Privacy notice for a tutor or school

A tutor or a school processes children's data, which the law protects more carefully than adults', on behalf of parents who contract and pupils who are the subjects, with safeguarding records that outlast the pupil's time there and sharing with schools, exam boards and local authorities that the law requires or permits. The privacy notice has to be written for parents and, where the pupils are old enough, for pupils, state the right bases (which for teaching and safeguarding are not consent), deal with health, special educational needs and safeguarding data, address photographs and the online platforms lessons run on, and explain the sharing. The pack (privacy notice, cookie notice and consent guidance) is drafted for the business for £595, fixed, in five working days.

Who this is for

Private tutors, tuition centres, online tutoring businesses, independent schools and education providers in England and Wales that are not maintained schools (whose notices follow the public task basis and the Department for Education's templates).

What matters in a tutor or school privacy notice

Pupils, parents and the two notices one organisation may need

Under Article 13 of the UK GDPR the business, being the controller, has to tell the people whose data it holds what it does with it, and in education that is the parents who contract (their contact, financial and family data) and the pupils who are taught (their learning, assessment, behaviour, health and safeguarding data, which is the child's even when the parent supplies it); the notice should be written in two layers or two documents (one for parents, one in language a pupil can understand where the pupils are of an age to read it), and should say who exercises the child's rights (the child with sufficient understanding, otherwise the parent) and what a parent may and may not see of a child's record.

Children's data and the age at which consent is theirs

Consent is the wrong basis for most of what a tutor or school does, but where it is used (photographs, marketing, optional activities) the notice should say whose consent is needed: under section 9 of the Data Protection Act 2018 a child may consent to an information society service from thirteen, and for other purposes a child with sufficient maturity may consent in their own right, with the provider assessing it; the Information Commissioner's age appropriate design code under section 123 of that Act applies to online services children are likely to use (a tutoring platform, a learning app), with its standards on defaults, profiling and language, and the notice should be drafted to the code where the service is online.

The lawful basis for teaching, assessment and safeguarding

For a private provider the lawful basis for teaching, assessing and reporting is the contract with the parent under Article 6(1)(b) of the UK GDPR and legitimate interests under Article 6(1)(f) for the pupil's education and the provider's operation, with legal obligation under Article 6(1)(c) for safeguarding, attendance and the duties the Education Act 1996 and the independent school standards place on schools, and the notice should state each rather than rely on consent, which a parent cannot withdraw without the provider ceasing to teach; a maintained school uses the public task basis instead, and the notice should be clear which kind of provider it is.

Special category data, health and the records that last for decades

Health conditions, allergies, special educational needs, disability, safeguarding concerns and (where recorded) religion and ethnicity are special category data under Article 9 of the UK GDPR, processed under the conditions in Schedule 1 to the Data Protection Act 2018 (safeguarding of children, substantial public interest, health care purposes, equality of opportunity) with the appropriate policy document the Act requires, and the notice should state which; safeguarding records are retained for decades under the guidance the Department for Education and the Independent Inquiry into Child Sexual Abuse have produced, and the notice should say so and limit the right to erasure accordingly, because a school that deletes a safeguarding file on request has destroyed evidence.

Photographs, platforms and the tools that teach online

Photographs and video of pupils for the website, social media, prospectuses or lesson recordings are personal data and often need consent (the parent's or the pupil's), which the notice and the consent form should handle, with the pupil's right to object as they grow; online lesson platforms, learning management systems, homework apps, safeguarding software and communication tools are processors under Article 28 with agreements the provider should hold, and the notice should describe them, the data each holds, any international transfers under Article 46, and the tracking in them, which needs consent under regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 where it is not strictly necessary.

Sharing with schools, exam boards and the authorities

The notice should explain the sharing the provider carries out: with the pupil's school (progress reports, with the parent's agreement for a tutor), with exam boards and awarding bodies for entries and results, with the local authority and the Department for Education where the law requires (safeguarding, attendance, census returns for schools), with the Disclosure and Barring Service for staff checks, with other parents only with consent, and with the provider's processors; it should also cover the individual's rights (access, rectification, erasure, restriction, portability, objection), how to exercise them, the one-month time limit, and the right to complain to the Information Commissioner's Office, and the business's registration with the Information Commissioner's Office, under the Data Protection (Charges and Information) Regulations 2018, belongs in the notice.

What it costs

Website privacy and cookies pack, £595. Privacy notice, cookie notice and consent guidance. Five working days.

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Buying online forms the engagement on payment. The scope is what the data protection agreements and privacy terms page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

Do we need separate notices for parents and pupils?

Two layers or two documents: one for parents and one in language pupils can understand where they are old enough to read it. The child's record is the child's, and the notice says who exercises the rights.

Can a parent demand we delete their child's safeguarding record?

A parent cannot. Safeguarding records are kept for decades under the guidance, and the notice explains the retention and the limit on erasure.

Do we need consent to teach a child?

Consent is not the basis: the contract with the parent, legitimate interests and legal obligation cover teaching, assessment and safeguarding. Consent is for photographs, marketing and optional activities, and the notice says whose consent that is.

Related guidance and services

• Data protection agreements and privacy terms, £595, the service this page describes
• Terms and conditions drafting, £995
• SaaS and technology contracts, £995
• Terms and conditions for a tutoring agency
• Privacy notice for a nursery or childcare business

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.