GDPR
Policy

General Data Protection Regulation (2018)

 

Data protection contact:
The relevant HIVE Educational Psychologist (Data Controller)

General enquiries:
hello@hiveepa.com

Policy Review:
July 2026

Next Review:
July 2027

1.Introduction

HIVE Educational Psychologists aim to be clear about how and why your personal information is used and how your privacy is protected. This policy explains how we collect, use, share, store and protect personal information, including sensitive information, in accordance with the UK GDPR and the Data Protection Act 2018, as amended.

If you have any questions about this policy, please contact the HIVE Educational Psychologist responsible for your information (the Data Controller). If you are not satisfied with their response, you may contact the Information Commissioner’s Office (ICO) at www.ico.org.uk.

2. Why Personal Information Is Collected

Personal information is collected for the following purposes:

Assessment and Consultation

To conduct consultations with key staff and parents/carers.

To carry out classroom observations.

To conduct psychological assessments of children and young people.

Communication and Service Delivery

To communicate with you, send reports, arrange appointments, provide feedback, and issue invoices.

To carry out and deliver the educational psychology service contracted by the child’s school, nursery, or educational setting.

Safeguarding and Initial Enquiries

In the case of child protection, case conferences, or related processes.

To gather information during initial enquiries from schools.

Note: Prior to parental consent, full names of children are not used.

3. Consent

Consent is an ongoing process and may vary depending on the context of the work.

If consent is not given, no educational psychology involvement will take place.

When a parent/carer provides consent, this covers the initial piece of work (consultation or assessment), the review consultation, and any subsequent pieces of work.

If a school requests involvement more than one year after initial involvement, a new Request for Involvement must be completed and signed to ensure consent remains valid.

Consent can be withdrawn at any time by contacting the Data Controller.

Parental Responsibility

Guidance from the Department for Education states that only one adult with parental responsibility is required to provide consent. However, if another adult with parental responsibility is likely to refuse consent, they must be given the opportunity to do so. If adults with parental responsibility disagree, involvement cannot proceed until the issue is resolved or determined by the Family Court.

4. Types of Information Collected

Legitimate Interest

Given the nature of the Educational Psychologist’s role, relevant personal data is collected to provide educational psychology support and to consider what support is required to remove barriers to learning.

One change: criminal convictions should be listed separately from special category data. The rest can remain as written. ICO guidance

5. Information Collected

Only information relevant to consultation, assessment, reporting, profiling, and advising is collected. This may include:

Background information and identifying details (e.g., family name, date/place of birth, address, phone numbers, areas of strength and need, medical conditions, other services involved).

Special category data (e.g., race, ethnic origin, religious beliefs, physical or mental health conditions).

Information relating to criminal convictions or offences, where relevant and lawful.

Psychological, medical, and other professional reports.

Assessment materials.

Email enquiries (schools are asked to use initials rather than full names).

6. Lawful Basis for Processing Data

Data is processed under the following lawful bases:

Signed consent from parents/carers.

Consent from Gillick-competent young people.

Compliance with a legal obligation.

Protection of vital interests.

Performance of a task in the public interest or an official function.

7. How Information Is Used and Processed

Information collected is used to:

Carry out consultation meetings with key staff and parents/carers, and record outcomes.

Interpret, hypothesise, and score assessment information, which is then compiled into written records or reports.

Share written records and reports with relevant parties (e.g., parents, schools, other professionals) with prior consent.

Storage of Assessment Materials

Paper assessment materials are destroyed after the assessment and report are completed.

Results are held within electronic reports.

Report Sharing

Reports are sent to schools as encrypted PDF files.

Passwords are provided separately.

Schools forward reports to parents/carers and other relevant parties.

7. Data Security

Appropriate technical and organisational measures are taken to protect personal data from unauthorised access, loss, or damage. These include:

Assessment materials, notes, and consent forms stored in a locked filing cabinet or encrypted electronic file.

An encrypted computer drive for electronic reports.

A firewall and anti-virus software on the computer.

Password-protected and backed-up electronic data.

8. Data Breach Procedure

If a data breach occurs:

The relevant HIVE Educational Psychologist will investigate, contain and record any personal data breach.

The ICO will be notified without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to risk individuals’ rights and freedoms. Affected individuals will be informed without undue delay where the risk is high.

Recipients must protect copies of reports they receive. Each EP remains responsible for information under their control.

The ICO will be contacted as soon as reasonably possible, and within 72 hours.

Schools and parents/carers will also be informed as soon as reasonably possible.

Once a report is sent to a school or parent/carer, it becomes their responsibility to protect the document in line with their own GDPR policies.