General Data Protection Regulation

The General Data Protection Regulations (2016) and The Data Protection Act (2018)

This section of the website contains a number of forms for downloading, filling in, and returning to the school, along with information and guidance related to the forms.

The privacy notices tell you what information we keep.  This could be data about students, parents/carers, staff, volunteers and members of the Management Committee (our version of a Board of Governors).  By reading the privacy notice(s) which is/are relevant to you, you will have a clearer understanding of how we collect information and what we do with it.

There are several legal categories that organisations must use to justify collecting data.  Because we are a school, the vast majority of data that we collect comes under the “Public Interest” category.  This is because it is in the public interest that our young people are educated, and all schools rely on this category for collecting most of their students’ data.  By and large, any educational activity that would normally be expected of an Alternative Provision will fall into the Public Interest category.  Basic data that is collected about parents/carers, such as emergency contact numbers, name, address, etc., is reasonable information to lawfully collect.

Generally, then, we are not required by law to obtain written consent for any information that we hold about students or parents/carers, unless it falls outside the reasons outlined about.  However, there are some areas of information that we would need specific permission for, if we wanted to use the data in that way.  The most obvious is the use of images.  If a photo is taken to prove that a student can escape from a kayak, or has made a bird table, for example, consent is not needed.  However, should we want to put those images on a display board in the school or on the school’s website, we would have to seek consent as these do not count as part of our core activity of education.

Everyone who is connected with the school is entitled to know what information the school holds about them.  The Subject Access Request forms are your way to obtain this information.  You can either download the form and print it out yourself, or contact the school office and they will provide you with the relevant form.   As the law currently stands, students who are 12 years or under have to have a Request made for them by a parent/carer.  From the age of 13, the government judges that students are old  enough to make their own request.  (This may change when the 2018 Data Protection Act goes through Parliament.)

When filling in the Subject Access Request forms, please read the guidance.  This is likely to shorten the time needed for us to prepare the information that you have requested.

Every school has to have a Data Protection Officer.  Maidstone and Malling Alternative Provision’s DPO is Mr Robert Monk.  The DPO is the first person to approach with any queries or requests about these regulations.


Below are a list of Policies about GDPR. 

Consent Forms

Below is a list of all Consent Forms which are compliant with GDPR.

Privacy Notices

Below is a list of all Privacy Notices which are compliant with GDPR. 

Subject Access Requests

Below is a list of all Subject Access Requests which are compliant with GDPR.