Privacy Policy

Ridgeway Education Trust Privacy Notice (How we use pupil information)

Under data protection law, individuals have a right to be informed about how the school uses any personal data that we hold about them. We comply with this right by providing ‘privacy notices’ (sometimes called ‘fair processing notices’) to individuals where we are processing their personal data.

This privacy notice explains how we collect, store and use personal data about pupils.

Didcot Girls’ School, St Birinus School and Sutton Courtenay CofE Primary School are a part of the Ridgeway Education Trust. The Trust is the ‘data controller’ for the purposes of data protection law.

The categories of pupil information that we process includes, but is not restricted to:

  • Personal identifiers and contacts (such as name, unique pupil number, contact details and address)
  • Characteristics (such as ethnicity, language, and free school meal eligibility)
  • Safeguarding information (such as court orders and professional involvement)
  • Special Educational Needs (including the needs and ranking)
  • Medical and administration (such as doctor’s information, child health, dental health, allergies, medication and dietary requirements)
  • Attendance and school history (such as sessions attended, number of absences, absence reasons and any previous schools attended)
  • Assessment and attainment (such as results of internal assessment and externally set tests)
  • Behavioural information (such as exclusions and any relevant alternative provision put in place)
  • Photographs (such as or identification in the school management information or cashless catering systems)
  • CCTV images captured in school
  • Biometric data (for our cashless catering system)
  • Catering information (such as eligibility for free school meals and on allergies)

Why we collect and use pupil information

We collect and use pupil information to:

  • support pupil learning
  • support pupil welfare
  • monitor and report on pupil progress
  • provide appropriate pastoral care
  • assess the quality of our services
  • keep children safe (food allergies, or emergency contact details)
  • meet the statutory duties placed upon us for DfE data collections
  • support pupils in deciding what to do after leaving school

We are required by The Education (Pupil Information) (England) Regulations 2005 to maintain a Pupil’s Educational Record. We only collect and use pupils’ personal data when the law and our policies allows us to.

Most commonly, we process it where:

  • we need to comply with a legal obligation
  • we need it to perform an official task in the public interest

Less commonly, we may also process pupils’ personal data in situations where:

  • we have obtained consent to use it in a certain way
  • we need to protect the individual’s vital interests (or someone else’s interests)

Where we have obtained consent to use pupils’ personal data, this consent can be withdrawn at any time. We will make this clear when we ask for consent, and explain how consent can be withdrawn.

Some of the reasons listed above for collecting and using pupils’ personal data overlap, and there may be several grounds which justify our use of this data.

How we collect pupil information

We collect and hold personal information relating to our pupils and those involved in their care. Pupil information is collected via enrolment forms as students join the school and secure file transfer from previous school. We may also receive information from local authorities and/or the DfE.

Pupil data is essential for the schools’ operational use. Whilst the majority of pupil information you provide to us is mandatory, some of it requested on a voluntary basis. In order to comply with the data protection legislation, we will inform you at the point of collection, whether you are required to provide certain pupil information to us or if you have a choice in this.

How we store pupil data

We keep personal information about pupils while they are attending our school. We may also keep it beyond their attendance at our school if this is necessary in order to comply with our legal obligations. Our record retention schedule sets out how long we keep information about pupils. Records are kept on our computer systems and we also hold some paper records.

We hold pupil data securely for the set amount of time recommended by the Information and Records Management Society’s toolkit for schools. 

For more information on our data retention schedule please refer to the IRMS toolkit -

Who we share pupil information with

We do not share information about pupils with any third party without consent unless the law and our policies allow us to do so.

Where it is legally required, or necessary (and it complies with data protection law) we may share personal information about pupils with:

  • schools that the pupils attend after leaving us
  • Oxfordshire County Council – to meet our legal obligations for data sharing with our local authority
  • The Department for Education (DfE) – to meet our legal obligations for sharing statutory data
  • education, training, careers and examining bodies
  • suppliers and service providers – to enable them to provide the service we have contracted them for.
  • suppliers of curriculum resources and learning support packages
  • Ofsted and other auditors
  • school staff, the trust board and school governing bodies
  • The pupil’s family and representatives
  • NHS and healthcare professionals
  • social and welfare organisations
  • the appointed school counsellor
  • police forces, courts, tribunals

Youth support services

Once our pupils reach the age of 13, we also pass pupil information to our local authority youth support services as they have responsibilities in relation to the education or training of 13-19-year-olds under section 507B of the Education Act 1996. This enables them to provide youth support services, post-16 education and training services and careers advisers.

Parents/carers, or pupils aged 16 or over, can contact our data manager to request that we only pass on the pupil’s name, address and date of birth to the youth support services. For more information about services for young people, please visit the Oxfordshire County Council website. 

Requesting access to your personal data

Under data protection legislation, parents and pupils have the right to request access to information about them that we hold (Subject Access Request). To make a request for your personal information, or be given access to your child’s educational record, contact:

School Data Protection Lead



Didcot Girls’ School

01235 812092

St Birinus School

01235 814444

Sutton Courtenay CofE Primary School 

01235 848 333

Data Protection Officer




01865 597620 (option 3 - GDPR)


You also have the right to:

  • object to processing of personal data that is likely to cause, or is causing, damage or distress
  • prevent processing for the purpose of direct marketing
  • object to decisions being taken by automated means
  • in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
  • a right to seek redress, either through the ICO, or through the courts

If you have a concern or complaint about the way we are collecting or using your personal data, we encourage you to raise your concern with us in the first instance. You have right to contact the Information Commissioner’s Office directly at:

ICO Concerns

Department for Education

The Department for Education (DfE) collects personal data from educational settings and local authorities via various statutory data collections. This data sharing underpins school funding and educational attainment policy and monitoring. We are required to share information about our pupils with the DfE either directly or via our local authority under regulation 5 of The Education (Information About Individual Pupils) (England) Regulations 2013.

All data is transferred securely and held by DfE under a combination of software and hardware controls, which meet the current government security policy framework.  

Government Security Policy Framework

For more information, please see ‘How Government uses your data’ section.

How the Government uses your data

The pupil data that we lawfully share with the DfE through data collections:

  • underpins school funding, which is calculated based upon the numbers of children and their characteristics in each school.
  • informs ‘short term’ education policy monitoring and school accountability and intervention (for example, school GCSE results or Pupil Progress measures).
  • supports ‘longer term’ research and monitoring of educational policy (for example how certain subject choices go on to affect education or earnings beyond school)

Data collection requirements

To find out more about the data collection requirements placed on us by the Department for Education (for example; via the school census) go to:

Data Collection

The National Pupil Database (NPD)

Much of the data about pupils in England goes on to be held in the National Pupil Database (NPD). The NPD is owned and managed by the Department for Education and contains information about pupils in schools in England. It provides invaluable evidence on educational performance to inform independent research, as well as studies commissioned by the Department. 

It is held in electronic format for statistical purposes. This information is securely collected from a range of sources including schools, local authorities and awarding bodies. 

To find out more about the NPD, go to:

Pupil Database

Sharing by the Department

The law allows the Department to share pupils’ personal data with certain third parties, including:

  • schools
  • local authorities
  • researchers
  • organisations connected with promoting the education or wellbeing of children in England
  • other government departments and agencies
  • organisations fighting or identifying crime

For more information about the Department’s NPD data sharing process, please visit: 

Data Protection

Organisations fighting or identifying crime may use their legal powers to contact DfE to request access to individual-level information relevant to detecting that crime. Whilst numbers fluctuate slightly over time, DfE typically supplies data on around 600 pupils per year to the Home Office and roughly 1 per year to the Police.

For information about which organisations the Department has provided pupil information, (and for which project) or to access a monthly breakdown of data share volumes with Home Office and the Police please visit the following website:


To contact DfE


If you have any questions, concerns or would like more information about anything in this privacy notice, please contact:

School Data Protection Lead



Didcot Girls’ School

01235 812092

St Birinus School

01235 814444

Sutton Courtenay CofE Primary School

01235 848 333

Data Protection Officer




01865 597620 (option 3 - GDPR)

For more information you can find the Trust Data Protection Policy on our website. This notice is based on the Department for Education’s model privacy notice, amended to reflect the way we use data in this school.

Back to Top