What Changed This Week in School Compliance? The SchoolDPO Weekly Briefing – 23 July 2026

The summer holidays may have begun for many schools, but compliance doesn’t stop when the pupils leave.

This week has seen several important developments in safeguarding, data protection and education that school leaders should be aware of before the new academic year begins.

Rather than simply listing the headlines, here’s what they mean in practice and whether schools need to take action now.

1. Updated DfE Data Protection Guidance

The Department for Education has refreshed its Data Protection in Schools guidance following the implementation of the Data (Use and Access) Act 2025.

The updates include further guidance around educational technology, data protection responsibilities and managing personal data within schools.

What this means for schools

For most schools, this isn’t a reason to rewrite every GDPR policy overnight. However, it is worth checking that your current documentation reflects the latest expectations and that any new software being introduced in September has been properly assessed.

SchoolDPO View:

If your GDPR documentation hasn’t been reviewed in the last 12–18 months, now is an ideal opportunity to complete a compliance health check before the autumn term begins.

2. KCSIE 2026 Is Ready for September

The latest version of Keeping Children Safe in Education has now been published and comes into effect on 1 September.

While many of the principles remain familiar, schools should ensure they understand any updates before staff return.

What schools should be doing now

During the summer break, schools should:

● Review safeguarding and child protection policies.

● Update annual safeguarding training.

● Prepare staff briefing materials for September.

● Ensure governors and trustees are aware of any significant changes.

SchoolDPO View:

Don’t wait until the first INSET day to read the guidance. Having policies and training ready before staff return makes the start of term significantly smoother.

3. The ICO Continues to Focus on Educational Technology

The Information Commissioner’s Office continues to work with education technology providers following its review of how children’s personal information is processed.

The message remains clear: schools are responsible for ensuring suppliers handle personal data lawfully and transparently.

Questions every school should ask

Before introducing any new platform, ask:

● Is there a signed Data Processing Agreement?

● Has a DPIA been completed where required?

● Do we know where the data is stored?

● Is the supplier collecting more information than necessary?

● How and when is the data deleted?

SchoolDPO View:

Technology can transform learning, but compliance must be considered before implementation rather than after problems arise.

4. Subject Access Requests Continue to Increase

Across the education sector, Subject Access Requests remain one of the most time-consuming areas of GDPR compliance.

Requests involving safeguarding, complaints, family disputes or historic records can quickly become complex.

Good preparation makes all the difference

Schools should ensure they have:

● a documented SAR procedure;

● a clear tracking process;

● appropriate redaction procedures;

● an understanding of third-party information;

● realistic plans for meeting statutory deadlines.

SchoolDPO View:

The best SAR processes are built before the request arrives—not during it.

5. September Is Closer Than You Think

Although schools are currently quieter, the first few weeks of the autumn term quickly become busy with admissions, safeguarding updates, inspections, policy reviews and governance meetings.

Taking time now to review compliance arrangements can prevent issues becoming urgent later in the term.

Final Thoughts

Compliance isn’t about producing more paperwork. It’s about giving school leaders confidence that the right systems are in place to protect pupils, support staff and meet legal responsibilities.

Each week, SchoolDPO will continue to monitor developments from the Department for Education, the Information Commissioner’s Office and across the education sector, highlighting what has changed and—more importantly—what schools actually need to do.

If you’d like support reviewing your school’s GDPR arrangements, safeguarding documentation or compliance framework before September, we’d be happy to help.

About SchoolDPO

SchoolDPO provides practical data protection, GDPR and compliance support exclusively for schools. From acting as your outsourced Data Protection Officer to supporting Subject Access Requests, policy reviews, staff training and ICO enquiries, we help schools stay compliant while focusing on what matters most—delivering excellence in education.