CEFM provides guidance and model documentation to help schools establish practical confidentiality and data-protection procedures that staff can understand and apply consistently.
A confidentiality policy in schools explains how confidential and personal information should be collected, used, stored, accessed and shared. It sets expectations for employees, governors, volunteers and contractors, and helps them understand when information must remain private and when it may need to be disclosed.
The policy should work alongside the school’s data-protection, safeguarding, records-management and information-security procedures. It should also make clear that confidentiality is not absolute: information may need to be shared where there is a legal duty, a safeguarding concern or another lawful basis for disclosure.
School staff need to understand when confidential information can be shared and who is authorised to receive it. A disclosure procedure should help staff to:
Staff should follow the school’s agreed reporting route and seek advice from the designated safeguarding lead, data protection lead or another authorised person when they are unsure.
A school confidentiality policy should normally cover:
A well-implemented confidentiality policy helps a school to:
The policy should be supported by secure systems, staff training and clear reporting arrangements. A written policy alone cannot prevent a breach if everyday practice does not follow it.
Confidentiality forms part of a school’s wider approach to data protection. Under the Data Protection Act 2018 and UK GDPR, schools must handle personal information lawfully, fairly, securely and transparently. They should also collect only the information they need, retain it for an appropriate period and enable people to exercise their information rights.
Related policies and procedures may cover privacy notices, records retention, subject access requests, information security, data breaches, safeguarding records and the use of third-party systems. Responsibilities should be clearly allocated and staff should know how to report a concern or suspected breach promptly.
Schools should review these arrangements when legal requirements, guidance, technology or working practices change.
The same core data-protection and safeguarding duties apply across primary and secondary education, but the information handled and the situations staff encounter can differ. Primary schools may work particularly closely with parents and carers, while secondary schools may handle a wider range of pupil communications, pastoral records, online systems and requests involving older pupils.
In every setting, the policy should explain how information about pupils and families is protected, how staff respond to safeguarding concerns and when information can be shared without consent. Training should reflect the school’s actual systems, reporting routes and day-to-day risks rather than relying on the policy document alone.
Confidentiality Policy Support from CEFM
CEFM provides model policies, guidance and consultancy support for schools reviewing their confidentiality and data-protection arrangements. Our team can help you consider responsibilities, disclosure procedures, staff awareness and the relationship between confidentiality, safeguarding and data protection.
Contact CEFM to discuss the policy and management support available to your school or academy trust.
A confidentiality policy explains how a school collects, uses, stores, accesses and shares confidential or personal information. It sets responsibilities for staff, governors, volunteers and contractors and explains when information must remain private or may need to be disclosed.
Confidentiality protects the privacy, dignity and safety of pupils, families and staff. It also helps schools meet data-protection and safeguarding duties, make accountable disclosure decisions and maintain trust within the school community.
A school may share confidential information where there is an appropriate lawful basis, where consent is valid and suitable, or where safeguarding or another legal duty requires disclosure. Only necessary information should be shared with authorised recipients, using secure methods.
No. The two areas overlap, but a data protection policy covers the school’s wider responsibilities for processing personal data. A confidentiality policy focuses on protecting sensitive information and deciding when it may be accessed or disclosed.
One of the most comprehensive online resources available for school managers. Over 7,000 pages of downloadable model policies, templates, forms and guidance.
Get access to our documents and the next three editions of CEFMinform.