School leaders and governors aren’t expected to know the answer to every question, and we know there’s plenty of question on your mind. That’s why, through a subscription to TheSchoolBus, you have access to our question and answer service, where our dedicated research team are on hand to answer any questions you have.

Our research team conduct extensive research to find you the answer you need – we’ll read through any relevant guidance or legislation, liaise with our sector specialists and contact other organisations, such as the DfE, ICO and HSE, to make sure we have all the necessary information to answer your questions.

To showcase the wonderful work our research editors do, we decided to give away the answer to our most popular question of the week!


 Tuesday 19 June

Q: How many pupils can a teaching assistant (TA) supervise alone in a before or after-school club?

To answer this query, we contacted the DfE who stated that it is entirely at the discretion of headteacher to decide whether a TA is capable of supervising a specified number of pupils – there are no limits on pupil to TA ratios.1

Headteachers should conduct a risk assessment to establish a TA’s capabilities when deciding upon the number of pupils that will be in their care. (DfE, personal communication) In addition, headteachers should consider the following factors when determining the appropriate ratio:

  • The activities that the pupils will be doing – some activities, e.g. sports, may require more supervision due to the higher risk of injury
  • Any arrangements that are needed for specific pupils – some pupils may require further assistance for an activity due to a specific need, e.g. a medical condition
  • The ages of the pupils – e.g. if there is a mix of ages and the pupils are participating in a sporting activity, more supervision may be required

Headteachers should consider the safety of the pupils in attendance and decide whether the risks require the ratios to be amended. This may mean that the ratios could vary depending on the activity the pupils are participating in, as well as the pupils who are in attendance. (DfE, personal communication)

1 DfE (2018) (Telephone conversation regarding a TA supervising pupils in a school club) [Personal communication: 13 June 2018]


Related terms: assistant, clubs, running a club, organising, leading. 


Tuesday 12 June

Q: Can schools share safeguarding information without consent?

In order to share information lawfully without consent, schools first need to identify the lawful basis for sharing the data – one of the lawful bases is consent, but consent will not be required if schools can justify another lawful basis for sharing the data. More information on the lawful bases and when they may be used can be found in our guidance here. For further clarification, we have spoken directly with the ICO who advised that schools will need to ensure they can satisfy a lawful basis, or determine whether the information can be shared under an exemption or requirement under another law – which will mean consent would not be required.1

The sharing of safeguarding data is included within our Child Protection and Safeguarding Policy 2018; section 28 (and specifically point 28.6) references how safeguarding data may be shared without consent: “Where it is in the public interest, and protects pupils from harm, information can be lawfully shared without the victim’s consent, e.g. if doing so would assist the prevention, detection or prosecution of a serious crime.” – i.e. a lawful basis, exemption or other requirement in law is satisfied.

The DfE’s ‘Data protection: a toolkit for schools’ (2018), also states that “GDPR does not prevent, or limit, the sharing of information for the purposes of keeping children safe”, and that information can be shared “without consent if to gain consent would place a child at risk”.2

When sharing safeguarding information, schools will also need to establish whether a data sharing agreement should be in place to set the provisions under which data will be shared – depending on who the information is shared with, the organisation/individual will either be a data controller or data processor and a data sharing agreement may be required. More information on controllers and processors can be found here – an example data sharing agreement can be accessed from the Related Content section of this article.

Finally, the ICO advised that schools will also need to outline their intention to share safeguarding information in their privacy notices – our resource pack contains various privacy notices which may be of use. (ICO, personal communication)

To conclude, if schools are able to satisfy a lawful basis other than consent, an exemption or requirement under another law, safeguarding information can be shared without consent – schools’ justification as to how they meet these must be clear.


1 ICO (2018) (Online conversation regarding sharing safeguarding data) [Personal communication: 29 May 2018]

2 DfE (2018) ‘Data protection: a toolkit for schools’, p.21


Related article: sharing data, processing agreement, sharing agreement, consent, lawful basis, lawful bases, GDPR


Tuesday 5 June


After speaking with the DfE, we can advise that schools are able to decide how they use their pupil premium funding allocation. If a school believes that the best use of this funding would be for free school meals (FSM), they will be able to do so.

However, schools should be aware that they must prepare evidence for inspectors with regards to the use of their pupil premium funding. When reviewing the usage of this, inspectors will gather evidence about the effectiveness of pupil premium funding in schools in relation to

  • The level of pupil premium funding received by the school in the current, and previous, academic year(s).
  • How leaders and governors have spent the pupil premium, their reasons for this spending and its intended impact.
  • How the use of the funding has impacted on disadvantaged pupils’ learning and progress, detailed by outcome data and inspection evidence.1

If Ofsted recognise the need for improvement in the provision of pupil premium funding, they will recommend an external review of the school’s usage, with specific regard given to the improvement of outcomes and progress for disadvantaged pupils. (Ofsted, p.46)

Whilst the usage of pupil premium funding is up to schools to decide, they must be prepared to justify their reasons for their spending and how it impacts on the learning and progress of disadvantaged pupils.

1Ofsted (2018) ‘School inspection handbook’, p.45, para.158


Tuesday 29 May

Q. What are the statutory requirements for school reports sent to parents at the end of the Summer term?

The DfE outlines that schools must send a written report to parents pertaining to their child’s performance in school; the reports need to be sent at the end of the Summer term, and at the end of each KS – there are no statutory requirements to send a report in other years in the KS.1

The table below shows what must be included in a school report for the end of KS1 to KS4.


Statutory information

Year 2 (end of KS1)

Year 6 (end of KS2)

Years 7, 8 and 9 (KS3)

Years 10 and 11 (KS4)

General progress





Notes of achievement, including strengths and weaknesses





How to arrange a discussion about the report with a teacher





Attendance record





The grade achieved at GCSE





Any other qualifications






The DfE advises that this information is the minimum requirement for schools, and that, if they so choose, they can include additional, non-statutory, information they wish to report on to parents. (DfE, para.4)

Schools should report on the compulsory national curriculum subjects at the end of each Summer term.2 A full list of compulsory national curriculum subjects can be found for each key stage, here. Schools can utilise our Annual Reports Resource Pack to ensure they are prepared for the end of an academic year.

1 DfE (2014) ‘School reports on pupil performance: guide for headteachers’, para.1 [Accessed: 09 May 2018]

2 (2013) ‘The national curriculum’, ‘overview’ para.5 <> [Accessed: 09 May 2018]


 Monday 22 May

Q: How do you make CCTV signs GDPR compliant?


The ICO confirm that for schools to ensure their CCTV in operation signs are GDPR compliant, they should:

  • Ensure signage is clear and visible, e.g. outdoor signs are not covered by overhanging branches.
  • Ensure signage is an appropriate size, e.g. if the CCTV is located near a drop off point it needs to be big enough for driver to see it from inside a car.
  • Ensure, if it captures images outside the school site, signs are clearly displayed for pedestrians.
  • Ensure staff know who to talk to if they get asked about the images captured on CCTV.1

Furthermore, when creating CCTV in operation signs, the wording used must include:

  • The details of the organisation operating the system.
  • The purpose of its use, e.g. crime prevention.
  • Who to contact if individuals have any enquires pertaining to the images being captured by the CCTV, e.g. the data protection officer (DPO) or headteacher.2

Schools can learn how to operate CCTV within their school, in compliance with the GDPR, by accessing our Surveillance and CCTV Policy in the related content section, below.

1 IFSEC Global (2017) ‘Watch: CCTV signage – How to avoid GDPR penalties’ para.6 <> [Accessed: 17 May 2018]

2 ICO (2018) (Email conversation regarding GDPR compliant CCTV signage) [Personal communication: 17 May 2018]

Monday 14 May

Q. How long can data be retained for?

Firstly, to comply with the GDPR, schools must have a lawful basis for seeking and holding data, these are the following:

  • Consent
  • Contract
  • Legal obligation
  • Vital interest
  • Public task
  • Legitimate interests 1

Schools should determine which of the above is the most appropriate justification for seeking, processing and storing data. To read more on lawful basis, click here.

In terms of retention, as per Article 5 of the GDPR, personal data should not be kept for longer than it is necessary for the purposes for which the data was originally obtained.2 In other words, once the data has been obtained, it should only be retained until its purpose has been fulfilled.

A Records Management Policy should be in place and should establish the retention periods that types of data will have. Please find our template Records Management Policy as a related article. When establishing the retention periods of data, you must be able to justify why it is kept for the specified length of time, and in line with any local arrangements.  

To be GDPR compliant, schools must justify seeking and processing the data with one of the lawful bases and retain the data in line with the above.

To effectively keep track of archived files, please see our Archived Files Log in the related articles bar which allows schools to log their archived files by providing space for them to enter the date the data was created and its retention period, then the tracker will work out the disposal date for you.

Related terms: General data protection regulation, kept, holding, retaining, information. 

2 ICO (2016) ‘Principles’, para. 7 <> [Accessed: 1 May 2018]


Tuesday 8 May

Q.Who needs safer recruitment training and how often does it need to be renewed?

In accordance with Regulation 9 of The School Staffing (England) Regulations 2009 (as amended), at least one member of the recruitment panel must have completed safer recruitment training.1

It is important for schools to be aware that, depending on which provider this training was undertaken with, the validity length can vary by certificate.

Therefore, the governance experts GovernorLine advise that whilst the majority of safer recruitment training certificates are open ended, it is good practice to ensure that this training is renewed at least every five years.2

1 The School Staffing (England) Regulations 2009, regulation 9 (a)

2 GovernorLine (2016) (Telephone conversation regarding renewal dates of safer recruitment training) [Personal communication: 30 September 2016]

Monday 30 April

Q. Can the PE and sports premium for primary schools be used for mental wellbeing?

We spoke to one of our experts who stated that using some of the PE and sports premium for mental wellbeing is allowed; however, schools must have good justification for spending the premium on mental health provision. Additionally, it must represent the link into the healthy lifestyles aspect of the curriculum; for example, raising the self-esteem of pupils with weight issues may increase their confidence to participate in sporting activities.1

Our expert also advised that any spending on mental wellbeing should only represent a small percentage of the total PE and sports premium spending. (Masterson, personal communication)

The DfE and the ESFA provide some examples as to how the premium can be used, they are as follows:

  • Provide staff with professional development, mentoring, training and resources to help them teach PE and sport more effectively
  • Hire qualified sports coaches to work with teachers to enhance or extend current opportunities
  • Introduce new sports, dance or other activities to encourage more pupils to take up sport and physical activities
  • Support and involve the least active children by providing targeted activities, and running or extending school sports and holiday clubs
  • Enter or run more sport competitions
  • Partner with other schools to run sports activities and clubs
  • Increase pupils’ participation in the School Games
  • Encourage pupils to take on leadership or volunteer roles that support sport and physical activity within the school
  • Provide additional swimming provision targeted to pupils not able to meet the swimming requirements of the national curriculum
  • Embed physical activity into the school day through active travel to and from school, active playgrounds and active teaching 2

The DfE and ESFA also state how the premium should not be used, including:

  • To employ coaches or specialist teachers to cover planning, preparation and assessment arrangements – these should come out of your core staffing budgets.
  • To teach the minimum requirements of the national curriculum – including those specified for swimming (or, in the case of academies and free schools, to teach your existing PE curriculum). (DfE and ESFA, section 4)

According to the DfE and ESFA, when using the PE and sports premium, there are five key indicators that schools should expect to see improvement across:

  • The engagement of all pupils in regular physical activity - the Chief Medical Officer guidelines recommend that all children and young people aged 5 to 18 engage in at least 60 minutes of physical activity a day, of which 30 minutes should be in school.
  • The profile of PE and sport is raised across the school as a tool for whole-school improvement.
  • Increased confidence, knowledge and skills of all staff in teaching PE and sport.
  • Broader experience of a range of sports and activities offered to all pupils.
  • Increased participation in competitive sport. (DfE and ESFA, section 4)

1 Masterson, E., (2018) (Email communication about the spending requirements of the PE and sports premium) [Personal communication: 05 February 2018]

2 DfE and ESFA, (2017) ‘PE and sport premium for primary schools, section 4 ‘How to use the PE and sport premium’, <> [Accessed: 05 February 2018]

Monday 16 April

 Inspecting a policy

Q: In an MAT, should the board of trustees ratify each school’s safeguarding and SEND policies, or can this be delegated to the local governing board (LGB) of the respective schools?

In accordance with the DfE’s ‘Multi-academy trusts’ guidance, the board of trustees will be held accountable for non-compliance and it is responsible for ensuring schools within the trust are compliant with statutory requirements. The document also specifies that the MAT’s board of trustees has the authority to “delegate governance functions to LGBs or other committees including to oversee one or more individual academy.”1 Unfortunately, after calling for clarification, the DfE couldn’t provide any further guidance regarding policies that could be ratified at governing board level. 

To overcome this, we referred to our governance experts who confirmed that it is good practice for the board of trustees of an MAT to ratify each school’s safeguarding and SEND policies and allow each academy to amend their policies to ‘reflect local circumstances, including the academy’s specific LA’.2

Furthermore, the responsibility for the strategic oversight of safeguarding sits with trustees/ directors of the trust. That being said, trusts can consider delegating some of that responsibility to its LGBs to ensure that individual academy policies pertaining to safeguarding and child protection complies with the requirements, and practices, of the Local Safeguarding Children Board which, of course, is a function owned by the LA. There should be no bar to safeguarding or child protection issues being dealt with immediately and effectively. 3

Overall, it would be considered good practice for the MAT to ratify any policies pertaining to safeguarding and SEND, yet policies should be amended at LGB level to enable individual academies to account for their LAs safeguarding and SEND protocols.  

1 DfE, (2016) ‘Multi-academy trusts’ p.21

2 Wadley, N., (2018) (Email conversation regarding ratifying policies at trust level) [Personal communication: 12 April 2018]

3 Hodsman, S., (2018) (Email conversation regarding ratifying policies at trust level) [Personal communication: 12 April 2018]

Monday 9 April

 Q. How do you decide whether legitimate interest is the most suitable lawful basis for processing data?

On the whole, legitimate interest is the most commonly used lawful basis but it will not always be applicable.1

To judge whether you can use legitimate interest for processing data, such as using pupils’ photographs as part of the school’s management information system, you should carry out three different tests, these are:

  • Purpose test – establishing why you want to use the data, what will be achieved and whether the benefits are justifiable.
  • Necessity test – establishing whether the processing of the pupils’ data will be useful and whether there is a less intrusive way of reaching a means to an end.
  • Balance test – establishing the impact it will have on the data subject by processing the data for said reason.

These three tests make up a ‘legitimate interest assessment’ (LIA) – you should carry out a LIA prior to obtaining the data and it should be recorded in a physical copy so that you are compliant with the GDPR.

A LIA is designed so that you can judge whether processing data in the ways you are suggesting is necessary and expected from the data subjects. The LIA is designed so that the data processors (the school) consider the impact the processing would have on the individual's own rights and freedoms.2

2 ICO (2018) (Email conversation regarding lawful basis for processing personal data) [Personal communication: 06 April 2018]

Monday 2 April

Q. Is a separate privacy notice required for governors?


We spoke directly with the DfE, who confirmed that governors are considered to be part of the school workforce and are therefore covered by this privacy notice - a separate privacy notice for governors is not required.1


1 DfE (2018) (Telephone conversation regarding privacy notices for governors) [Personal communication: 21 March 2018]



Monday 19 March

Q. What should our office staff prepare for before Ofsted inspections?

1. Preparing office staff for Ofsted

In addition to all aspects of their prescribed role, office staff should be up-to-date on the school’s attendance and absence data, punctuality and lateness, and the visitor’s procedure aspects of the school’s Safeguarding Policy.

2. Greeting inspectors

Inspectors must be treated in-line with your visitor’s procedure. For this reason, greet them with warmth and, as with any other visitor, ask to see their photo ID, sign in the visitor’s book, and ask them to read/take note of whatever safeguarding arrangements the school has in place for visitors.

3. What might inspectors ask office staff to do during inspection?

  • More often than not, it is the office manager who will have the single central record and so they may be asked to produce it.
  • During the inspection the inspector might ask office staff (or the headteacher) directly about their arrangements for checking visitors.
  • The office staff (or headteacher) might be asked to print off the parent view results during the second day.
  • The office staff (or headteacher) might be asked about present attendance, past attendance, arrangements for following up absences, attendance of different pupil groups, punctuality and lateness. 

4. Sources of further reading

The most important documents for any section 5 inspection are “The Inspection Handbook”, “The Framework for School Inspections” and “Inspecting Safeguarding in Maintained Schools”.

Monday 12 March

Q. Who can be a school's data protection officer (DPO)?

The role of data protection officer (DPO) can be undertaken by any individual either internally, for example by a staff member or governor, or externally, such as by a third party data specialist; however, the GDPR requires the appointed person to have professional experience and knowledge of data protection law.1

Whilst the GDPR does not specify any particular qualifications a DPO should have, when appointing someone to the role, it is important to ensure that the proposed person has knowledge proportionate to the type of processing the school carries out, as well as an understanding of the school’s IT, technical and organisational infrastructure. (ICO, 2016)

It should be noted that, when appointing the role internally, it must be ensured that the individual’s duties as DPO do not lead to a conflict of interest within their other role. For example, where a governor is appointed as DPO they should not be given any other responsibilities.2

To help you further understand the role of the DPO and appoint an appropriate person, explore our Role of the Data Protection Officer guidance.

2 Data Protection Education (2017) ‘The GDPR and Your School - The Data Protection Officer’, <> [Accessed: 7 March 2018]


Monday 5 March

Q. Under the GDPR, how often do privacy notices need to be signed?

To answer this question we reviewed the ICO’s Consent webpage, which states you should “keep consents under review and refresh them if anything changes”1; therefore, privacy notices need only be signed once.

Consent will need to be sought in the event the reasons for processing change and consent isn’t specific to the new processing purposes, e.g. if the school needs to collect more data, such as employment history. To ensure consent remains compliant with the terms of the GDPR, the ICO recommends “building regular consent reviews into your business processes”. (ICO, para.29)

The ICO website also suggests:

  • Keeping records to evidence consent – who consented, when, how and what they were told.
  • Making it easy for people to withdraw consent at any time they choose. (ICO paras. 27 & 28)

 In summary, consent should be sought when initially issuing a privacy notice and when any adjustments have been made that affect the original consent.


1 ICO (2017) ‘Consent’, paras. 27, 28, & 29 <> [Accessed: 14 February 2018]


Monday 26 February

Our question of the week is: How long should schools retain pupil records, including sensitive data?

We spoke to the Information Commissioner’s Office, who confirmed that the Data Protection Act 1998 does not stipulate how long records should be kept for and by whom.1 However, it is considered good practice for pupil records to be kept until the pupil reaches the age of 25 and that the responsibility for keeping these records lies with the school which the pupil attended until they reached statutory school leaving age.

Our team also sought the opinion of the DfE, who advised that maintained schools should liaise with their LA in regards to the storing and retention of sensitive data, such as special educational needs and disabilities information.2

For this reason, it is suggested that schools contact their LA to clarify retention details in order to ensure that their school is fully compliant with procedures within their relevant area.


1 ICO (2016) (Telephone conversation about record retention in schools) [Personal communication: 19 October 2016]

2 DfE (2016) (Telephone conversation about record retention, particularly SEND and child protection information) [Personal communication: 19 October 2016]

Monday 19 February 

Q. How does Ofsted define good attendance when inspecting schools?

In terms of what Ofsted would define as good or better attendance when conducting inspections, our Ofsted expert advised that 96 percent is the key indicator of good attendance (the current national average), but schools must monitor the attendance of all key groups using the relevant figure tables.1

In light of the above, our governance expert, Nicki Wadley, further advised that Ofsted consider the attendance statistics for a school and national averages (relevant to the specific school type, e.g. a primary school), and will also use these as an indicator of good attendance.2

As well as using statistical information, Ofsted will also consider a school’s approach towards improving and tackling poor attendance, and will therefore use procedures as well as figures to decide on a school’s overall attendance performance. Our Ofsted Expectations of Pupil Attendance guidance document explains what Ofsted look for when assessing attendance.


1 Ofsted Expert (2017) (Email communication regarding attendance percentages) [Personal communication: 8 September 2017]

2 Nicki Wadley (2017) (Personal communication regarding Ofsted’s expectations of attendance) [Personal communication: 6 September 2017]


Monday 12 February


Q: Are schools required to publish information relating to swimming on their website? 

In accordance with guidance from the DfE, we can confirm that from the 2017/2018 academic year, it is now a requirement for schools to publish information relating to swimming on their school website, specifically in relation to the PE and sport premium grant. This includes how many pupils within a school’s Year 6 cohort are meeting the national curriculum requirements to:

  • Swim competently, confidently and proficiently over a distance of at least 25 metres.
  • Use a range of strokes effectively.
  • Perform safe self-rescue in different water-based situations.1

Schools may choose to use some of the PE and sport premium to improve swimming provision – if they choose to do so, they must also publish certain information relating to the distribution of their funding; this includes the following:

  • The amount of premium received
  • A full breakdown of how it has been spent, or will be spent
  • The impact the school has seen on pupils’ PE and sport participation and attainment
  • How the improvements will be sustainable in the future

In order to help schools meet this requirement, we have created a PE and Sport Premium Strategy Template in line with our pupil premium expert, which helps schools address each criteria effectively and set out their strategy for using the funding.

1 DfE (2014) ‘PE and sport premium for primary schools’, para ‘Accountability’, <> [Accessed: 5 February 2018]



To learn more about our QA service and our in-house production process that makes us so popular, take out a free, no obligation trial today -