Virtual school privacy notice

This privacy notice is designed to help you understand how and why the virtual school processes your personal data. This notice should be read in conjunction with our corporate privacy notice.

Who are we?

North Yorkshire Council are a ‘data controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR). The virtual school is a statutory service which consists of all the children in care of North Yorkshire, whether they are placed in a North Yorkshire school or elsewhere in the country. The virtual school is a specialist support team responsible for raising the attainment, progress and aspirations of North Yorkshire's looked after children and previously looked after children. In order to provide this service, the virtual school needs to collect and process your personal data.

We have appointed Veritau Ltd to be our data protection officer.

Their contact details are:

Information Governance Office


West Offices

Station Rise


North Yorkshire



Tel: 01904 552848

What personal information do we collect?

In order to deliver our virtual school, we will need to collect both personal and special category data, specifically:

Personal data collected:

  • parent and child personal information (e.g. name, address, date of birth, contact information)
  • education history
  • family information
  • pupil premium information
  • unique pupil reference number (UPN)

Special category data collected:

  • looked after or adoption status
  • ethnicity
  • religion
  • child’s statement of educational needs or educational health and care plan (EHCP)
  • exclusion information

Why do we collect your personal information?

We need to collect this information to fulfil our legal obligation with regard to children on roll of the virtual school, specifically for the following purposes:

Purpose of processing your data:

  • monitoring of admissions, attendance and exclusions of looked after children
  • promoting educational achievement of looked after children
  • service delivery of the virtual school
  • service improvement
  • research and statistics

Who do we share this information with?

In the course of performing our legal duties, we may share your information with a number of agencies who are key to delivering our service.

Within the council:

  • our teams responsible for the provision of the virtual school

Agencies we share information with:

  • education providers
  • other local authorities (where children attend schools outside of ourselves)
  • DfE (statutory requirement for reporting)
  • Ofsted (statutory reporting)
  • adoption agencies
  • police
  • youth offending services

How long do we keep your information for?

Data held

Retention period

Looked after children case files

Date of birth + 75 years If the child/young person dies before the age of 18, retain for 15 years from date of death

What is our lawful basis for processing your information?

With regard to personal data:

Article 6(1)(c) - Legal obligation: the processing is necessary to comply with the law

With regard to special category data:

Article 9(2)(h) – Health and social care

The legislations, policies and guidance that relates to this service includes, but is not limited to:

  • the children act 1989, as amended by the children and families act 2014 and the children and social work act 2017
  • the care planning, placement and case review (England) regulations 2010, as amended

For more information about how we use your data, including your privacy rights and the complaints process, please see our corporate privacy notice.