Data Protection

Data Protection

Thamesmead School is committed to data protection and supports the data protection rights of all those with whom it works, including, but not limited to staff, students, governors and visitors. Our Data Protection Policy sets out the accountability and responsibilities of the school, its staff and its students to comply fully with the provisions of the Data Protection Act 2018 and UK General Data Protection Regulation (UK GDPR). This legalisation has been modified by the Data (Use and Access) Act 2025.

The School has appointed a Data Protection Officer (DPO) to monitor and advise on compliance with the UK GDPR and the Data Protection Act 2018. Information can be obtained from the DPO who can be contacted via dpo@thamesmead.surrey.sch.uk.

Data Subject Rights

The Data Protection Act 2018 contains data subject rights the School must comply with – the rights to information, subject access, to rectification, to object, to erasure, to portability, to restrict processing and in relation to automated decision-making and profiling. These rights can be restricted for personal data used in research.

Subject Access Requests and the right to data portability
Individuals have the right to request to see or receive copies of any information the School holds about them, and in certain circumstances to have that data provided in a structured, commonly used and machine readable format so it can be forwarded to another data controller. The School will respond to these requests within one calendar month.

Where possible, subject access requests should be submitted in writing, either using the attached Subject Access Request (SAR), by letter or email to the DPO. dpo@thamesmead.surrey.sch.uk

Subject Access Request

Those not submitting a request using the form should try to include:

  • Name of Individual
  • Relationship to the school
  • Correspondence address
  • Contact number and email address
  • Details of the information requested

Data protection complaint

The new Data (Use and Access) Act 2025 provides a route for individuals to complain if they believe Thamesmead haven’t correctly followed data legislation in the way they handled your personal information (or the personal information of someone you’re acting on behalf of).

For example, a pupil or parent could complain about:

  • The way you’ve responded to their subject access request (SAR)
  • The security measures you’ve used to protect their information
  • How you’ve collected or used their personal information

Please use the school’s complaints procedure or contact dpo@thamesmead.surrey.sch.uk to make a data protection compliant.