Lambrook School is a data controller for the purposes of data protection legislation (UK General Data Protection Regulations – Data Protection Act 2018) as we process personal data. This notice is designed to give information about how we process that data. 

This policy is to be read in relation to other School policies including:

  • Data Protection Policy
  • Complaints Procedure

What type of data we possess

This information will include:

  • names, email addresses, contact details;
  • parent banking or financial information;
  • pupil assessment results, academic records, attendance information, any disciplinary or exclusion information;
  • references from a previous school;
  • any special educational needs pupils may have;
  • where pupils go after they leave us and personal characteristics such as ethnic groups; and
  • medical information for staff and pupils and contact details of next of kin and guardians.

The School collects photographic images of pupils which are used for purposes of identification and also for marketing purposes. Upon accepting an offer of a place at the School, parents are offered an opportunity to consent or otherwise to the use of their child’s photographic image for marketing purposes. We will not use images of pupils for marketing purposes where parental consent has not been explicitly given.

Images of parents, pupils and other visitors to the School will be captured by our CCTV system which monitors public areas including the main entrance used by visitors, the pedestrian and vehicle gates, and the entrances to all other School buildings. The School only has one CCTV camera inside Lambrook House in the lobby outside the Headmaster’s office. These images are collected and stored in line with the Lambrook Security Statement and Data Protection Policy. The images do not leave School premises and are never shared with any third party, with the potential exception of law enforcement agencies in the event of a security breach. Images are kept for one month.

How we gather and use pupil information

We collect and hold personal information relating to our pupils and their parents directly from parent(s)/guardian(s) at the time of registration and joining the School and may also receive information about them from their previous School, local authority and/or the Department for Education (DfE). We do this for the legitimate interest of educating children. We also create personal information about the pupil during their time in the school in the form of assessments, marking of work and reports. We use this personal data:

  • For the purposes of pupil assessment and to confirm the identity of prospective pupils and their parents.
  • To provide education services (including SEN), digital remote learning education services, career services, and extra-curricular activities to pupils; monitoring pupils’ progress and educational needs; and maintaining relationships with alumni and the School community.
  • For the purposes of management planning and forecasting, research and statistical analysis, and to enable the relevant authorities to monitor the School’s performance.
  • To give and receive information and references about past, current and prospective pupils, including relating to outstanding fees or payment history, to/from any educational institution that the pupil attended or where it is proposed they attend.
  • To enable pupils to take part in national or other assessments, and to publish the results of public examinations or other achievements of pupils of the School.
  • To safeguard pupils’ welfare and provide appropriate pastoral (and where necessary, medical) care, and to take appropriate action in the event of an emergency or accident, including by disclosing details of an individual’s medical condition where it is in the individual’s interests to do so, for example for medical advice, insurance purposes or to organisers of School trips.
  • To monitor (as appropriate) use of the School’s IT and communications systems in accordance with the School’s ICT Acceptable Use Policy.
  • To facilitate operation management of the school, including the compilation of pupil records, the administration of invoices, fees and accounts, the management of security and safety arrangements (including the use of CCTV in accordance with our CCTV policy), the maintenance of historic archives, and other operational purposes.
  • To make use of photographic images of pupils for identification purposes and in School publications, on the School website and (where appropriate) on the School’s social media channels, where parental permission has been given, and in accordance with the School’s ICT Acceptable Use Policy.
  • For security purposes, and for regulatory and legal purposes (for example child protection and health and safety) and to comply with its legal obligations.
  • Where otherwise reasonably necessary for the School’s purposes, including to obtain appropriate professional advice and insurance for the School.

How we use parent information

We collect and process personal data relating to the parents of pupils at the School at the time of registration and joining Lambrook. This data is used:

  • For contractual purposes and/or to enable the payment of fees.
  • To keep parents informed and provide accurate information relating to ongoing events and activities held within the school. This communication may take the form of the School e-newsletter or may be communicated directly through telephone, email or post.
  • Upon accepting an offer of a place at the School for a child, parents will have been offered an opportunity to consent or otherwise to our sharing of contact information with other parents in a child’s cohort. The purpose of this sharing of information is to facilitate the wider School community. We will not share contact information with a child’s cohort unless explicit consent has been given.

Who has access to personal data?

For the most part, personal data held by the School will remain within the School and will be processed by appropriate members of staff for the purpose for which the data was collected.  Personal data, for example, will be used in communication with parents and senior schools, the organisation and management of classes and small groups within classes, assessment, organisation, school fixtures / team selection.

As an organisation, we have taken appropriate technical steps to protect personal data and have implemented policies addressing use of technology. Particularly strict rules of access apply in the context of medical records and pastoral or safeguarding file although a certain amount of information will need to be disseminated more widely in order to provide the necessary care and education that the pupil requires (for example, details of any allergies or life threatening medical conditions).

Some of the School’s systems are provided by third parties with some being hosted by the School and others externally. Those hosted externally include the School’s website, Microsoft 365, SOCS and iSAMS. The organisations providing these systems are aware of the requirements of current data protection legislation.

In certain circumstances, we share personal data (including, where necessary, special category personal data) with third parties in order to further the objectives and interests of the School and facilitate the efficient operation of the School. Examples of the third parties with whom we share personal data are relevant authorities (such as the Local Children Safeguarding Board, the Charity Commission, the Independent Schools Inspectorate, the Information Commissioner), the emergency services, third parties who run or support academic, musical, sporting or co-curricular tuition, activities and training or school trips on behalf of or in conjunction with the School.

At the time that a child transitions to another School, we will share transfer reports about the child with their next School which may also include exam results. We are required, by law, to pass certain information about our pupils to our local authority (LA) and the Department for Education (DfE). DfE may also share pupil level personal data that we supply to them, with third parties. This will only take place where legislation allows it to do so and it is in compliance with the Data Protection Act 2018.

Consent for the sharing of data in this way may be given or withdrawn by parents at any time during a child’s attendance at the School. If parents wish to change consent, please contact the Privacy Officer through the Lambrook School Office.

How long do we keep data for?

Personal data will be kept securely and for no longer than is necessary or required by law. As this period will vary depending on the piece of personal data and the purpose for which it was collected, we follow a records and retention policy which details the time periods for each different category. If parents have any specific questions in respect of retention, they should direct them to the Compliance Officer, via the Lambrook School Office.

It should be noted that records considered by the School to be of historic value are retained and passed to County Archive Services indefinitely. Personal data in the archive relating to living individuals which is not otherwise in the public domain is not shared with third parties without that individuals’ consent.

When a child leaves the School, parents (and the child if s/he has reached the age of 13) will be offered the opportunity to be included in our Alumni programme. A separate Privacy Notice regarding the processing of data for Alumni purposes will be provided at that time.

If parents would like to receive a copy of the information about themselves, or their son/daughter that we hold, please contact the Lambrook School Office in the first instance

Your rights

Please see the rights as a ‘data subject’, which are the same as any member for the public, under applicable data protection legislation from the Information Commissioner’s Office website available at


  • to obtain access to, and copies of, the personal data that we hold about a parent and/or child;
  • to require us to correct the personal data we hold about parents and children, if it is incorrect;
  • to require us (in certain circumstances) to erase a parent or child’s personal data;
  • to request that we restrict our data processing activities (and, where our processing is based on parental consent, parents may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal);
  • to receive from us the personal data we hold about a parent/child which has been provided to us, in a reasonable format specified by the parent, including for the purpose of transmitting that personal data to another data controller;
  • to object, on grounds relating to an individuals particular situation, to any of our particular processing activities where parents feel this has a disproportionate impact on their rights.
  • Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply. The school will endeavour to respond to any such requests as soon as is reasonably practicable and in any event within statutory time-limits (which is generally one month, but actually fulfilling more complex or multiple requests, e.g. those involving third party information, may take 1-2 months longer).

Contact and complaints

If you have any complaint about the way that personal data is handled, please refer to the School’s Complaints Policy. If after following the complaints process you think we have not dealt with your request for information properly, complaints can be made to the Information Commissioners Office.