DATA PROTECTION FOR EDUCATION
Evidence-First Data Protection for UK Schools
Clear advice and practical support for day-to-day GDPR — policies, SARs, FOI and breach response, delivered in plain English.
MEET SAR AND FOI DEADLINES
SAR and FOI Support — Calm, Fast, Defensible
When deadlines bite, we handle the heavy lifting and keep a clear record of key decisions — so you stay in control and avoid last-minute panic.
POLICIES, DEPLOYED
Policies You Can Deploy, Not Just Download
Unlike generic templates, our policies are built to be put straight into use. We've done the hard work of turning requirements into finished, school-ready documents — so you're not left filling in the blanks.
PRICING
Simple, Transparent Pricing for UK Schools
From £2 per pupil per year (VAT included). Straightforward support, clear scope, and no surprises — priced to scale with your pupil numbers.
PLATFORM FOUNDATIONS
Built for Separation by Default
Each school or trust only sees its own data and outputs. Access is role-based, key decisions are recorded, and the system is designed to fail closed.
DPO SERVICE
Data Protection Support That Does the Work
From advice and records to policies, SARs, FOI and incidents, we help schools turn data protection decisions into clear, defensible outputs.
DATA PROTECTION FOR EDUCATION
Evidence-First Data Protection for UK Schools
Clear advice and practical support for day-to-day GDPR — policies, SARs, FOI and breach response, delivered in plain English.
Why choose us
Different by design
Four things that set us apart.
Approach
We start with the thinking — law, guidance, context, and risk — then give you a clear position you can stand behind.
Delivery
Advice alone doesn’t ship outcomes. We support delivery: decisions, documentation, evidence handling, and usable outputs.
Education-first
Education is different — safeguarding realities, mixed systems, and tight deadlines. Our service reflects that environment.
Governed service
We provide a governed data protection service, with a framework, operating model, and quality layer behind the work.
Trust
Trusted by UK Schools and Trusts
Support across the education sector — from nurseries to multi‑academy trusts.
“Gareth is our amazing DPO. He has supported me through one of the most challenging cases I have worked on in 30 years and other cases besides. I wouldn’t now actually use anyone else and wholeheartedly recommend him!”
Mrs Williams, CEO/Headteacher, Weaver Trust Ltd.
Pricing
Simple, transparent pricing
Subscribe to what you need, or buy credits for one-off tasks.
Outsourced DPO
Starts at £2 per pupil / year
A named, qualified DPO for your school or trust. Covers advice, incident response, SAR handling, and annual review.
Portal standalone
£495 per school / year
A single place for evidence, cases, outputs, and the decisions behind them.
TruCredits
Pay as you go
Pre-purchase credits for processing, redaction, exports, and policy packs.
Evidence processing
Credits per export
Turn raw evidence into a clean, reviewable pack with a clear manifest of what was included and why.
Directory-assisted redaction
Credits per document
Consistent initials/pseudonyms and faster review using a temporary directory match, without manual name-hunting.
Policy packs & exports
Credits per pack
School-ready policy packs, pre-populated with your details and exported in clean formats.
KCSIE 2026
Safeguarding and data protection are moving closer together
The next KCSIE update is expected to sharpen the link between safeguarding, digital risk, records and information sharing. Schools should review how they evidence decisions where data protection and child protection overlap.
ICO edtech audit
Schools need stronger edtech governance
The ICO audited 28 edtech providers and found recurring gaps in DPIAs, controller and processor roles, contracts, transparency and AI governance. For schools and MATs, that means supplier assurances need to be tested, documented and kept under review.
Audit findings
The ICO made 596 recommendations across the 28 audited edtech providers, showing the scale of the governance gaps it found.
Accepted actions
Ninety-eight per cent of the ICO’s recommendations were accepted, reinforcing that the issues identified were substantive and actionable.
DPIA gap
Over 40 per cent of providers had not completed a DPIA at all for their product, underlining the need for stronger supplier assurance.
Evidence quality
Around 80 per cent of the DPIAs reviewed were not sufficiently detailed, showing that schools need more than a tick-box assessment.
FAQ
Common questions
What does the Outsourced DPO service include?▾
The Outsourced DPO service provides a named, qualified DPO for schools and trusts. It can cover advice, incident response, SAR and FOI support, annual review and related governance support, depending on the agreed plan.
Are you advice-only, or do you get involved?▾
We get involved. We help scope the work, support defensible decisions and deliver practical outputs, including policies, SAR and FOI support, and breach handling.
Do MATs get a discount?▾
Yes. Multi-academy trusts receive a discount based on the number of schools: 2–9 schools = 10%, 10–19 = 20%, and 20+ = 30%. A further 5% applies on a 3-year commitment billed annually.
What are TruCredits and how do I use them?▾
TruCredits are prepaid credits you can use for high-effort, one-off work such as evidence processing, redaction, exports and policy packs. Credits are deducted per task or unit.
Do I need the Portal to use the DPO service?▾
No. The DPO service stands on its own. Portal access may be included in some plans and can also be purchased separately where appropriate.
Do TruCredits roll over?▾
Purchased TruCredits roll over until used. Included monthly TruCredits, where part of a plan allowance, reset monthly and do not roll over.
What is the difference between Advisory and Comprehensive?▾
Advisory means the school manages the day-to-day data protection workflow, with Tru Data Protection providing advice, review and assurance. Comprehensive means Tru Data Protection manages the workflow with the school, using school-provided raw data, context and access, so the school is not left carrying the day-to-day administrative burden.
What is the difference between Advisory and Comprehensive?▾
Advisory means the school manages the day-to-day data protection workflow, with Tru Data Protection providing advice, review and assurance. Comprehensive means Tru Data Protection manages the workflow with the school, using school-provided raw data, context and access, so the school is not left carrying the day-to-day administrative burden.