Schools & Education GDPR, DPO & Safety Compliance
From the classroom to the staffroom — expert GDPR compliance, external Data Protection Officer services, health and safety audits, fire risk assessments, safeguarding support and INSET day training for primary schools, secondary schools, academies and multi-academy trusts across the UK.
Compliance Services for Schools & Education
Click each service to see how RADCaT supports your school, academy or multi-academy trust.
External DPO Services
Appointment as your school's external Data Protection Officer (DPO) — a legal requirement for all state schools, academies and MATs under Article 37 of UK GDPR. We monitor compliance, advise on DPIAs for new systems (MIS, CCTV, biometrics), manage subject access requests and FOI requests, handle ICO correspondence, deliver staff training and produce annual compliance reports for governors. A cost-effective alternative to an internal appointment with access to specialist expertise.
Explore School DPO ServicesGDPR & Data Protection
Comprehensive UK GDPR compliance for schools covering data audit and mapping, Records of Processing Activities (ROPA), privacy notices for parents, pupils and staff, lawful basis assessment for every processing activity, data sharing agreements with local authorities and third-party providers, cookie compliance for school websites, and data retention schedules aligned with the IRMS retention toolkit for schools.
Explore GDPR ServicesData Breach Response
Schools handle highly sensitive data — pupil records, SEN information, safeguarding logs, medical data, free school meals eligibility, behavioural records and staff HR files. A breach of this data has serious consequences. We help you establish breach detection and response procedures, assess breaches when they occur, prepare ICO notifications within the 72-hour window, notify affected individuals and implement remediation to prevent recurrence.
Explore Breach ResponseSubject Access & FOI Requests
Schools receive increasing numbers of Subject Access Requests (SARs) from parents, former pupils and staff, plus Freedom of Information (FOI) requests from parents, media and the public. We manage the entire process — searching systems, applying exemptions (third-party data, safeguarding, legal privilege), redacting appropriately and ensuring you respond compliantly within the one-month statutory timescale. We also handle right to erasure, rectification and portability requests.
Explore SAR ServicesHealth & Safety for Schools
Schools have the same health and safety obligations as any employer — plus additional duties around pupil safety, playground supervision, educational visits, science lab safety, design and technology workshops, swimming pool compliance and PE equipment. We provide workplace risk assessments, fire risk assessments, legionella assessments, asbestos management reviews, manual handling assessments for caretakers and kitchen staff, and develop bespoke safety policies for your school.
Explore H&S ServicesFire Safety for Schools
Fire risk assessments for school buildings including classrooms, halls, kitchens, science labs, server rooms, storage areas and temporary buildings. We assess fire detection and alarm systems, emergency lighting, escape routes and assembly points, fire door integrity, fire extinguisher provision and evacuation procedures for pupils with SEND or mobility needs. Regular review visits ensure ongoing compliance with the Regulatory Reform (Fire Safety) Order 2005.
Explore Fire SafetyHR & Employment Law for Schools
Schools face unique HR challenges — Burgundy Book and Green Book terms, teacher pay and conditions, performance management frameworks, absence management for teaching staff, safeguarding-related disciplinaries, TUPE for academisation, redundancy consultation for school restructures and managing relationships with unions including NEU, NASUWT and UNISON. We provide practical HR support tailored to the education sector's specific employment framework.
Explore HR ServicesINSET Day & Staff Training
Accredited courses delivered at your school on INSET days or twilight sessions — no supply cover needed.
GDPR Awareness
UK GDPR for school staff. Data handling, consent, breach reporting and individual responsibilities.
Fire Awareness
School fire risks, evacuation procedures, fire marshall duties and PEEP for SEND pupils.
Paediatric First Aid
First aid for children. Choking, asthma, allergic reactions, seizures and playground injuries.
Cybersecurity
Phishing awareness, password security, social engineering and protecting school systems from attack.
Equality & Diversity
Protected characteristics, unconscious bias, inclusive practice and the Equality Act 2010 in education.
Manual Handling
Safe lifting for caretakers, kitchen staff and support workers. MHOR 1992 practical techniques.
Mental Health Awareness
Recognising mental health issues in colleagues and pupils. Signposting, support and wellbeing culture.
H&S for Schools
Risk awareness for school staff. Playground safety, trips, slips, classroom hazards and reporting.
GDPR Awareness
UK GDPR for school staff. Data handling, consent, breach reporting and individual responsibilities.
Fire Awareness
School fire risks, evacuation procedures, fire marshall duties and PEEP for SEND pupils.
Paediatric First Aid
First aid for children. Choking, asthma, allergic reactions, seizures and playground injuries.
Cybersecurity
Phishing awareness, password security, social engineering and protecting school systems from attack.
Equality & Diversity
Protected characteristics, unconscious bias, inclusive practice and the Equality Act 2010 in education.
Manual Handling
Safe lifting for caretakers, kitchen staff and support workers. MHOR 1992 practical techniques.
Mental Health Awareness
Recognising mental health issues in colleagues and pupils. Signposting, support and wellbeing culture.
H&S for Schools
Risk awareness for school staff. Playground safety, trips, slips, classroom hazards and reporting.
A Typical School Compliance Journey
Here's how we support a typical school or academy to achieve and maintain full compliance.
GDPR Compliance Audit
We audit your school's data protection practices — privacy notices, consent mechanisms, data sharing agreements, Records of Processing Activities, retention schedules, website cookies and staff awareness levels.
DPO Appointment & Gap Analysis
We accept formal appointment as your external DPO and produce a prioritised compliance roadmap — addressing critical gaps first, then building toward best practice across all data processing activities.
Policy & Documentation
We draft or update all required policies — data protection policy, privacy notices (parents, pupils, staff, job applicants), CCTV policy, biometrics policy, data retention schedule, breach procedure, SAR procedure and data sharing agreements.
INSET Day Staff Training
GDPR awareness training delivered to all staff on an INSET day or twilight session. Covers data handling responsibilities, recognising and reporting breaches, pupil data sensitivity, parental requests and individual accountability.
Health & Safety Review
Full health and safety audit of school premises — fire risk assessment, legionella risk assessment, asbestos register review, playground safety, manual handling for site staff, educational visits policy and first aid provision.
Ongoing DPO & Compliance
Year-round DPO support — SAR and FOI handling, DPIA advice for new systems, breach response, ICO liaison, legislative updates, annual compliance report for governors and scheduled review visits throughout the academic year.
Schools & Education Compliance FAQ
Does my school legally need a Data Protection Officer?
Yes. Under Article 37 of UK GDPR, all public authorities — including maintained schools, academies and free schools — must appoint a DPO. Multi-academy trusts can appoint a single DPO across all their schools. The DPO can be internal or external. RADCaT provides external DPO services that are significantly more cost-effective than an internal appointment and give you access to specialist data protection expertise year-round.
How do you handle subject access requests for schools?
We manage the entire SAR process on your behalf. This includes logging the request, verifying identity, searching all relevant systems (MIS, email, CPOMS, paper records), applying exemptions (third-party data, safeguarding, legal privilege, exam scripts), redacting appropriately, compiling the response and ensuring it's issued within the one-month statutory deadline. We also handle FOI requests, right to erasure and rectification requests.
Can you deliver GDPR training on an INSET day?
Absolutely. We deliver GDPR and data protection awareness training on INSET days, twilight sessions or during staff meetings. Sessions are tailored specifically to school staff — covering pupil data handling, parental consent, photography and social media, breach recognition and reporting, and individual staff responsibilities. No supply cover needed. We bring all materials and every attendee receives documentation of their training for your records.
What happens if our school has a data breach?
Common school breaches include misdirected emails containing pupil data, lost USB drives, unauthorised access to MIS systems, and parental information disclosed to the wrong parent in separated families. If a breach occurs, you must assess it within 72 hours and, if it poses a risk to individuals, report it to the ICO. As your DPO, RADCaT guides you through the entire process — assessment, ICO notification, parent notification if required, and remediation measures.
Do you support multi-academy trusts?
Yes. We provide DPO and compliance services for multi-academy trusts, acting as the single DPO across all schools in the trust. We coordinate consistent data protection policies, manage cross-trust DPIAs, provide centralised SAR handling, deliver trust-wide staff training, produce board-level compliance reporting and ensure each school meets the same compliance standards regardless of size or phase. MAT packages offer significant savings over individual school appointments.
What health and safety does my school need?
Schools need general workplace risk assessments, fire risk assessments (reviewed annually), legionella risk assessments for water systems, asbestos management surveys (for pre-2000 buildings), manual handling assessments for caretakers and kitchen staff, educational visits policy and risk assessments, PE equipment inspections and first aid provision. RADCaT carries out a full H&S audit and produces all required documentation.
How much do school DPO services cost?
External DPO costs for schools depend on the school's size, phase, number of pupils and complexity of data processing. Single-school packages start from competitive annual rates that are typically a fraction of the cost of an internal DPO appointment. MAT packages offer per-school rates that reduce further with scale. All packages include DPO appointment, compliance monitoring, SAR handling, staff training, breach support and annual governor reports. Contact us for a tailored quote.
Ready to Make Your Workplace Safer?
Get in touch for a free, no-obligation site visit. We'll audit your school's compliance, identify gaps and recommend practical solutions.