Principles and Lawful Basis

Principles relating to the processing of personal data are:

i) processed lawfully, fairly and in a transparent manner

ii) collected for specified, explicit and legitimate purposes

iii) adequate, relevant and limited to what is necessary

iv) accurate and, where necessary, kept up to date

v) kept for no longer than is necessary

vi) processed in a manner that ensures appropriate security of the personal data.

The GDPR also establishes Accountability as a core data processing principle. This places a statutory responsibility on the school, as Data Controller, to be able to demonstrate compliance with the other principles set out above.