LiA Student Data Protection Supplement

LiA Student Data Protection Supplement

1. Purpose and Scope

This supplement applies the Malvern International GDPR Data Protection Policy to the Language in Action (LiA) under-18 provision. It covers the categories of data specific to working with children, who exercises data rights on behalf of students, and how data protection law interacts with safeguarding. It applies to all LiA staff, contractors and agency partners, and should be read together with the Group policy. The Data Protection Officer (gdpr@malvernplc.com) remains the contact for all requests, complaints and breaches.

2. Special Category Data We Process

In delivering programmes for under-18s, LiA routinely processes special category data under Article 9 UK GDPR, including: health data (allergies, medical conditions, prescribed medication, first aid and medical incident records), dietary requirements which may reveal religious belief, safeguarding and welfare records, and images of students.

This data is processed under the conditions for substantial public interest — safeguarding of children and of individuals at risk (Data Protection Act 2018, Schedule 1, Part 2) — and, in emergencies, to protect a student’s vital interests. Health information collected pre-arrival through the enrolment process is shared only with the staff who need it to keep the student safe (e.g. centre management and catering for allergies). Visible allergy identifiers are used only where necessary to protect the student’s safety.

3. Data Rights of Under-18 Students

Students do not lose their data rights because they are children, and parents do not automatically acquire them. Any request concerning a student’s data — from the student, a parent or guardian, or an agent — must be referred immediately to the Data Protection Officer, who will verify the identity and authority of the requester before responding. In general, parents or guardians exercise rights on behalf of younger children, while older students of sufficient maturity may exercise their own rights; the DPO assesses this case by case. Requests are answered within one month as required by law.

4. Information Sharing for Safeguarding

Data protection law does not prevent the sharing of information for the purposes of keeping children safe. Fear of breaching UK GDPR must never stand in the way of reporting or escalating a safeguarding concern, in line with Keeping Children Safe in Education (KCSIE) 2025.

Safeguarding disclosures — to the DSL chain, the Local Authority Designated Officer (LADO), the police, statutory services, or a student’s parents and guardians — follow the Group Safeguarding and Prevent Policy and the LiA Safeguarding & Prevent Operational Implementation Addendum, and do not require the consent of the data subject. Such disclosures are made on a need-to-know basis and documented in line with the Addendum.

5. Practical Handling Rules

• Access on a need-to-know basis: student personal data is available only to the staff who need it for their role, in line with the Group least-privilege principle.
• Student images and testimonials are used for publicity only on the basis of the parental consent collected pre-arrival; any withdrawal of consent is actioned without delay.
• Safeguarding and welfare records are retained for a minimum of seven years, or until the student reaches the age of 25, whichever is later; other student records follow the Group retention schedule.
• Student data must never be stored on personal devices or shared through personal accounts or channels.
• Any suspected breach involving student data is reported immediately to gdpr@malvernplc.com and, where safeguarding may be affected, to the LiA DSL in parallel.

6. Related Documents

• Malvern International GDPR Data Protection Policy
• Group Safeguarding and Prevent Policy and LiA Safeguarding & Prevent Operational Implementation Addendum
• Privacy Policy (website)
• Student Complaints Policy and Procedure (Subject Access Requests, Section 4)
• E-Safety and Cyber-Bullying Policy and Procedure (personal information online)