GDPR awareness training for school staff

What school staff need to know

Not the regulation. A teacher does not need to recite the six lawful bases; they need to recognise the handful of moments in a school week where personal data is at stake.

• Which attachment is going to which list, and the pause before sending to a group.
• What may and may not be said about a child in a corridor, a staff room or a WhatsApp group.
• That a parent asking "what do you hold about my child" has started a formal clock, and who to forward it to that day.
• What never goes into a general-purpose AI tool.
• What to do in the first hour of a suspected breach, and who to tell — including that telling someone quickly is the expected behaviour, not an admission.
• Why the clean desk and removable media rules exist, which is the difference between following them and working around them.

Why a generic course does not land

A course built for a corporate office talks about customers, clients and commercial contracts. The examples do not match, so staff complete it, learn that data protection is a thing that happens to other industries, and carry on.

A school course can use the situations that arise: the class list that went to the wrong parent group, the SNA asked about a child by another parent at the gate, the laptop in the car, the shared email account in the office.

The completion record is the point

Training that happened but cannot be evidenced does very little when the school is asked what measures it had in place. The record that counts is per person, per course, per date — not "we ran a session in September".

That matters most for the people a staff-meeting briefing misses: part-time staff, SNAs on a different timetable, substitutes, the caretaker, and anyone who joined in October. Those are the people a spreadsheet loses.

It also connects to the policies. A member of staff who has acknowledged the Data Protection Policy and completed the training is a documented position. One of the two on its own is half an answer.