Data and its protection
We take the management and protection of information and personal data seriously. This page explains how we manage the collection, storage and security of data to comply with Freedom of Information Act 2000, UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025 to keep information safe and secure.
1. Information and data protection policies & documents
We manage information and data according to the policies and documents below:
- Freedom of Information Publication scheme – what information we publish or hold.
- Data Protection policy – how the school meets its legal duties.
- Special Category Data policy.
- Information Management/Security policy – keeping data safe.
- Records Retention schedule – how long data is kept.
- Acceptable Use policy (staff & pupils).
2. Privacy notices
We collect personal information from parents, pupils, staff & volunteers so that we:
- provide children with an education.
- keep everyone safe.
- communicate effectively.
- fulfil our legal obligations as a public body.
We provide more details on the data we collect in our Privacy Notices. we have different privacy notices for:
- Pupils
- Parents/Carers
- Staff
- Governors
3. Your rights
Individuals whose data we manage have the right to:
- access their data (Subject Access Request).
- request corrections.
- ask for deletion (where applicable).
- object to processing.
- complain about how we have managed their data.
Parents also have the right to see their child’s educational record.
Everyone has the right to ask broader questions about the school under the Freedom of Information Act. You can find out what we already publish by looking through our Publication Scheme.
4. How to make a Subject Access Request (SAR)
Individuals whose data we manage have the right to request access to personal data the school holds about them or their child. You do not need to use special wording – it just needs to be clear what personal data you are requesting. You can use the form below or contact the school office: info@st-james-elstead.surrey.sch.uk
We will usually respond within one calendar month. If your request is complex, we can extend this by up to two further months, but we will let you know and explain why.
We may need to ask for proof of identity to make sure we are giving information to the right person. This might include:
- Photo ID (such as a passport or driving licence)
- Proof of address
- Confirmation of details we already hold about you
If you need help completing a form, please contact the school office or the Data Protection Officer and we will assist you.
5. How to report a data protection, publication or SAR complaint
If you have a concern or complaint about how the school collects and manages personal data, how it publishes information or how it has handled your subject access request (SAR), please contact us using the form below. We will acknowledge your complaint and aim to respond within 30 days. If we need more time, we will let you know.
If you need help completing the form, please contact the school office or our Data Protection Officer and we will assist you.
If your concern remains unresolved after 31 days, contact our Data Protection Officer (DPO), Rachel Dunnage: DPO@godalminglearning.org.uk
If your concern has not been resolved by the DPO after a further calendar month, you can contact the Information Commissioner’s Office (ICO): Make a complaint about how an organisation has used your personal information | ICO
Data protection, publication or SAR Complaint Form
6. Contact the Data Protection Officer (DPO)
Our DPO is independent and available to advise Individuals whose data we manage on data protection matters. You can contact Rachel Dunnage on DPO@godalminglearning.org.uk
7. Information Commissioner’s Office (ICO)
The ICO website has a wealth of information and guidance about data protection: For the public | ICO
You can contact the Information Commissioner’s Office by phone: 0303 123 1113
For more ways to get in touch see: How you can contact us | ICO