Data Protection Policy

The SEND Consultancy Group Ltd

Version date: 30.08.2026
Next review date: 30.09.2026
Policy owner: Managing Director

1. INTRODUCTION

This Data Protection Policy sets out how The SEND Consultancy Group Ltd (“we”, “our”, “us”) processes personal data in connection with our SEND consultancy and advocacy business.

This Policy applies to all personal data we process, regardless of the format or medium on which that data is stored. This includes personal data relating to past, present and prospective clients, children and young people, parents, carers, guardians, family members, employees, workers, contractors, consultants, suppliers, professional contacts, website users and any other individuals whose personal data we process.

Because of the nature of our work, we may process sensitive and confidential information relating to children and young people with special educational needs and disabilities, including information about education, health, disability, mental health, social care, safeguarding, family circumstances, professional assessments, school records, Education, Health and Care Plans, tribunal or complaint documents and correspondence with schools, local authorities, NHS bodies, therapists, educational psychologists and other professionals.

We are committed to processing personal data lawfully, fairly and transparently, and to protecting the confidentiality, integrity and security of all personal data entrusted to us.

For the purposes of this Policy:

• Data Protection Laws means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and any other applicable UK data protection or privacy legislation, including as amended or supplemented from time to time.
• UK GDPR means the UK General Data Protection Regulation.
• Personal data means any information relating to an identified or identifiable living individual.
• Special category data means more sensitive personal data, including information about health, disability, race or ethnic origin, religious or philosophical beliefs, sex life or sexual orientation, biometric data, genetic data, trade union membership and political opinions.
• Criminal convictions data means personal data relating to criminal convictions, offences, allegations, proceedings and related security measures.
• Data Subject means the individual to whom the personal data relates.
• Controller means the organisation that decides why and how personal data is processed.
• Processor means an organisation that processes personal data on behalf of a Controller.

We usually act as a Controller in relation to the personal data we process for our SEND consultancy and advocacy services because we decide why and how that personal data is used.

2. DATA PROTECTION PRINCIPLES

We comply with the data protection principles under the UK GDPR. Personal data must be:

1. Processed lawfully, fairly and transparently .
2. Collected for specified, explicit and legitimate purposes and not further processed in a way that is incompatible with those purposes.
3. Adequate, relevant and limited to what is necessary for the purposes for which it is processed.
4. Accurate and, where necessary, kept up to date .
5. Kept in a form that permits identification for no longer than is necessary .
6. Processed securely , using appropriate technical and organisational measures to protect against unauthorised or unlawful processing, accidental loss, destruction or damage.
7. Handled in a way that allows Data Subjects to exercise their legal rights .
8. Transferred outside the UK only where lawful safeguards are in place , where required.

We are responsible for, and must be able to demonstrate, compliance with these principles. This is known as the accountability principle.

3. LAWFULNESS, FAIRNESS AND TRANSPARENCY

We only collect, use and share personal data where we have a lawful basis for doing so.

The lawful bases we may rely on include:

1. Contract — where processing is necessary to perform a contract with the individual or to take steps at their request before entering into a contract. For example, providing consultancy or advocacy services to a parent, carer or young person.
2. Legal obligation — where processing is necessary to comply with a legal obligation.
3. Legitimate interests — where processing is necessary for our legitimate business interests or those of a third party, provided those interests are not overridden by the rights, freedoms and interests of the Data Subject, particularly where the Data Subject is a child.
4. Consent — where the individual has given clear consent for a specific processing activity.
5. Vital interests — where processing is necessary to protect someone’s life. This is likely to be rare but may be relevant in urgent safeguarding or welfare situations.
6. Recognised legitimate interests , where available under Data Protection Laws, for certain specified purposes which may include safeguarding, crime prevention, national security or responding to emergencies.

We identify and document the lawful basis for each category of processing activity in our data inventory or record of processing activities.

We provide Data Subjects with clear information about how we process their personal data through our Privacy Notice, which is available here: https://thesendconsultancygroup.co.uk/privacy-policy/

4. SPECIAL CATEGORY DATA AND SENSITIVE INFORMATION

Because we provide SEND consultancy and advocacy services, we may process special category data and other highly sensitive information.

This may include, but is not limited to:

• information about a child or young person’s special educational needs;
• health information;
• disability information;
• mental health information;
• neurodevelopmental information, including information relating to autism, ADHD, dyslexia, dyspraxia and other conditions;
• medical letters, reports and assessments;
• educational psychology reports;
• speech and language therapy reports;
• occupational therapy reports;
• physiotherapy reports;
• CAMHS or other mental health records;
• social care records;
• safeguarding information;
• information relating to behaviour, exclusions, attendance or emotional-based school avoidance;
• Education, Health and Care Plans;
• school records, SEN support plans, individual education plans and risk assessments;
• tribunal, mediation, complaint or appeal documents;
• information about family circumstances where relevant to our services;
• information about reasonable adjustments, disability discrimination or equality-related matters.

We only process special category data where we have both:

1. a lawful basis under Article 6 UK GDPR; and
2. a special category condition under Article 9 UK GDPR and, where required, the Data Protection Act 2018.

The special category conditions we may rely on include:

1. Explicit consent , where the individual, or where appropriate their parent, carer or legal guardian, has given explicit consent to the processing.
2. Legal claims , where processing is necessary for the establishment, exercise or defence of legal claims, including SEND Tribunal appeals, disability discrimination claims, complaints, mediation, local authority disputes and related advocacy work.
3. Substantial public interest , where permitted by the Data Protection Act 2018, including where processing is necessary for safeguarding children or individuals at risk, equality of opportunity or treatment, or other relevant substantial public interest conditions.
4. Vital interests , where processing is necessary to protect someone’s life and the person is physically or legally incapable of giving consent.
5. Health or social care , where applicable and where processing is necessary for the provision of health or social care or treatment, or the management of health or social care systems and services.

Where we rely on a substantial public interest condition under the Data Protection Act 2018, we will ensure that an appropriate policy document is in place where required.

We recognise that information about children and young people with SEND is particularly sensitive. We will apply additional care when collecting, using, storing, sharing and deleting this information.

5. CRIMINAL CONVICTIONS DATA

We may occasionally process criminal convictions data or information relating to alleged offences where this is relevant to our services. For example, this may arise in connection with safeguarding matters, exclusions, behaviour incidents, police involvement, youth justice matters, complaints or appeals.

We will only process criminal convictions data where authorised by Data Protection Laws. This may include where processing is necessary for:

• the establishment, exercise or defence of legal claims;
• safeguarding children or individuals at risk;
• preventing or detecting unlawful acts;
• complying with legal obligations;
• substantial public interest reasons permitted by the Data Protection Act 2018.

Where required, we will maintain an appropriate policy document in relation to this processing.

6. CHILDREN AND YOUNG PEOPLE’S DATA

A significant part of our work may involve processing personal data relating to children and young people.

We recognise that children and young people merit specific protection under Data Protection Laws because they may be less aware of the risks, consequences and safeguards involved in the processing of their personal data.

When processing children’s data, we will:

1. only collect the information we need for the specific service being provided;
2. explain our processing in clear and accessible language where appropriate;
3. take account of the age, maturity and understanding of the child or young person;
4. involve the child or young person where appropriate and where this is consistent with their rights and best interests;
5. obtain consent or explicit consent where required from the appropriate person;
6. respect the rights of young people who are able to exercise their own data protection rights;
7. take particular care when sharing children’s information with third parties;
8. ensure appropriate security measures are in place.

Where a parent, carer or legal guardian provides information about a child or young person, we will process that information in accordance with our Privacy Notice and this Policy.

Where a young person has sufficient understanding and capacity to make their own decisions about their personal data, we will take this into account when responding to data rights requests or deciding whether parental involvement is appropriate.

7. CONSENT AND EXPLICIT CONSENT

Consent must be freely given, specific, informed and unambiguous. It must be given by a clear affirmative action, such as ticking an unticked box, signing a consent statement or providing another clear indication of agreement. Silence, inactivity or pre-ticked boxes do not constitute valid consent.

Where we rely on consent, the Data Subject must be able to withdraw consent at any time. We will make it easy to withdraw consent and will promptly honour withdrawal requests. Where we process special category data and rely on explicit consent, the consent must be clear, express and specific. This may be obtained through a written or electronic signed statement.

We will keep appropriate records of consent, including:

• who gave consent;
• when consent was given;
• what the person was told at the time;
• how consent was given;
• whether consent has been withdrawn.

We will not rely on consent where another lawful basis is more appropriate. For example, in some circumstances we may rely on contract, legitimate interests, legal claims or safeguarding-related conditions rather than consent.

8. PURPOSE LIMITATION

We will only collect and process personal data for specified, explicit and legitimate purposes.

The purposes for which we may process personal data include:

1. providing SEND consultancy and advocacy services;
2. advising and supporting parents, carers, children and young people;
3. reviewing educational, health, social care and professional documents;
4. preparing for or supporting meetings with schools, local authorities, health bodies or other professionals;
5. assisting with Education, Health and Care needs assessments, Education, Health and Care Plans, annual reviews, complaints, mediation, appeals and tribunal-related matters;
6. communicating with clients and prospective clients;
7. liaising with schools, local authorities, NHS bodies, therapists, experts, legal representatives, tribunal bodies and other relevant third parties where appropriate;
8. safeguarding children or vulnerable individuals;
9. managing client files and records;
10. dealing with enquiries, bookings, payments and administration;
11. managing our website and online services;
12. marketing our services in accordance with applicable law;
13. obtaining feedback and reviews;
14. managing staff, contractors and suppliers;
15. complying with legal, regulatory and professional obligations;
16. establishing, exercising or defending legal claims;
17. maintaining business records;
18. protecting our business, clients, staff and third parties.

We will not use personal data for new, different or incompatible purposes unless we have a lawful basis to do so and, where required, we have informed the Data Subject and obtained consent.

9. DATA MINIMISATION

We will ensure that personal data is adequate, relevant and limited to what is necessary for the purposes for which it is processed.

Given the nature of SEND consultancy and advocacy work, it may be necessary to process detailed educational, health, social care, family and professional information. However, we will not collect excessive information and will only request or retain information that is genuinely needed for the relevant matter.

We will periodically review the personal data we hold and delete, anonymise or securely archive information that is no longer needed, in accordance with our retention procedures.

Our data retention guidelines are available here: https://thesendconsultancygroup.co.uk/privacy-policy/

10. ACCURACY

We will take reasonable steps to ensure that personal data is accurate and, where necessary, kept up to date.

We recognise that SEND-related information may change over time, including diagnoses, needs, provision, school placements, professional recommendations and family circumstances.

We will:

1. take reasonable steps to check the accuracy of personal data at the point of collection;
2. ask clients to provide updated information where relevant;
3. correct inaccurate personal data without undue delay where appropriate;
4. ensure that opinions, assessments and professional reports are clearly identifiable as such;
5. where appropriate, record disputed information rather than simply deleting it, particularly where it may be relevant to a complaint, appeal, tribunal or legal claim.

11. STORAGE LIMITATION AND RETENTION

We will not keep personal data in identifiable form for longer than necessary for the purposes for which it is processed.

We may need to retain client files and related records for a period after our work has concluded, including where this is necessary for:

• legal, regulatory or contractual reasons;
• safeguarding reasons;
• complaints handling;
• insurance purposes;
• financial and accounting records;
• the establishment, exercise or defence of legal claims.

We will maintain retention procedures to ensure that personal data is securely deleted, anonymised or archived when it is no longer needed.

We will inform Data Subjects, through our Privacy Notice, of the period for which their personal data will be retained or the criteria used to determine that period.

Where third-party processors process personal data on our behalf, we will require them to delete or return personal data when appropriate and in accordance with our instructions and contractual arrangements.

12. SECURITY, INTEGRITY AND CONFIDENTIALITY

We will protect personal data using appropriate technical and organisational security measures.

Given the sensitive nature of the information we process, particularly children’s SEND, health, disability, safeguarding and family information, we will apply enhanced care when handling client records.

Our security measures may include, where appropriate:

1. password protection;
2. multi-factor authentication;
3. access controls and role-based permissions;
4. secure cloud storage;
5. encryption or password protection for sensitive documents where appropriate;
6. secure email practices;
7. secure file-sharing systems where appropriate;
8. anti-virus and malware protection;
9. device security controls;
10. secure disposal of paper records;
11. staff and contractor confidentiality obligations;
12. staff training;
13. limiting access to personal data to those who need it;
14. maintaining appropriate back-ups;
15. reviewing third-party service provider security.

We will maintain data security by protecting:

• confidentiality — only authorised people who need the data can access it;
• integrity — personal data is accurate and protected from unauthorised alteration;
• availability — authorised users can access the data when needed for authorised purposes.

We will exercise particular care in protecting special category data and criminal convictions data from loss, unauthorised access, misuse, disclosure or alteration.

13. CONFIDENTIALITY AND PROFESSIONAL BOUNDARIES

All staff, workers, contractors and consultants who have access to personal data must maintain confidentiality.

Personal data must only be accessed, used or disclosed where necessary for authorised business purposes and in accordance with this Policy.

Client information, children’s records, professional reports, safeguarding information and tribunal or complaint documents must not be discussed with anyone who does not have a legitimate need to know.

Any unauthorised access, disclosure, loss or misuse of personal data must be reported immediately in accordance with our data breach procedure.

14. REPORTING A PERSONAL DATA BREACH

A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

Examples may include:

• sending a professional report to the wrong recipient;
• losing a laptop, phone or paper file containing personal data;
• unauthorised access to a client file;
• accidental disclosure of a child’s health or SEND information;
• cyber-attacks, ransomware or email compromise;
• failure to use blind copy when emailing a group, where personal data is revealed;
• loss of login credentials.

We have procedures in place to identify, report, investigate and respond to suspected personal data breaches.

Where required, we will notify the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Where a breach is likely to result in a high risk to the rights and freedoms of affected individuals, we will also inform those individuals without undue delay.

We will keep a record of personal data breaches, whether or not they are reportable to the Information Commissioner’s Office.

15. TRANSFERS OUTSIDE THE UK

Data Protection Laws restrict transfers of personal data outside the UK unless appropriate safeguards or exemptions apply.

A transfer may occur where personal data is sent, stored, accessed or viewed in another country. This may include using cloud-based software, email platforms, customer relationship management systems, video conferencing tools, website platforms or other online service providers based outside the UK.

We will only transfer personal data outside the UK where one of the following applies:

1. the destination country has been recognised as providing an adequate level of protection;
2. appropriate safeguards are in place, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism;
3. the transfer is covered by a valid derogation under Data Protection Laws, such as explicit consent, performance of a contract, legal claims or vital interests;
4. another lawful basis for the transfer applies.

Where required, we will carry out appropriate transfer risk assessments and ensure that international transfers are recorded in our data inventory or records of processing activities.

16. DATA SUBJECT RIGHTS AND REQUESTS

Data Subjects have rights in relation to their personal data. These include the right to:

1. be informed about how their personal data is processed;
2. request access to their personal data;
3. request correction of inaccurate or incomplete personal data;
4. request erasure of personal data in certain circumstances;
5. request restriction of processing in certain circumstances;
6. object to processing based on legitimate interests or direct marketing;
7. withdraw consent where processing is based on consent;
8. request data portability in certain circumstances;
9. object to certain automated decision-making;
10. be notified of certain personal data breaches;
11. complain to the Information Commissioner’s Office.

We will respond to Data Subject requests in accordance with Data Protection Laws.

We will take reasonable steps to verify the identity of the person making the request before disclosing personal data.

Where a request relates to a child or young person, we will consider:

• the age and maturity of the child or young person;
• whether they are able to understand and exercise their own rights;
• the nature of the information requested;
• whether disclosure to a parent, carer or other person is appropriate;
• whether disclosure could adversely affect the child or young person or another individual;
• safeguarding considerations.

We will not disclose personal data to third parties unless we are satisfied that they are authorised to receive it.

In responding to subject access requests, we will carry out searches that are reasonable and proportionate. We may refuse or charge a reasonable fee for requests where permitted by law, including where a request is manifestly unfounded, excessive or vexatious.

17. COMPLAINTS

We take data protection complaints seriously.

If a Data Subject has a concern about how we process their personal data, they should contact us first using the contact details in our Privacy Notice.

We will acknowledge and respond to complaints in accordance with our complaints handling process and applicable Data Protection Laws.

Data Subjects also have the right to complain to the Information Commissioner’s Office. The Information Commissioner’s Office can be contacted at:

Information Commissioner’s Office
Website: https://ico.org.uk
Telephone: 0303 123 1113

18. ACCOUNTABILITY

We will implement appropriate technical and organisational measures to ensure and demonstrate compliance with Data Protection Laws.

This includes, where appropriate:

1. maintaining this Data Protection Policy;
2. maintaining a Privacy Notice;
3. maintaining records of processing activities or a data inventory;
4. maintaining retention guidelines;
5. maintaining a data breach procedure;
6. using appropriate contracts with processors;
7. carrying out data protection impact assessments where required;
8. applying data protection by design and by default;
9. providing data protection training to staff, workers and contractors;
10. reviewing third-party service providers;
11. keeping records of consents and opt-outs;
12. documenting lawful bases for processing;
13. documenting special category conditions where relevant;
14. implementing appropriate security measures;
15. regularly reviewing our compliance arrangements.

We will appoint a Data Protection Officer if legally required. If we are not legally required to appoint a Data Protection Officer, we will still allocate responsibility for data protection compliance to an appropriate person within the business.

19. RECORD KEEPING

We will keep appropriate records of our personal data processing activities.

These records may include:

1. our name and contact details as Controller;
2. details of any Data Protection Officer or data protection lead;
3. the purposes of processing;
4. categories of Data Subjects;
5. categories of personal data;
6. categories of special category data;
7. categories of criminal convictions data, where applicable;
8. lawful bases for processing;
9. special category conditions relied on;
10. categories of recipients of personal data;
11. third-party processors used;
12. international transfers and safeguards;
13. retention periods;
14. technical and organisational security measures;
15. records of consent and withdrawal of consent;
16. records of data breaches;
17. records of Data Subject requests;
18. data protection impact assessments where applicable.

We will keep our records under review and update them when our processing activities change, including when we introduce new systems, services, suppliers or data processing activities.

20. DATA PROTECTION BY DESIGN AND BY DEFAULT

We will apply data protection by design and by default when developing or changing our services, systems and processes.

This means that we will consider data protection at the start of a project and throughout its lifecycle.

When designing or changing any process involving personal data, we will consider:

1. what personal data is needed;
2. why it is needed;
3. whether less data could be used;
4. how long it needs to be kept;
5. who needs access to it;
6. how it will be kept secure;
7. whether children’s data is involved;
8. whether special category data or criminal convictions data is involved;
9. whether data will be shared with third parties;
10. whether data will be transferred outside the UK;
11. how Data Subjects will be informed;
12. how Data Subject rights will be respected.

21. DATA PROTECTION IMPACT ASSESSMENTS

We will carry out a Data Protection Impact Assessment where processing is likely to result in a high risk to the rights and freedoms of individuals.

This may be particularly relevant where processing involves:

1. large-scale processing of special category data;
2. children’s data;
3. safeguarding information;
4. vulnerable individuals;
5. systematic monitoring;
6. new technologies;
7. automated decision-making;
8. profiling;
9. intrusive processing;
10. significant sharing of sensitive information between organisations.

A Data Protection Impact Assessment will include:

1. a description of the processing;
2. the purposes of the processing;
3. an assessment of necessity and proportionality;
4. an assessment of risks to individuals;
5. measures to reduce or manage those risks;
6. evidence of compliance with Data Protection Laws.

Where a high risk cannot be adequately reduced, we will seek guidance from the Information Commissioner’s Office where required.

22. AUTOMATED DECISION-MAKING AND PROFILING

We do not usually carry out solely automated decision-making or profiling that produces legal or similarly significant effects on individuals.

If we introduce automated decision-making or profiling in the future, we will ensure that it complies with Data Protection Laws.

Where required, we will:

1. inform Data Subjects that automated decision-making or profiling is taking place;
2. explain the logic involved;
3. explain the significance and likely consequences;
4. provide the right to request human involvement;
5. allow Data Subjects to express their point of view;
6. allow Data Subjects to challenge the decision;
7. carry out a Data Protection Impact Assessment where required;
8. apply additional safeguards where children’s data, special category data or vulnerable individuals are involved.

23. DIRECT MARKETING

We comply with Data Protection Laws and the Privacy and Electronic Communications Regulations when carrying out direct marketing.

We may send marketing communications to individuals where we have the appropriate consent or where another lawful route applies.

For email and text marketing to individual subscribers, prior consent is usually required unless the soft opt-in applies.

The soft opt-in may apply where:

1. we obtained the person’s contact details in the course of a sale or negotiations for a sale;
2. we are marketing our own similar products or services;
3. we gave the person a clear opportunity to opt out when their details were collected; and
4. we give the person a clear opportunity to opt out in every subsequent marketing message.

For business-to-business marketing, we will comply with applicable rules and ensure that recipients can object or opt out.

We will always honour objections to direct marketing promptly.

Where someone opts out of marketing, we may keep a suppression record containing the minimum information needed to ensure that their marketing preference is respected.

24. COOKIES AND SIMILAR TECHNOLOGIES

Where our website uses cookies or similar technologies, we will comply with applicable cookie rules.

We will not place non-essential cookies, such as analytics, advertising or tracking cookies, unless the user has given valid consent, unless an exemption applies under applicable law.

We will provide users with clear information about cookies and similar technologies through our Cookie Notice or Cookie Policy.

Users must be able to manage their cookie preferences, including refusing non-essential cookies.

25. SHARING PERSONAL DATA

We will only share personal data where we have a lawful basis to do so and where the sharing is fair, necessary and proportionate.

In connection with our SEND consultancy and advocacy services, we may share personal data with relevant third parties where appropriate, including:

1. schools, colleges and educational settings;
2. local authorities;
3. NHS bodies;
4. health professionals;
5. social care professionals;
6. therapists;
7. educational psychologists;
8. SEND consultants or advocates;
9. legal representatives;
10. mediators;
11. SEND Tribunal or court bodies;
12. expert witnesses;
13. professional advisers;
14. insurers;
15. IT, software, cloud storage, email, accounting and administrative service providers;
16. regulators or public authorities where required by law;
17. safeguarding bodies or relevant professionals where necessary.

We will only share personal data where:

1. the recipient has a legitimate need to receive the information;
2. sharing is consistent with our Privacy Notice or otherwise permitted by law;
3. we have obtained consent where consent is required;
4. appropriate confidentiality and security arrangements are in place;
5. where the recipient is a processor, a written data processing agreement is in place;
6. international transfer rules are complied with where applicable;
7. the sharing is appropriate having regard to the rights and interests of any child or young person involved.

We will take particular care when sharing special category data, criminal convictions data, safeguarding information or information relating to children and young people.

26. PROCESSORS AND THIRD-PARTY SERVICE PROVIDERS

Where we use third-party service providers to process personal data on our behalf, we will ensure appropriate safeguards are in place.

Examples may include providers of:

• email services;
• cloud storage;
• client relationship management systems;
• accounting software;
• payment processing;
• website hosting;
• online forms;
• video conferencing;
• document management;
• IT support;
• marketing platforms.

We will only use processors that provide sufficient guarantees that they will implement appropriate technical and organisational measures.

We will ensure that written contracts are in place with processors where required by Data Protection Laws. These contracts will set out, among other things:

1. the subject matter and duration of processing;
2. the nature and purpose of processing;
3. the type of personal data;
4. the categories of Data Subjects;
5. our instructions;
6. confidentiality obligations;
7. security obligations;
8. rules on sub-processors;
9. assistance with Data Subject rights and data breaches;
10. deletion or return of personal data at the end of the services;
11. audit and compliance obligations;
12. international transfer safeguards where relevant.

27. STAFF, WORKERS AND CONTRACTORS

All staff, workers, contractors and consultants who handle personal data must comply with this Policy.

They must:

1. only access personal data they need for their role;
2. keep personal data confidential;
3. follow our security procedures;
4. use approved systems and devices where required;
5. avoid downloading, copying or sharing personal data unnecessarily;
6. report suspected data breaches immediately;
7. complete data protection training where required;
8. comply with retention and deletion rules;
9. take extra care with children’s data, special category data and safeguarding information.

Failure to comply with this Policy may result in disciplinary action or termination of contractual arrangements, as applicable.

28. TRAINING AND AUDIT

We will ensure that relevant staff, workers and contractors receive appropriate data protection training.

Training may cover:

1. data protection principles;
2. children’s data;
3. special category data;
4. safeguarding-related information;
5. secure handling of client records;
6. confidentiality;
7. data breaches;
8. Data Subject rights;
9. direct marketing rules;
10. use of approved systems;
11. retention and deletion;
12. phishing and cyber security awareness.

We will periodically review and test our systems, processes and policies to assess compliance with Data Protection Laws.

We will keep records of training where appropriate.

29. SAFEGUARDING AND WELFARE CONCERNS

Where we identify safeguarding or welfare concerns, we may need to process and share personal data, including special category data, without consent where this is necessary and lawful.

This may include sharing information with:

• safeguarding leads;
• schools or colleges;
• local authorities;
• social care;
• police;
• healthcare professionals;
• other relevant safeguarding bodies.

Where possible and appropriate, we will be transparent with the relevant individuals about such sharing. However, we may share information without informing them first where doing so is necessary to protect a child, young person or another individual, or where informing them would prejudice safeguarding action or legal obligations.

We will document significant safeguarding-related decisions involving personal data sharing.

30. COMPLAINTS, APPEALS AND TRIBUNAL MATTERS

As part of our SEND consultancy and advocacy work, we may process personal data for the purposes of complaints, mediation, SEND Tribunal appeals, disability discrimination matters, local authority disputes, school disputes or other legal or quasi-legal processes.

This may include processing and sharing:

• Education, Health and Care Plans;
• professional reports;
• medical evidence;
• school records;
• attendance records;
• exclusion records;
• complaint correspondence;
• local authority correspondence;
• tribunal documents;
• witness evidence;
• expert evidence;
• family information;
• safeguarding information where relevant.

Where processing is necessary for the establishment, exercise or defence of legal claims, we may rely on the legal claims condition under Data Protection Laws, including in relation to special category data where applicable.

31. CHANGES TO THIS POLICY

We will keep this Data Protection Policy under regular review.

This version was last updated on: 30.08.26

We may update this Policy from time to time to reflect changes in our business, services, systems, legal obligations or regulatory guidance.

This Policy does not override applicable Data Protection Laws.