Five Data Protection & Cyber Security Updates Every School Should Know This Week

Keeping up with data protection, cyber security and information governance can be difficult when you’re also managing the day-to-day running of a school.

Each week, SchoolDPO.com reviews updates from the Information Commissioner’s Office (ICO), the Department for Education (DfE), the National Cyber Security Centre (NCSC) and other trusted sources to highlight the developments that matter most to schools, academies and trusts.

This week’s round-up focuses on five key developments that school leaders should be aware of before the summer break and the start of the new academic year.

1. New Legal Duty: Schools Must Have a Data Protection Complaints Process

One of the most significant changes this month is the introduction of a new legal requirement for organisations that process personal data to operate a clear data protection complaints process.

Under the Data (Use and Access) Act, schools must now ensure individuals can raise data protection complaints directly with the school. Complaints should be acknowledged within 30 days, investigated appropriately and resolved without undue delay. (Information Commissioner’s Office)

What this means for schools

Schools should review whether they have:

• a documented data protection complaints procedure;

• a clear route for parents, staff and pupils to raise concerns;

• appropriate records of complaints and outcomes; and

• updated privacy notices explaining how complaints can be made.

Although many schools already operate a general complaints policy, this new duty requires schools to consider complaints specifically relating to personal data and UK GDPR compliance.

2. DfE Refreshes Data Protection Guidance

The Department for Education has updated its guidance on data protection in schools, reinforcing existing expectations around governance, safeguarding and the use of technology in education. The refresh also reflects the growing use of generative AI and the importance of ensuring that schools understand how personal data is processed when using new digital tools. (Data Protection Education)

Practical actions

School leaders should consider:

• reviewing staff guidance on AI tools;

• checking privacy notices remain accurate;

• ensuring software suppliers have appropriate data protection arrangements; and

• confirming governors receive regular assurance on compliance.

• 
  

3. Cyber Security Remains One of the Biggest Risks Facing Schools

Cyber attacks against education continue to make headlines.

Recent incidents affecting schools demonstrate that ransomware groups continue to target the education sector, with attacks disrupting learning, exposing personal information and placing significant pressure on school resources. (Data Protection Education)

Schools should review

• Multi-factor authentication (MFA)

• Backup arrangements

• Password policies

• Incident response plans

• Staff cyber awareness training

  
  

Cyber security should now be viewed as both an IT issue and a safeguarding responsibility.

4. AI Continues to Present Opportunities and Risks

Artificial intelligence is becoming increasingly common within schools.

From lesson planning and administrative support to drafting communications, tools such as ChatGPT, Microsoft Copilot and Google Gemini offer genuine opportunities to reduce workload.

However, schools should also ensure that staff understand:

• when personal information can and cannot be entered into AI tools;

• whether suppliers use information for model training;

• the need for human oversight of AI-generated content; and

• the importance of maintaining confidentiality.

  
  

Clear policies and staff guidance remain essential as AI becomes more widely adopted.

5. Summer Is the Ideal Time to Review Compliance

The summer holiday provides schools with an excellent opportunity to review key documentation before September.

We recommend checking:

• Data Protection Policy

• Privacy Notices

• Subject Access Request Procedure

• Data Breach Procedure

• Acceptable Use Policy

• AI Guidance

• Information Security Policy

• Records Retention Schedule

  
  

Small improvements now can prevent much larger issues later in the year.

Five Practical Actions for This Week

✔ Review your data protection complaints process.

✔ Ensure governors are aware of current cyber risks.

✔ Check staff understand the school’s approach to AI.

✔ Confirm multi-factor authentication is enabled for key systems.

✔ Schedule a policy review before the start of the autumn term.

Looking Ahead

Over the coming weeks we expect further developments relating to AI governance, cyber security and education technology.

SchoolDPO.com will continue monitoring guidance from the ICO, DfE, NCSC and other regulators, translating complex legal and technical developments into practical advice for schools.

If you would like support reviewing your policies, providing staff training or acting as your school’s independent Data Protection Officer, we’d be delighted to help.

Visit SchoolDPO.com for practical guidance, downloadable resources and the latest updates for schools, academies and trusts.

Useful Resources

• ICO: Data (Use and Access) Act and new complaints handling guidance.

• ICO: Guidance on data protection complaints.

• DfE: Data protection in schools guidance.

• NCSC: Cyber security guidance for schools.

• DfE Cyber Security Hub.

  
  

(Always refer to the latest official guidance before updating school policies or procedures.)