Education privacy notice

This privacy notice explains how Portsmouth City Council (“the Council”, “we”, “us”) collects and uses personal information about children and young people for education‑related functions and services, including work we do with and for schools, early years providers and childcare providers.

This notice should be read alongside the Council’s corporate privacy notice, which explains how we handle personal information across the organisation.

• Data Controller: Portsmouth City Council (Registration Number Z5578313)
• Address: Civic Offices, Portsmouth, PO1 2AL
• Data Protection Officer (DPO) Email: DataProtection@portsmouthcc.gov.uk
• Telephone: 023 9282 2251

If you have questions about this notice, or want to exercise your rights, contact the DPO using the details above.

This notice applies to personal information we process about:

• Children and young people living in or receiving education‑related services connected to Portsmouth, and
• Parents/carers/guardians where their information is included in education records or communications (for example, contact details).

The categories of information we process may include:

• Personal identifiers and contact details (for example name, address, contact details, Unique Pupil Number)
• Characteristics (for example ethnicity, language, Free School Meal eligibility)
• Safeguarding information (for example court orders and professional involvement)
• Special educational needs and disability (SEND) information
• Attendance (for example sessions attended, absences and reasons, previous schools attended)
• Assessment and attainment (for example key stage results, post‑16 courses and outcomes)
• Behavioural information (for example exclusions and alternative provision arrangements)

This list is not exhaustive. To request the current list of categories we process, contact the DPO.

Special category data

Some education functions require us to process special category data (for example health/SEND/safeguarding‑related information). We only do this where the law allows and with appropriate safeguards.

We collect information through secure methods including:

• secure file transfer systems between schools, local authorities and partners (including Common Transfer Files (CTFs) and spreadsheets)
• online or paper application and data collection forms

Mandatory vs voluntary information

Most of the information we process is required for the Council to carry out education functions and statutory responsibilities. Some information may be requested on a voluntary basis. We will explain at the point of collection whether information is required and what happens if it is not provided.

We use children and young people’s information to:

• carry out education functions we are responsible for
• deliver and manage services for and on behalf of children, young people, parents, schools and stakeholders
• plan, monitor and improve services, and produce statistics (including school funding and performance monitoring)
• set targets and assess performance of services and schools
• investigate complaints and concerns about services we deliver

UK GDPR lawful bases (Article 6)

Depending on the specific education activity, we rely on one or more of the following:

• Article 6(1)(c) – Legal obligation (where we must process information to meet legal duties)
• Article 6(1)(e) – Public task (where processing is necessary to perform our official functions)
• Article 6(1)(a) – Consent (where we ask for consent for a specific optional purpose)

Special category data conditions (Article 9)

Where we process special category information, we rely on a lawful condition such as:

• Article 9(2)(a) – Explicit consent (where this applies)
• Article 9(2)(g) – Substantial public interest (with appropriate safeguards)

Department for Education (DfE) statutory collections

We also process and share information to meet obligations placed on us by the Department for Education (DfE) for statutory data collections, including under The Education (Information About Individual Pupils) (England) Regulations 2013.

We may share children and young people’s information where the law allows, and to deliver education services effectively. We routinely share pupil information with recipients such as:

• youth support services (for pupils aged 13+)
• the Department for Education (DfE)
• post‑16 education and training providers / other local authorities
• Solent NHS Trust and Children’s Public Health partners
• Portsmouth‑based secondary schools and relevant education partners
• National Consortium for Examination Results (NCER)
• third‑party system suppliers that provide education systems on our behalf

We do not share information without consent unless the law and our policies allow us to do so.

Youth support services (age 13+)

From age 13, we share limited information (name, address, date of birth) with youth support services to help them carry out responsibilities for 13–19 year olds under section 507B of the Education Act 1996. Where a parent/guardian consents, additional relevant information may be shared; this right transfers to the young person at age 16.

Health and public health programmes

Information may be shared with NHS partners to support delivery of child public health programmes (for example school nursing and the National Child Measurement Programme). The notice describes legal powers used for some health sharing (including S251b – Health and Social Care (Safety and Quality) Act 2015).

BeeWell wellbeing project (where a school participates)

For schools participating in BeeWell, the Council shares specified pupil data items (including Unique Pupil Number, name, SEND and Free School Meal eligibility) with the University of Manchester under the BeeWell Data Sharing Agreement.

Library cards (Reception year)

We share information with the Library Service to enable Reception year pupils to be issued with a library card.

Looked after children attendance support

For Portsmouth looked after children placed in or outside Portsmouth, the notice describes sharing with a commissioned service (Welfare Call Ltd) to monitor daily attendance and support completion of personal education plans.

We keep personal information no longer than necessary and in line with our retention requirements.

The education notice includes a specific retention statement for BeeWell processing: identifying personal information may be retained until data linkage opportunities have been completed — “until the end of 2029 based on current external dependencies.”

For broader retention information, see the Council’s corporate retention schedule.

We store information on secure systems and premises with controls such as:

• staff training in information security and data protection
• controlled access to systems, networks and premises
• regular testing and patching of technology

Where we use third‑party suppliers to process information on our behalf, we require appropriate contractual and security safeguards.

Under data protection law, parents and pupils have rights including:

• to request access to personal information we hold
• to have inaccurate data corrected
• to request deletion where there is no compelling reason to continue processing
• to restrict processing
• to object to certain types of processing (including direct marketing and some research/statistics)
• rights relating to solely automated decision‑making
• to withdraw consent (where processing is based on consent)

To make a request or raise a concern, contact the DPO:

• Email: DataProtection@portsmouthcc.gov.uk
• Phone: 023 9282 2251

If you have a complaint or query about how we collect and use personal information, if you would like a change to be made to your record, or want to object to processing, please contact us using the details below.

If you are not satisfied with our response, you can complain to the Information Commissioner’s Office (ICO):

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate)

The education notice explains that data shared with the DfE supports school funding, monitoring, accountability and longer‑term research, and links to DfE information about the National Pupil Database and data sharing.

This privacy notice was last updated in February 2024. It may be updated to reflect changes in law or service delivery.