A parent’s data complaint can cross the whole school: the June change independent leaders need to understand

01

A complaint rarely arrives in the language of the legislation

A family may question a photograph, a fee email sent to the wrong person or information shared between a boarding house and an external service. The message may reach a teacher or receptionist before anyone describes it as a data-protection complaint. That is the operating problem independent schools need to recognise: a right cannot be exercised effectively if the school’s first contact point cannot identify it.12

The relevant June development is specific. The Data (Use and Access) Act’s complaint provisions came into force on 19 June 2026. The ICO’s announcement on 23 June explained that organisations handling personal data must provide a clear complaint route, acknowledge complaints within 30 days and take appropriate action without undue delay. This is a UK data-protection development, rather than an academy-only instruction.12

02

The important connection is from receipt to responsibility

A policy can name the right person while leaving several practical gaps. Who notices a complaint sent to an admissions inbox? Who covers an absence? Can the recipient recognise that a concern about accuracy, disclosure or access may require a data response as well as a pastoral or contractual one? These questions concern implementation, not whether the school possesses a suitable policy file.

Consider a hypothetical case: a parent challenges information in a residential record and says it was shared inappropriately. The school may need the house team’s account of the facts, the data lead’s assessment of the processing and a careful pastoral response. Treating the concern exclusively as a boarding matter could miss the information right. Passing it immediately to a generic data mailbox could miss an urgent safeguarding issue.

03

Thirty days is not a waiting period

The ICO’s detailed guidance distinguishes acknowledgement from investigation. It says the obligation to investigate begins on receipt, and schools must arrange acknowledgement cover during holidays or staff absence. The 30-day acknowledgement requirement does not authorise a school to leave a concern untouched until that point. Nor should it be confused with the response rules for a subject access request.3

Our assessment is that a useful internal record should connect the date received, the nature of the concern, the person coordinating it, the evidence requested, communications with the individual and the eventual outcome. Its purpose is to preserve continuity when several teams are involved. It should also make visible a concern that appears resolved locally but has revealed a wider weakness, such as repeated inaccurate exports from one system.3

04

The child’s rights need a separate judgement

A school also needs to avoid assuming that the person paying fees automatically exercises every information right for the pupil. ICO guidance distinguishes a pupil’s UK GDPR access right from a parent’s educational-record right, and explains that the latter differs by nation and school type. Authority to act and the child’s competence and interests require consideration in the actual circumstances.4

This is particularly consequential in a residential setting, where a pupil may disclose information to different adults for different purposes. School Connection is not suggesting that staff withhold information by default. The point is that a fee relationship, a parental contact entry and authority to exercise a child’s data rights answer different questions. A sound response identifies which right is being exercised before deciding what can be disclosed.4

05

An external system does not make the concern external to the school

Admissions platforms, parent applications and outsourced administration can complicate an investigation. ICO guidance requires an appropriate written contract where a controller uses a processor, with responsibilities set out between the parties. A school therefore needs a workable route to obtain relevant information and assistance from the provider; a supplier’s helpdesk is not a substitute for deciding who is coordinating the school’s response.5

A practical review can follow one real processing activity from collection to use, sharing, correction and deletion. Which organisation holds each record? Which version is authoritative? Can a correction made in one place leave an inaccurate copy elsewhere? Those questions connect digital governance with the everyday experience of pupils, families and staff. They can also reveal why a superficially simple complaint takes time to investigate fairly.5

06

Use the outcome to improve the operating model

A proportionate governing-board view should focus on whether the process works: concerns recognised, responses coordinated, delays understood and recurring causes addressed. Raw complaint counts are ambiguous. More complaints may reflect a clearer route and greater confidence in raising concerns; fewer may reflect either improvement or difficulty finding a route. Neither number alone establishes the quality of the school’s practice.

The June change is therefore an opportunity to examine the handover between reception, admissions, house teams, finance, IT and school leadership. Its value comes from a reliable response when a real concern arrives. The continued test is whether the school learns from the issue and can explain what changed, while protecting the personal information involved.

Leadership questions

Questions that turn the development into a governing conversation.

What we are monitoring next

Publication is the beginning of the watch.

• Follow regulator clarification and evidence of how schools implement holiday cover, coordination and complaint outcomes.
• A material legal update or evidence that concerns are being lost between school teams would change the assessment.

Continue the evidence trail

Read across the historical record

• When school systems fail, the first question is what pupils and staff can still do ↗

The continuing record

How the record develops

• The MIS decision that lasts beyond the demonstration: can the school leave with usable records? ↗

  Moves from responding to a data concern to testing whether contractual data access and migration support the school’s ability to act.

• Pupil images carry the school’s promise beyond the prospectus ↗

  Follows the route of a concern into the actual images and communications a school needs to identify and review.