In accordance with the Data Protection Act 2018 and the General Data Protection Regulation individuals have the right to be informed about how the school uses any personal data that we hold about them. This privacy notice explains how we collect, store and use personal data about individuals at the school.


Under Data Protection legislation, the school is its own data controller.

Contact details below:

Llantarnam Community Primary School

James Prosser Way



NP44 3XB


Head teacher:

Laura Perrett


Llantarnam Community Primary School Privacy Notice


Have we sourced your personal data, directly from you?

Data is collected from a variety of sources to make sure that we can help you in your education and look after you at school.  For the same reasons, we get information about you from other places too, and these include but are not restricted to the following:

  • Social Care

  • Families First

  • School Health

  • Torfaen County Borough Council Departments

  • Other schools 

What information does the School collect about you?

The School collects and processes a range of information about you. 

This includes but is not restricted to:

● Personal identifiers and contacts (such as name, gender, date of birth, next of kin, unique pupil number, contact details, e-mail address and home address, school photograph, transport details)

  • Characteristics (such as ethnicity, religion, language, free school meal eligibility and immigration status)

● Safeguarding information (such as court orders, looked after children, young carers and professional involvement)

● Details of any support received, including care packages, plans and support providers (including needs and ranking)

● Medical and administration details (such as doctors information, child health, allergies, medication and dietary requirements)

● Attendance (such as sessions attended, number of absences, absence reasons and any previous schools attended)

● Performance in internal and national assessments and examinations

● Behavioural information (such as exclusions and any relevant alternative provision put in place)

● Photographs and CCTV images captured in school

● School History

The School may collect this information in a variety of ways: 

Verbally, electronically, via paper systems, 3rd parties


We will store your data:

Electronically and paper based in secure lockable locations or password protected if in electronic format.


Why does the School process your personal data?

We process personal information about pupils and their families:

  • For identification purposes

  • To support pupil learning

  • To monitor and report on pupil progress

  • To provide appropriate pastoral care

  • To assess the quality of our services

  • To keep children safe (food allergies, or emergency contact details)

  • To meet the statutory duties placed upon us for Welsh Government data collections

  • To comply with the law and legal obligations and the law regarding data sharing

  • To administer trips and activities, catering and free school meal management

  • To protect student welfare and wellbeing

  • To contact pupils and parents when we need to

  • To carry out research, planning, checking and improving services

Pupil data is essential for the schools’ operational use.  Whilst the majority of pupil information you provide is mandatory, some of it is requested on a voluntary basis.  When this is the case you will have the option to withdraw consent if you choose.


We can process this category of data because:  

We only collect and use pupils personal data when the law allow us to.  Our legal basis for processing personal data under Article 6 (1) of the GDPR is:

  • We need to comply with a legal obligation: and is contained within the Education Act 1996 and associated Welsh Government regulations

  • We need it to perform an official task in the public interest (in order to provide you with an education).


Less commonly, we may also process students’ personal data in situations where:

  • We have obtained consent from you or your parents to use it in a certain way: and 

  • We need to protect the individual’s vital interests (or someone else’s interest).  

Where we have obtained consent to use students personal data, this consent can be withdrawn at any time and we will make this clear how it can be withdrawn.  

Data Protection legislation provides extra protection for certain classes of information under Article 9 called ‘special category’ personal data, which includes:

• Physical or mental health or condition• Politics• Racial or ethnic origin• Religion or other beliefs of a similar nature• Sex life• Sexual orientation• Biometrics (where used for identification purposes)


The lawful basis for collecting and processing information under Article 9 of the GDPR is:

  • The data subject has given explicit consent

  • It is necessary to fulfil the obligation of the controller or of the data subject 

  • It is necessary to protect the vital interests of the data subject 

  • It is in the public interest


Who has access to your data?

We do not share information about pupils with any third party without consent unless the law and our policies allow us to do so. Where it is legally required, or necessary (and it complies with data protection law) we share personal information about students with such bodies as


Department for Education on a statutory basis. As outlined within the Education Act 1996 and associated Welsh Government regulations.

Welsh Government - The Welsh Government receives information on pupils directly from schools normally as part of statutory data.  In addition to the data collected as part of PLASC, the Welsh Government and Local Authorities also receives information regarding National Curriculum assessments, public examination results, and attendance data at individual pupil level which comes from Schools and /or Awarding Bodies (e.g. WJEC).    

The Welsh Government uses this personal information for research (carried out in a way that ensures individual children and young people cannot be identified) and for statistical purposes, to inform, influence and improve education policy and to monitor the performance of the education service as a whole. Examples of the sort of statistics produced can be viewed at

Welsh Government School Workforce Annual Census and PLASC returns

Pupils family and representatives 

Internally with schools departments 

Torfaen Council Departments including professional advisers and consultants including Social Care, Families First, Legal and Insurance, internal auditors

Other Educational establishments and examining bodies


Coleg Gwent

Education Achievement Service (EAS)


Welsh / English Government Health Services

Health Authority for Health Care Programmes

Police Services, Ambulance Services, Courts 

Careers Wales/ Youth Support Services once pupils reach the age of 13 under section 507B of the Education Act 1996.

Careers Wales/ Youth Support Services once pupils reach the age of 16 under section 507B of the Education Act 1996

John Muir Project

Photography Companies

NRS Cashless Catering - biometerics (where used for identification purposes only) not all schools


How does the School protect data?

The school takes the security of your data seriously.  The school have, and are developing further, internal policies to ensure the data it processes is not lost, accidentally destroyed, misused or disclosed and is not accessed except by its employees in the performance of their duties.  Data that we keep about pupils while attending our school will be stored in student files, in the schools management system and in other IT systems.  It is stored securely if in paper form or if electronically will be password protected.  

Where the school engages third parties to process personal data on its behalf, they do so on the basis of written instructions. These third parties are also under a duty of confidentiality and are obliged to implement appropriate measures to ensure the security of data.


How long does the School keep your data?

The school will hold your personal data only for the period that is necessary and will follow organisational and Local Authority standards in this area.

We will keep your information in line with the school retention schedules.

Your rights

Parents and pupils have rights regarding personal data. Individuals have a right to make a “subject access request” to gain access to personal information the school holds about them. The law allows that by the age of 13 children have sufficient maturity to understand their rights and to make an individual right request themselves if they wish.  A parent would be expected to make a request on a child’s behalf if the child is younger. You can also request an “education record request” which will give you all information processed on behalf of the governing body of the school.  If you would like to request either of these please contact the Head teacher.  

The Data Protection Act 2018 and GDPR laws give individuals additional rights in respect of personal information held on yourself.  These rights include: 

The right to be informed

The right of access

The right to rectification

The right to erasure - in certain circumstances.  Whilst the child is in school, there may be data that you would not erase if requested as this could hamper your ability to perform your public task

The right to restrict processing

The right to data portability

The right to object 

Rights in relation to automated decision making and profiling.

If you would like to exercise any of these rights, please contact the Head teacher in writing who will respond within one calendar month. 

You may also contact the Information Commissioner (ICO), however, the ICO (Wales) cannot make a decision unless you have exhausted the complaints/internal review procedure offered by the Council.  Please do not hesitate to contact, Head Teacher