General Data Protection Regulation (GDPR)

GDPR came into force on 25 May 2018.  This is a regulation in European Law that covers data protection and privacy for all individuals within the EU and the export of data outside the EU.

The Data Protection Officer (DPO) for Haileybury Turnford is HFL Education.

Any data protection matters should be addressed to

We have issued the privacy notice below to all students and ask that the consent form be signed and returned to the school.  The legislation has decided that at 13 children have the right of consent over their data.  This is a significant responsibility and we encourage parents/carers discuss the consent form with their child prior to completing and signing it.

Below is guidance on submitting a subject access request (SAR) and a form to use should you wish to make a SAR.  It is not necessary to use this form however.

Relevant polices (which can be found in the Policies section of the website) are Data Protection Policy and CCTV policy.

Student Data Consent Form

Subject Access Request Guidelines

Subject Access Request Form




GDPR Subject Access Request Policy
GDPR Data Breach Guidelines
GDPR Data Security Policy
GDPR Records Retention Schedule
GDPR Data Retention Policy
GDPR Data Protection Policy
GDPR Privacy Notice Parents Carers