governors 01st Sep 2021 GDPR Privacy Notice - Employees 01st Sep 2021 GDPR Policy 01st Sep 2021 Data Retention Policy 01st Sep 2021 CCTV Policy 01st Sep 2021 CURRENT PARENTS Newsletters Letters Home Term Dates Calendar The School Day School Uniform School Meals Attendance and Medical Information Breakfast and After School Club Extra-Curricular Activities Provision for Pupils with Special Educational Needs and Disabilities (SEND) Special Needs Support Centre (SNSC) Provision for High Attaining Pupils Friends of St Matthew's (FOSM) Policies GDPR Useful Websites for Our Pupils Supporting your child's learning BACK TO TOP CONNECT WITH US CONTACT US Headteacher Mrs J Lightfoot Linkfield Lane, Redhill, Surrey, RH1 1JF T: 01737 762080 info@stmatthews-redhill.surrey.sch.uk USEFUL LINKS Site Map Terms of Use Privacy Policy GDPR Sitemap Terms of Use Privacy Policy Cookie Usage High Visibility Version School website by * Cookie Policy: We use cookies on this site to improve your user experience. MORE INFORMATION ALLOW ALL COOKIES MANAGE PREFERENCES