Data and its protection
We take the management and protection of information and personal data seriously. This page explains how we manage the collection, storage and security of data to comply with the Freedom of Information Act 2000, Environmental Information Regulations 2004, UK GDPR and Data Protection Act 2018 and the Data (Use and Access) Act 2025 and to keep information safe and secure.
1. Information and data protection policies & documents
We manage information and data according to the policies and documents below:
- Freedom of Information Publication scheme – what information we publish or hold.
- Data Protection policy – how the school meets its legal duties.
- Special Category Data policy.
- Information Management/Security policy – keeping data safe.
- Records Retention schedule – how long data is kept.
- Acceptable Use policy (staff & pupils).
2. Privacy notices
We collect personal information from parents, pupils, staff & volunteers so that we:
- provide children with an education.
- keep everyone safe.
- communicate effectively.
- fulfil our legal obligations as a public body.
We provide more details on the data we collect in our Privacy Notices. we have different privacy notices for:
- Pupils
- Parents/Carers
- Staff
- Governors
3. Your rights
Individuals whose data we manage have the right to:
- access their data (Subject Access Request).
- request corrections.
- ask for deletion (where applicable).
- object to processing.
- complain about how we have managed their data.
Parents also have the right to see their child’s educational record.
Everyone has the right to ask broader questions about the data the school manages under the Freedom of Information Act (FOI) and Environmental Information Regulations (EIR). You can find out what we already publish by looking through our Publication Scheme.
4. How to make a Subject Access Request (SAR)
Individuals whose data we manage have the right to request access to personal data the school holds about them or their child. You do not need to use special wording – it just needs to be clear what personal data you are requesting. You can use the form below or contact the school office: info@st-james-elstead.surrey.sch.uk
We will usually respond within one calendar month. If your request is complex, we can extend this by up to two further months, but we will let you know and explain why.
We may need to ask for proof of identity to make sure we are giving information to the right person. This might include:
- Photo ID (such as a passport or driving licence)
- Proof of address
- Confirmation of details we already hold about you
If you need help completing a form, please contact the school office or the Data Protection Officer and we will assist you.
5. How to make a Freedom of Information (FOI) or Environmental Information Regulation (EIR) request
If you have a question about the general data the school manages that is not already published, contact the school office on info@st-james-elstead.surrey.sch.uk.
Requests made under the FOI Act must be made in writing. Requests made under the EIR may be verbal or in writing.
We will usually respond within 20 working days. If your request is complex, we can extend this, but we will let you know and explain why.
6. How to report a data protection, publication or SAR complaint
If you have a concern or complaint about how the school collects and manages personal data, how it publishes information or how it has handled your subject access request (SAR), please contact us using the form below. We will acknowledge your complaint and aim to respond in full within 30 calendar days for general data protection or SARs complaints and within 20 working days for FOI and EIR complaints.
If we need more time, we will let you know.
If you need help completing the form, please contact the school office or our Data Protection Officer and we will assist you.
If your concern remains unresolved after 31 days for general data protection or SARs and after 21 school days for FOI and EIR complaints., contact our Data Protection Officer (DPO) Rachel Dunnage: DPO@godalminglearning.org.uk
If your concern has not been resolved by our DPO after a further calendar month, you can contact the Information Commissioner’s Office (ICO): Make a complaint about how an organisation has used your personal information | ICO
Data use and access requests Complaint Form
7. Contact the Data Protection Officer (DPO)
Our DPO is independent and available to advise Individuals whose data we manage on data protection matters. You can contact Rachel Dunnage on DPO@godalminglearning.org.uk
8. Information Commissioner’s Office (ICO)
The ICO website has a wealth of information and guidance about data protection: For the public | ICO
You can contact the Information Commissioner’s Office by phone: 0303 123 1113
For more ways to get in touch see: How you can contact us | ICO