We keep the School Services and Admissions Privacy Notice under review. It was last reviewed and updated in June 2023.
If you have any questions about this Privacy Notice contact the council’s Data Protection Officer.
View the privacy and transparency information for all of the City of York Council (CYC).
- collecting personal data
- our legal basis for using personal data
- sharing personal data
- retaining personal data
- further processing of personal data
- your rights relating to personal data
Collecting personal data
We will collect your personal data via:
- applications made by parent or carers, online or otherwise
- Common Transfer Files (CTFs)
- secure file transfers from schools or other public sector bodies
The amount and type of personal data we collect from you or others about you, will depend on why and how you are contacting or interacting with us. It will include:
- names
- contact details such as addresses, email addresses, phone numbers
- personal identifiers such as dates of birth (DOB), National Insurance Number (NINO)
- characteristics such as ethnicity, language
- safeguarding information such as court orders and professional involvement
- special educational needs, including the needs and ranking
- attendance such as sessions attended, number of absences, absence reasons and any previous schools attended
- behavioural information such as exclusions and any relevant alternative provision placements put in place
We use your personal data to:
- provide you with our services for example, to enable us to carry out the school admissions service for which we are responsible; free school meal eligibility checking; respond to general education queries
- allocating school places
- processing school applications
- derive statistics for reports and to inform decisions such as the funding of schools and planning of school places
- assess performance and to set targets
Our legal basis for using personal data
Any personal data including special category data that we process about individuals using our services is done so in accordance with Article 6 and 9 of the UK GDPR and Schedule 1 of the Data Protection Ac 2018 (DPA 2018).
The legal basis for processing your personal data is in accordance with the following:
- Article 6(1)(c) so we can comply with our legal and statutory duties
- Article 6(1)(e) for the performance of our public task
Where the information we process is special category data, for example health data, the additional bases for processing that we rely on are:
- Article 9(2)(a) your explicit consent
- Article 9(2)(b) which relates to carrying out our legal obligations
- Article 9(2)(g) – where processing is necessary for reasons of substantial public interest
Some of the Schedule 1 conditions for processing special category data require an Appropriate Policy Document (APD) to be in place, that sets out and explains the procedures for securing compliance with the principles in Article 5 and policies regarding the retention and erasure of such personal data. This document explains this processing and satisfies the requirements of Schedule 1, Part 4 of the DPA 2018 and supplements this privacy notice. You can find this at Our Appropriate Policy Document.
Sharing personal data
To deliver our services, we will need to share your personal data with:
- other City of York council services
- youth support services (pupils aged 13+)
- other government departments such as Department for Education (DfE); Department of Work and Pensions DWP)
- other local authorities
- schools, academies and other providers of education
- external providers of our commissioned services
- professionals from health, social care and Early Help teams
- Families Information Service
- our Business Intelligence Unit
- auditing services
- approved home to school transport providers
We will not pass on your personal data to any third parties for marketing, sales or any other commercial purposes without your prior explicit consent.
We may also use the information we collect from you for reporting, research and statistical purposes. When we do this, it will be anonymised which means the information will be turned into a form that cannot be linked back to you and does not identify individuals.
Sharing data under Data Protection legislation
We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent, for example if we have a legal obligation to do so, such as for:
- law enforcement
- fraud investigations
- regulation and licensing
- criminal prosecutions
- court proceedings
- safeguarding
We must protect public funds and may use personal data and data-matching techniques to detect and prevent fraud, collect taxes and ensure public money is targeted and spent in the most appropriate and cost-effective way. To do this, your personal data may be shared with other bodies responsible for auditing or administering public funds, including the Department for Work and Pensions, HM Revenue and Customs, the Police and other local authorities.
Retaining personal data
We will only keep your personal data for as long as we need it and we will securely and confidentially delete and destroy it when we no longer have a need for it.
At the end of the retention period, we may pass any relevant information to the City Archives where it is required or appropriate to do so.
Further processing of personal data
If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.
The new notice will:
- explain this new use before we start the processing
- set out the relevant purposes and processing conditions
Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.
Your rights relating to personal data
When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.
To find out about your rights under data protection law, you can go to the Information Commissioners Office (ICO).
You can also find information about your rights.
If you have any questions about this privacy notice, want to exercise your rights, or if you have a complaint about how your information has been used, please contact us.
See further details of your rights relating to personal data.
Also see
- Our Data Protection Policy Statement
- Website terms and disclaimer
- Accessibility statement
- Cookies policy
- Copyright statement