UK GDPR FOR SCHOOLS
Data protection,
you can rely on.
Practical, inspection-ready UK GDPR compliance for schools, academies, and trusts — delivered by a senior privacy professional with local authority DPO service experience.
QUALIFIED
CIPP/E · CIPM
SECTOR
Education
COVERAGE
UK-wide
CIPP/E CERTIFIELD
.
CIPM QUALIFIELD
.
ICO REGISTERED
.
LOCAL AUTHORITY DPO EXPERIENCE
.
OFSTED-READY DOCUMENTATION
.
SCHOOLS-SPECIFIC UK GDPR
.
SAFEGUARDING-ALIGNED COMPLIANCE
.
CIPP/E CERTIFIELD . CIPM QUALIFIELD . ICO REGISTERED . LOCAL AUTHORITY DPO EXPERIENCE . OFSTED-READY DOCUMENTATION . SCHOOLS-SPECIFIC UK GDPR . SAFEGUARDING-ALIGNED COMPLIANCE .
BUILT FOR YOUR ROLE
Who this is for
Data protection sits differently depending on your role in school. We've designed our offer around how compliance actually lands in practice.
LEADERSHIP
Headteachers & SLT
You are accountable for data protection governance. Our packs give you defensible documentation and an inspection-ready evidence trail — without taking up your time or requiring specialist knowledge to implement.
SAFEGUARDING
DSLs & Data Leads
Safeguarding and data protection overlap constantly. Our KCSIE mapping, DSAR procedures, and breach response tools are built to work alongside your safeguarding processes — not in tension with them.
GOVERNANCE & OPERATIONS
SBMs & Trust Leads
Managing suppliers, processors, and contracts? Our Enhanced and Premium packs include lawful basis matrices, DPIA trigger tools, and governance sign-off pages designed for your accountability structure.
FRAMEWORKS, & GOVERNANCE TOOLS
Prime Data Compliance provides school-ready data protection frameworks, tools and implementation support so schools can move from scattered paperwork to a clearer, evidence-ready compliance position.
Inspection-ready, fully editable Word documents tailored to schools. Each level builds on the one before it. Choose the level of support your school needs.
*A licence to implement Prime Data Compliance’s proprietary documents within your school or trust.
Ready-to-deploy GDPR Governance Frameworks for Schools
Foundation Governance Framework
£1,495
Single school licence · One-off
For schools that know their data protection policies, privacy information, registers and review records need updating, but do not have the time to build everything from scratch.
The Foundation Governance Framework gives your school a clear, school-ready compliance baseline that leaders and governors can recognise, review and use.
The Foundation Governance Framework
includes 25 documents
Governance Layer
GL1 · Master Data Protection Governance Framework
GL2 · Governance Approval and Review Register
GL3 · Annual Compliance Review Checklist
GL4 · Governance Evidence Index
GL5 · Governor Assurance Summary
GL6 · Leadership Executive Summary
Accountability Layer
AL1 · Article 30 School Processing Register
AL2 · Processing Activity Inventory Worksheet
AL3 · DfE-Aligned Records Retention Framework
AL4 · School Information Asset Register
Privacy Layer
PL1 · Workforce Privacy Information
PL2 · Governor and Trustee Privacy Information
PL3 · Recruitment Privacy Information
PL4 · Primary Pupil Privacy Notice
PL5 · Secondary Pupil Privacy Notice
PL6 · Special School Privacy Notice
Operational Layer
OL1 · Staff Data Handling Handbook
OL2 · Subject Access Request Management Framework
OL3 · Personal Data Breach Response Framework
Safeguarding Layer
SL1 · KCSIE and Data Protection Mapping Guide
SL2 · Safeguarding Information Sharing Guidance
SL3 · Child Protection Records Handling Guidance
Assurance Layer
AS1 · School Compliance Health Check
AS2 · Governance Maturity Assessment
AS3 · First 90-Day Compliance Action Plan
Best for schools that need to:
put core GDPR governance paperwork in place quickly
update policies, notices, registers and review records
evidence a structured approach to data protection
give leaders and governors clearer assurance
move from scattered documents to an organised compliance baseline
Licence Options and Pricing
MAT Schools and Trusts
Up to 5 schools £5,995 + VAT
6–10 schools £9,995 + VAT
Larger MATs: Bespoke quote
MOST POPULAR
Operational Governance System
£2995
Single school licence · One-off
Step up from core governance to a working compliance system.
The Operational Compliance System is the step-up offer for schools that need more than the Foundation Governance Framework.
It includes the 25 Foundation Governance Framework documents, plus 20 additional operational documents that help the school manage day-to-day compliance in practice.
The Operational Compliance System includes 45 documents in total
25 Foundation Governance Framework documents
20 additional Operational Compliance System documents
The Operational Compliance System includes every document in the Foundation Governance Framework PLUS:
Additional operational documents included
Rights Management Layer
RL1 · Data Subject Rights Management Framework
RL2 · Rights Request Register
RL3 · Rights Decision Matrix
Incident Management Layer
IL1 · Incident Response Operating System
IL2 · Breach Investigation Toolkit
IL3 · Incident Governance Reporting Tools
DPIA and Risk Layer
DL1 · DPIA Toolkit and Decision Framework
DL2 · School Lawful Basis Matrix
DL3 · Privacy Risk Assessment Toolkit
Processor Governance Layer
PG1 · Article 28 Processor Governance Framework
PG2 · Supplier and Processor Governance Register
PG3 · Processor Due Diligence Toolkit
Sharing Governance Layer
SG1 · Data Sharing Governance Framework
SG2 · Safeguarding Information Governance Operating Guide
SG3 · Designated Safeguarding Lead Compliance Resources
Implementation Layer
IM1 · Compliance Implementation Manual
IM2 · Operational Compliance Review Checklist
IM3 · Operational Compliance Dashboard
IM4 · Staff Training and Awareness Resources
IM5 · Governor and Trustee Assurance Briefing
Best for schools that need to:
move beyond policies into practical procedures
give staff clearer steps for rights requests and data incidents
manage DPIAs, suppliers, data sharing and safeguarding information more consistently
evidence day-to-day compliance decisions
give governors a clearer view of operational compliance
Licence Options and Pricing
MAT Schools and Trusts
Up to 5 schools £10,995 + VAT
6–10 schools £18,995 + VAT
Larger MATs: Bespoke quote
Assured Governance Implementation
£5,495
Single school licence · One-off
Expert support to implement the Operational Compliance System.
Assured Governance Implementation is the supported implementation offer.
It includes the full Operational Compliance System and adds implementation support to help your school tailor, prioritise and evidence the work.
Assured Governance Implementation includes
All 45 documents:
the 25 Foundation Governance Framework documents
the 20 additional Operational Compliance System documents
Plus implementation support
Initial compliance review
Gap analysis and priority risk review
Document tailoring support
ROPA and accountability support
Privacy information review
Implementation planning
Leadership briefing
Governor or trustee assurance briefing
Compliance health check
Prioritised action plan
Implementation review call
Assurance summary
Best for schools that need to:
get expert help to implement the framework
identify gaps and priorities quickly
tailor the documents to their setting
support leaders, governors or trustees with assurance
move from paperwork to practical implementation
Licence Options and Pricing
MAT Schools and Trusts:
Up to 5 schools £17,995 + VAT
6–10 schools from £29,995 + VAT
Larger MATs: Bespoke quote
Licence options and pricing
Choose the licence that matches your school or trust structure.
A single-school licence is for one named school only.
Trust licences allow the framework to be adopted across the named schools within one academy trust or school group.
Licence guide
Licence type applies to: Single school licence: For use by one named school only
Trust licence up to 5 schools: For small trusts or school groups wanting a shared framework across named schools
Trust licence 6–10 schools: For medium trusts needing a consistent approach across several schools
Larger MATs: Bespoke pricing based on number of schools, structure, complexity and implementation needs
Important note
Assured Governance Implementation includes trust-level implementation support, central governance alignment and roll-out guidance. School-by-school tailoring, additional workshops or extended implementation support can be added separately.
All framework materials remain the intellectual property of Prime Data Compliance. Purchase provides a limited, non-transferable licence for the named organisation’s internal use, subject to the applicable licence terms.
ADVISORY RETAINERS
Ongoing support services
Compliance is not a one-time event. Our retainer services keep your school's data protection live, governed, and responsive throughout the year.
Essentials
£350 / month
1 HOUR / MONTH · RESPONSE WITHIN 2 WORKING DAYS
Confidence on demand. Q&A, template guidance, and light document reviews by email with one short advisory call per month if needed. Includes a 30-minute onboarding call to understand your current position. Rolling monthly — no minimum term. Unused time does not roll over.
Active
£750 / month
3 HOURS / MONTH · RESPONSE WITHIN 1 WORKING DAY
Compliance kept live. Covers supplier and processor reviews, DPIA input, full data subject rights guidance (including SAR, erasure, and objection), and breach support. Includes a monthly governance check-in call with a written summary of actions and upcoming deadlines. Quarterly compliance status report for governors. 3-month minimum term.
Assured
£1,250 / month
5 HOURS / MONTH · PRIORITY RESPONSE WITHIN 4 HOURS
Full oversight and named adviser contact. Includes everything in Active, plus: a rolling evidence review against your inspection index, annual staff data protection training session (in person or virtual), a formal annual compliance report for governors, and priority response within 4 working hours for urgent matters. ICO enquiry support included. 3-month minimum term.
PDC
Calissa Palmer
Founder, Prime Data Compliance
CIPM
CIPP/E
"Most schools don't have a data protection problem. They have a clarity problem."
Prime Data Compliance was built on real experience inside schools and local authority DPO services. We understand what headteachers, DSLs, and SBMs are actually dealing with: limited time, competing safeguarding pressures, and guidance that was written for lawyers — not practitioners.
Our approach is direct. We produce documentation that staff can actually follow, workflows that sit alongside safeguarding rather than complicating it, and evidence that stands up to Ofsted, ICO, and governance scrutiny.
QUALIFICATIONS
CIPP/E (Certified Information Privacy Professional, Europe)
CIPM (Certified Information Privacy Manager)
SECTOR EXPERIENCE
Local authority schools DPO service
In-school operations & governance
Public, private & third sector
COMPANY
Registered in England & Wales
Company No. 16440019
DATA RIGHTS
For parents & carers
Under UK GDPR, your child's school holds personal information about your family. You have rights over how that information is used — and schools are legally required to respect them.
01
The right to know
Schools must tell you what personal data they hold about you and your child, why they hold it, who they share it with, and how long they keep it. This information should be in the school's privacy notice.
02
The right to access
You can submit a Subject Access Request (SAR) to ask for a copy of personal data the school holds about your child. The school must respond within one month. There is no charge for most requests.
03
The right to complain
If you are not satisfied with how a school has handled your data, you can raise a complaint with the school's Data Protection Officer, then escalate to the ICO (Information Commissioner's Office) at ico.org.uk.