Physical security and data protection in a school

What makes a school different

Offices control who enters. Schools cannot, in the same way. Parents come in at the start and end of the day. Contractors work during holidays. Visiting coaches, therapists and tutors move through the building. Pupils are everywhere and are curious by design.

Reception is usually in a corridor that everybody uses, and it is where enrolment forms, medical notes and the day’s messages sit. That is not a failing of the school; it is what the building is for. It is the reason the controls have to be about practice rather than about layout.

The controls to write down

• Access — which rooms are locked, who holds keys and codes, and what happens to that access when a person leaves.
• Visitors — signed in, badged, and accompanied where they will be near personal data. The clause most often missing covers contractors working outside school hours.
• Screens — positioned away from the counter, locked when the desk is left. A reception monitor facing the corridor undoes a lot of other effort.
• Rooms — where meetings about a pupil happen, and whether that room’s door closes and its conversation carries.
• Storage — lockable presses that are kept locked, and child-protection records held separately with a narrower list of people who can reach them.
• Disposal — confidential waste collected under contract or cross-cut shredded, never the recycling bin.
• Keys — a register, and a rule for what happens when one is lost.

Where it belongs

These clauses sit inside the Data Protection Policy, with the day-to-day half in the Clean Desk Policy and the retention half in the Records Management Policy. Keeping them connected matters, because the same incident — a file left out and read by the wrong person — touches all three.

As with every other policy, it is the Board of Management that adopts it, the version in force that counts, and the acknowledgement record that shows staff were told.