Two Cyber Security Warnings Every School Leader Should Know About This Week
SchoolDPO | 26 October 2026
Schools and academy trusts hold substantial amounts of personal information, including pupil records, safeguarding information, SEND documentation, medical information and staff records.
Protecting that information is not simply a matter for the IT department. It is a responsibility shared by school leaders, governors, trustees and the organisations providing technical services.
Two recent cyber security developments provide a timely reminder of why schools need effective oversight of their systems, suppliers and information security arrangements.
The first concerns a reported National Cyber Security Centre (NCSC) warning about critical software vulnerabilities. The second involves Information Commissioner’s Office (ICO) enforcement action following a ransomware attack that exposed children’s personal information.
Although the circumstances are different, both reinforce an important message:
Outsourcing IT does not mean outsourcing responsibility for data protection.
1. NCSC cyber security warning: could your school systems be affected?
A recent NCSC security warning has highlighted the importance of identifying and addressing critical vulnerabilities in software used by organisations.
The reported warning concerns vulnerabilities affecting PHP, a programming language widely used to operate websites and online applications.
PHP is used behind the scenes by many websites and digital services. Schools may therefore use systems built with PHP without necessarily knowing it.
This does not mean that every school website or online system is vulnerable. The level of exposure depends on the software, its configuration and whether the affected components are installed.
However, the wider message is important.
Schools need assurance that their internet-facing systems are maintained, monitored and updated appropriately.
Why does this matter to schools?
Schools and academy trusts increasingly rely on externally hosted websites, cloud applications, parent communication systems and specialist educational platforms.
A security vulnerability could potentially allow an attacker to compromise a system, access information or disrupt services.
For schools, the consequences could include:
Unauthorised access to personal information.
Disruption to school websites or online services.
Compromise of administrative systems.
Loss of access to essential records.
Additional safeguarding, operational and reputational risks.
Not every cyber security incident constitutes a personal data breach. However, where personal information is compromised, schools must consider their obligations under UK GDPR.
What should schools do?
School leaders do not need to become technical experts or independently investigate software vulnerabilities.
They do, however, need appropriate assurance from those responsible for managing their systems.
Schools should ask their IT provider or website administrator:
Are any of our systems affected by the recently reported vulnerabilities?
Have the relevant security updates been reviewed and applied where necessary?
Are our externally accessible systems regularly checked for vulnerabilities?
How are critical security warnings identified and prioritised?
What arrangements are in place if a serious vulnerability cannot be immediately resolved?
Where a school uses several different providers, responsibilities should be clear.
For example, the organisation maintaining the school website may not be the same provider responsible for the school’s management information system or network.
Recommended action: Request confirmation from relevant IT providers that current critical security alerts have been reviewed and any necessary action taken.
This is a sensible security precaution, rather than a new statutory requirement created by the warning.
Official NCSC website:
Publication note: The precise October PHP advisory and vulnerability identifiers should be checked against the original NCSC publication before being presented as a confirmed technical alert.
2. ICO enforcement: children’s information exposed following a ransomware attack
A recent ICO enforcement case involving two Welsh organisations provides a particularly relevant lesson for schools.
According to the reported enforcement findings, a ransomware attack resulted in the theft of personal information relating to approximately 3,300 individuals, predominantly children.
The reported investigation identified weaknesses involving an old test account, inadequate security arrangements and insufficient oversight of relevant technical and contractual responsibilities.
The case illustrates how a seemingly minor weakness can contribute to a significant security incident.
The danger of forgotten accounts
Organisations often create accounts for temporary staff, contractors, testing or system administration.
Over time, some accounts may no longer be required.
If these accounts remain active, particularly where they have unnecessary permissions or weak passwords, they can create avoidable security risks.
This is especially relevant in schools, where staff turnover, temporary appointments, agency workers and external contractors can result in numerous accounts being created.
Schools should have arrangements to ensure that accounts are removed or disabled when no longer needed.
What about external IT providers?
Many schools rely on managed IT services to maintain networks, administer accounts, manage cloud systems and respond to technical incidents.
These arrangements can provide valuable expertise.
However, they do not automatically transfer the school’s data protection responsibilities to the provider.
Where a school or trust is the data controller, it remains responsible for ensuring that personal information is processed lawfully and securely.
Where an external organisation processes personal data on the school’s behalf, appropriate contractual arrangements are also required.
Under UK GDPR Article 28, these arrangements must include relevant provisions concerning the processing of personal data.
Article 32 requires appropriate technical and organisational security measures.
The key distinction is between delegating technical work and retaining organisational accountability.
A school may reasonably expect its IT provider to manage account security, but school leaders should still understand what arrangements are in place and how they are assured.
Five questions to ask your IT provider
Schools should be able to obtain clear answers to the following:
1. Are inactive accounts removed?
There should be a process for disabling accounts when staff, contractors or other users leave or no longer require access.
2. Is multifactor authentication enabled?
MFA should be implemented where appropriate, particularly for administrative accounts, remote access and systems containing sensitive information.
3. Who has administrator access?
Privileged access should be limited to those who need it and reviewed regularly.
4. Are security responsibilities documented?
The school should understand which responsibilities belong to its internal staff and which belong to external providers.
5. What happens if there is a cyber incident?
Schools need to know who will investigate, who will preserve evidence, who will assess any personal data breach and who will decide whether notification to the ICO is necessary.
Official ICO website and enforcement publications:
Publication note: The exact October enforcement notice and reported case details should be checked against the ICO’s original publication before quoting the figures or account credentials as established facts.
3. Cyber security is a governance issue, not just an IT issue
These developments highlight an important distinction.
IT providers are responsible for carrying out the technical activities they have agreed to deliver.
School leaders and governing bodies are responsible for ensuring that appropriate organisational arrangements exist.
This includes understanding significant risks, obtaining assurance and ensuring that relevant policies and procedures are followed.
A school does not necessarily need a detailed technical explanation of every software vulnerability.
However, leaders should know:
Who is responsible for monitoring cyber security risks.
Whether critical vulnerabilities are addressed promptly.
How access to sensitive information is controlled.
Whether external providers have appropriate contractual responsibilities.
What arrangements exist for responding to incidents.
How cyber security risks are reported to governors or trustees.
These are reasonable governance questions for any school or trust.
4. What does UK GDPR actually require?
It is important to distinguish legal obligations from recommended good practice.
Neither an NCSC security warning nor an ICO enforcement decision automatically creates new legislation for schools.
However, existing data protection requirements remain relevant.
Article 5: Integrity and confidentiality
Personal data must be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and accidental loss, destruction or damage.
Article 24: Responsibility of the controller
Schools and trusts acting as data controllers must implement appropriate measures and be able to demonstrate compliance.
Article 28: Processor arrangements
Where external providers process personal information on behalf of a school, appropriate contractual arrangements must be in place.
Article 32: Security of processing
Organisations must implement appropriate technical and organisational measures, taking account of the risks associated with processing personal data.
Articles 33 and 34: Personal data breach notification
Where a personal data breach is likely to result in a risk to individuals’ rights and freedoms, the ICO must normally be notified within 72 hours of the controller becoming aware of the breach, where feasible.
Where a breach is likely to result in a high risk, affected individuals must also be informed without undue delay, subject to the applicable exceptions.
Not every cyber incident requires notification. Schools should assess and document the circumstances of each personal data breach.
Official UK GDPR guidance:
5. What should school leaders do this week?
There is no need for schools to respond to every cyber security announcement by producing new policies or introducing unnecessary administrative processes.
A proportionate approach is more useful.
We recommend five practical actions.
First, obtain assurance from your IT provider. Confirm that relevant security alerts have been reviewed and that critical vulnerabilities are being managed.
Second, review access arrangements. Ensure that old accounts are disabled, unnecessary permissions are removed and privileged access is appropriately controlled.
Third, check supplier responsibilities. Confirm that responsibilities for cyber security, account management, incident response and personal data processing are clearly documented.
Fourth, review your incident response arrangements. Staff should know how to report a suspected cyber incident or personal data breach and who is responsible for assessing it.
Finally, ensure governors and trustees receive appropriate assurance. Cyber security should form part of wider risk management and information governance arrangements.
These actions should not require schools to duplicate work already being undertaken effectively by their IT providers.
The objective is to ensure that appropriate arrangements exist and that leaders have confidence they are working.
6. A note for governors and trustees
Cyber security is increasingly relevant to school governance because of the amount and sensitivity of information held by educational organisations.
A serious incident could disrupt teaching, prevent access to essential systems, expose confidential information and create significant operational pressures.
Governors and trustees do not need detailed technical expertise.
They should, however, be able to challenge leaders appropriately and seek assurance that risks are being managed.
A useful question at the next governing body or trust committee meeting would be:
“How do we know that our school’s cyber security arrangements are effective, particularly where services are provided by external organisations?”
The answer should be supported by clear responsibilities, proportionate assurance and effective incident response arrangements.
Final thoughts
Schools depend on technology to deliver education, manage information and communicate with families.
External IT providers play an essential role in maintaining these systems, but technical support is only one part of effective information governance.
The wider responsibility involves leadership, accountability, appropriate policies, supplier oversight and staff awareness.
The lesson from recent cyber security developments is straightforward:
Schools can outsource technical services, but they cannot simply outsource accountability for the personal information they hold.
A few well-targeted questions to IT providers, alongside effective governance arrangements, can make a meaningful difference.
How SchoolDPO can help
SchoolDPO provides practical data protection and information governance support to schools, academies and multi-academy trusts.
We support schools with data protection policies, information governance arrangements, personal data breach assessments, subject access requests, supplier arrangements and wider UK GDPR compliance.
If your school would benefit from reviewing its data protection arrangements or obtaining independent advice about information governance responsibilities, please get in touch.
SchoolDPO – Practical data protection support for schools.
Comments