Data protection is a shared responsibility, but that does not mean everyone has the same role.
Schools and multi-academy trusts (MATs) need to distinguish who makes decisions, who puts them into practice, who provides independent advice and who checks that arrangements are working.
Clear responsibilities help staff respond consistently to everyday questions and incidents. They also help leaders evidence how decisions were made and whether advice was considered.
This guide explains the main roles and offers a practical framework for connecting board oversight, leadership decisions, Data Protection Officer (DPO) advice and day-to-day responsibilities. Adapt it to your organisation’s structure and scheme of delegation.
Independent schools can use this framework too, adapting responsibilities to their ownership and governance arrangements. They should assess whether they must appoint a DPO under the UK GDPR appointment criteria; where a DPO is appointed voluntarily, the same requirements for independence, resources and avoiding conflicts of interest apply.
Key takeaways
-
The school or trust is normally the controller for the personal data it uses for its own purposes. Establish the responsible legal entity rather than assuming each school site is a separate controller.
-
Governors and trustees provide oversight; leaders make and implement organisational decisions within their delegated authority.
- The Data Protection Officer (DPO) advises and monitors independently. Appointing a DPO does not transfer the organisation’s accountability to that person.
- Staff need clear reporting routes, practical training and access to support.
-
Role descriptions should identify decision-makers, escalation routes and cover arrangements, not simply list job titles.
Who is responsible for what?
The data controller: organisational accountability
The controller determines why and how personal data is processed. The Department for Education’s guidance on responsibilities explains that the school or MAT is the controller for most of the personal data it collects, stores and uses.
For schools within a MAT, the trust is normally the controller, rather than each academy being a separate controller. Maintained schools should confirm their governing body’s responsibilities and any arrangements involving the local authority. Other organisations may be separate controllers for information they receive.
Identify the correct controller in privacy information, relevant agreements and accountability records. Review those arrangements when a school joins a trust or its legal structure changes. The ICO’s accountability and governance guidance provides a useful reference point.
Governors and trustees: oversight and challenge
Boards need enough information to assess whether data protection is being managed effectively. This means asking about risks, outstanding actions, resources and decisions, not simply receiving confirmation that a policy exists.
Useful questions include:
-
What needs leadership attention?
-
Have agreed improvements been completed?
-
Does the DPO have sufficient support and access?
-
What have incidents and information requests shown us?
In a MAT, distinguish the trust board’s responsibilities from those delegated to local governing bodies. Trust-wide reporting should make school-level gaps visible without obscuring the trust’s overall accountability.
GDPRiS’s support for MATs can help leaders bring compliance information together across schools. Reporting tools support oversight; they do not replace board scrutiny or follow-up.
Senior leaders: decisions and implementation
Headteachers, principals and executive leaders put governance arrangements into practice. Their responsibilities should cover decisions about systems, information sharing, staff training and the resources needed to manage data protection.
Within a MAT, make delegated authority explicit. Staff should know which decisions can be made locally and which require trust-level approval or DPO advice.
A practical role description also names who follows up agreed actions. Advice alone does not implement a policy, change a system or resolve an identified risk.
The DPO: independent advice and monitoring
The ICO’s guidance on DPOs explains when appointment is required and what the role involves. Public authorities and bodies must appoint a DPO; other organisations should assess the applicable criteria.
The DPO informs and advises, monitors compliance, advises on Data Protection Impact Assessments (DPIAs), and acts as a contact point for the ICO and individuals. The DPO must be appropriately resourced, operate independently and report directly to the highest management level. This does not necessarily mean being line-managed at that level.
Leadership remains responsible for organisational decisions and implementation. Involve the DPO early, record their advice and document the reasons when a decision departs from it.
One DPO can cover all schools in a MAT, provided the function has sufficient capacity and is accessible. Local data protection leads can help coordinate work without taking over the independent DPO role. An Outsourced DPO Service is one way to access specialist support, but management accountability remains with the school or trust.
Operational staff: everyday handling and reporting
Teachers, administrative teams, IT staff and support colleagues all encounter personal data. Responsibilities should reflect the information each role handles, from attendance records to safeguarding referrals and supplier access.
Staff need to recognise information requests, report suspected incidents promptly and know where to ask for advice. Use realistic scenarios in training: a request for a child’s records, an email sent to the wrong person or a proposed new classroom tool.
Building a culture of data protection awareness means making these processes familiar and usable, not expecting every member of staff to become a specialist.
Building a trust-wide accountability framework
A useful framework connects responsibility with authority, evidence and follow-up. The following is a suggested governance model, not a prescribed organisational chart:
-
Trust board: reviews risks and performance, challenges gaps and checks that leadership follows through.
-
Executive leadership: allocates resources, assigns implementation owners and resolves decisions requiring trust-wide authority.
-
DPO and compliance support: The DPO provides independent advice and monitoring. Compliance support staff coordinate records, reporting and agreed actions, with implementation responsibilities clearly assigned.
-
School leadership and local leads: implement agreed arrangements, maintain local visibility and escalate concerns.
Keep the DPO’s independent reporting route distinct from day-to-day management and coordination arrangements.
Step 1: Map the work and its owners
Use your data audit to identify which teams handle personal data and who makes decisions about it. Include central services, school teams and relevant suppliers.
For each activity, identify the decision-maker, the implementation owner and the people who need to be consulted. Include deputies and absence cover.
Step 2: Make responsibilities specific
Replace vague descriptions such as “supports compliance” with observable tasks. For example:
-
Coordinates the scheduled policy review and records approval.
-
Reports suspected breaches through the agreed incident process without delay.
-
Seeks DPO advice before introducing processing that may require a DPIA.
If you set internal response targets, label them as organisational requirements. Do not present a locally chosen deadline as a statutory timescale.
Step 3: Document escalation and decisions
Record how staff escalate incidents, information requests and proposed changes. Explain who makes the decision, when DPO advice is needed and where the evidence is kept.
Your incident response playbook should connect technical investigation, leadership decisions and data protection advice. Test the reporting route with a realistic scenario so gaps become visible before an incident.
Step 4: Review arrangements as they change
An annual review is a useful starting point, with additional checks when staff leave, schools join or systems and processing activities change. Agree a review schedule that reflects your risks and governance arrangements.
Check that job descriptions, policies, training and actual practice still agree. A named owner in an outdated document provides little practical assurance.
Keeping roles and processes current
Support the DPO without transferring accountability
Give the DPO access to relevant people, information and decisions. Review capacity as the trust grows and consider conflicts of interest before combining responsibilities.
Document who acts on advice and how outstanding actions reach leadership. A regular review cycle helps keep this visible.
Keep an evidence trail
For incidents, subject access requests (SARs) and significant processing decisions, record the facts available, advice received, decision-maker, reasons and follow-up actions. Distinguish confirmed information from assumptions that still need checking.
For SARs, keep a clear record of when the request was received, who is coordinating the response, the applicable deadline, searches undertaken and decisions about disclosure or withholding information. Record any DPO advice and when and how the response was provided.
The purpose is to support sound decisions and demonstrate accountability, not simply to accumulate documents.
Review legislative changes with your DPO
Changes associated with the Data (Use and Access) Act 2025 should prompt a review of relevant processes, including subject access requests, complaints and lawful-basis assessments.
Before changing a procedure, check the applicable provisions and current ICO guidance and confirm how they apply to your school or trust. Do not assume that a change creates a general permission to pause requests or use a particular lawful basis for all safeguarding or cyber security activity.
Assign an owner to update procedures, brief affected staff and record when the change takes effect. The DPO can advise on the implications; leadership should ensure agreed changes are implemented.
Putting accountability into practice
Clear roles work when they are reflected in everyday decisions. Leaders need visibility, staff need accessible processes, and agreed actions need an owner and a review date.
Use role-based training and support to connect responsibilities with the situations staff encounter. Use compliance reporting to track actions between reviews, rather than relying only on an annual audit.
GDPRiS supports schools and trusts with data protection management tools and DPO services. These can help organise information and provide specialist advice, while leaders retain responsibility for decisions and follow-through.
Frequently asked questions
Who is responsible for data protection in a MAT?
The trust is normally the controller for its schools’ processing. Trustees provide oversight, leaders make and implement decisions, and staff carry out their assigned responsibilities. DPO advice supports those roles rather than replacing them.
Does each academy need a separate DPO?
A MAT can appoint one DPO covering its schools. The arrangement must provide sufficient capacity, accessibility and support across the trust.
What should the DPO do during a breach?
The DPO should be involved promptly to advise on data protection risks, reporting obligations and documentation. The incident plan should identify who investigates, who takes operational action and who is authorised to make decisions for the controller.
How often should we review role documentation?
Set a regular review schedule, such as an annual check, and review sooner when people, systems or organisational arrangements change. This is a practical recommendation, not a universal statutory annual deadline for role documentation.
Can a headteacher also be the DPO?
The DPO must avoid conflicts of interest. A headteacher’s decisions about why and how personal data is used are likely to conflict with independently monitoring those decisions. Assess the actual responsibilities and refer to the ICO’s DPO guidance before making an appointment.
Can a school business manager also be the DPO?
Assess the actual responsibilities, not just the title. For example, deciding how payroll or finance data is used could create a conflict with independently monitoring those decisions as DPO. Administrative involvement alone does not automatically rule someone out.
Can an IT manager also be the DPO?
A conflict may arise if they determine how personal data is processed through systems, monitoring or access arrangements. Providing technical support is not automatically incompatible; assess their decision-making authority.
Can an HR lead or designated safeguarding lead also be the DPO?
These roles need careful assessment where they decide how staff or safeguarding information is used or shared. Handling sensitive information alone is not the test: the concern is independently monitoring processing decisions they make.
How should we assess a potential conflict of interest?
Map both roles and identify decisions the person would monitor as DPO. Document the assessment. If conflicting duties cannot be separated effectively, appoint someone else. Training or a different reporting line does not, by itself, remove a conflict.
These school-specific examples apply the principle in the ICO’s DPO guidance: additional duties must not conflict with the DPO’s independent role.
Clear roles, ongoing accountability
Effective data protection is not about giving one person responsibility for everything. It is about making sure each person understands their role, has the support to carry it out and knows when to involve others.
Start with a practical check: can your school or trust show who makes decisions, who provides independent advice and who follows up agreed actions? Where responsibilities overlap, review whether they create a conflict of interest or leave an important task without an owner.
Keep those arrangements under review as your people, systems and trust structure change. Clear ownership, documented decisions and regular oversight give leaders a stronger basis for managing data protection and evidencing accountability.
Need support reviewing your arrangements?
If you need support, speak with the GDPRiS team about your current arrangements and priorities.