Data Protection Frequently Asked Question for parents – COVID testing in
Schools and Colleges.
You will need to give medical consent for your child to take the test (if they are
under 16), If you want your child to be tested, you will also need to understand that
as part of testing we process their personal data. This processing of their data is
allowed under data protection legislation, known as UKGDPR and the Data
Protection Act 2018.
We are responsible for the processing of the test and ensuring all the personal
data relating to the test is properly managed in accordance with their legal
Before we can use any personal data in the administration of taking the test and
processing the results, we must tell you the lawful basis for why it is necessary to
process personal data and it must be in one of 6 reasons which are allowed in UK
data protection legislation. For the purpose of COVID-19 we are using Public Task
where it is necessary to process personal data to ensure we meet our obligations
in education legislation to safeguard and promote the wellbeing of pupils.
Public Health legislation also allows the sharing of personal data with DHSC, Local
Government, Test and Trace and the NHS.
You can find details of the specific legislation in the privacy notice or ask your
school’s data protection officer for more details [email address of DPO].
When you register for a test you need to provide us with your child’s
• Date of birth
• Home postcode
• Email address
• Mobile number
• Name of Parent or Guardian
This allows us to register your child for a test and to process the results. Once your
child is registered for a test they will be assigned a unique barcode which will be
used to identify the test without the need for sharing a lot of personal data.
Once the test has been completed, we will also record the results.
We will record that you have been offered and rejected a test so that we do not
keep asking you to agree to a test. We will not tell any unauthorised person
that is not directly involved in the recording of tests who has refused a test.
Schools and Colleges will not share refusals with other parents or pupils.
We will use the personal data you provided when you register your child for the
test to send the result to the named parents/guardians of children who test positive
for coronavirus on the day of the test. You will not be informed of a negative test
If you test positive, you will be offered a further test of a different kind (called a
PCR test) positive to confirm that your test result and details for this will be sent by
email/and or text to parents/legal guardians within 24-48 hours of the test by the
In the event of a positive result, in addition to sharing with the parent/guardian We
will only share the result with appropriate contacts such as the head teacher and
named nominated person in the school to allow us to start their own COVID
isolation processes. We will not tell any unauthorised person (that is anyone
not involved in the recording of test results) who has received a positive
result. Schools and Colleges will not share positive results with other
parents or pupils.
In the event of a negative result, We will only share the result with appropriate
contacts such as the head teacher and named nominated person. We will not tell
any unauthorised person (that is anyone not involved in the recording of test
results) who has received a negative result. Schools and Colleges will not
share negative results with other parents or pupils.
All results – both positive and negative – are shared by us with the Department for
Health and Social Care (DHSC).
DHSC will share results with the NHS to offer advice and support. Results will also
be sent to your GP so they can support you. If you have tested positive, a
notification will be sent to Public Health England to enable them to contact people
who have been in close contact with your child
No. We will not tell anyone that is not directly involved with administrating the test
who has had a test and who has not had a test, or what any of the result
If we have to advise other parents that their child has to isolate due to another
receiving a positive test, we will not identify any individual positive results and you
do not have any rights to know who may have tested positive.
Yes. However, data used for research and statistical purposes by DHSC/NHS will
not use any personal data that can identify your child. Aggregate level data that
wil not identify individuals will be used. This is lawful under UK data protection
Your child’s details will be used to complete testing. As part of testing, details of
pupils and their parents or guardians, as well as staff, may be used for:
• registering your child and recording their participation in the testing
• matching your child’s contact details with health data stored by the NHS
• communicating with you about testing
• contacting you if you are the parent or guardian of someone who is
participating in the Programme
• contacting you with your child’s test results by text message/email
• contacting you relating to your child’s positive or inconclusive result to
collect other medical information about your child’s health relating to
• phoning you to gather feedback to inform improvements that could be made
to a full end-to-end testing process.
We will keep the data used for testing for up to 14 days.
Your child’s information will be passed on to the DHSC who will share this
information with NHS who will keep it for as long as it is required to provide your
child with direct care and to support NHS initiatives to fight COVID-19.
Information held for direct care purposes are stored in line with the Records
Management Code of Practice for Health and Social Care 2016. This means such
information will be held for up to 8 years before it is deleted.