GDPR readiness checklist

You maintain an up-to-date record of what personal data you hold and why.

You know where sensitive categories (health, biometric, child protection) are stored.

Your record of processing activities is reviewed at least once a year.

You document the lawful basis for each category of personal data.

Consent is freely given, specific and easy to withdraw where it is the basis used.

Staff can explain the difference between consent and legitimate interests.

You have written retention schedules for pupil, staff and governor records.

Out-of-date records are securely deleted or anonymised on schedule.

Leavers' data is removed or archived according to your policy.

You have a clear SAR process with a one-month response target.

Staff know how to recognise and escalate a SAR.

You log exemptions and redactions consistently.

You have a written personal-data breach procedure.

All breaches are logged and assessed for ICO reporting.

Staff know how to report a suspected breach within 24 hours.

New staff receive GDPR and data-protection training as part of induction.

All staff have had refresher training in the last 12 months.

You can evidence who has been trained and when.

You have written contracts or data-processing agreements with every third-party processor.

You review processor security before signing or renewing.

You know which processors transfer data outside the UK.

You have documented any data transfers outside the UK.

Appropriate safeguards are in place where required.

You review transfer mechanisms when services or contracts change.