Introduction

1.1 Purpose of this Policy

Providence English Private School (PEPS) collects and uses personal data about students, parents, staff and visitors in order to run the school safely and effectively. This policy explains what personal data we collect, why we collect it, how it is kept secure, who it may be shared with, and the rights individuals have over their own data.

1.2 Scope

This policy applies to all personal data processed by PEPS, in any format, relating to current and former students and their families, staff, governors, volunteers, contractors and visitors.

1.3 Our Commitment

Legal Framework

This policy is written with reference to the personal data protection legislation applicable in the United Arab Emirates:

• Federal Decree-Law No. (45) of 2021 on the Protection of Personal Data (the “PDPL”), the UAE's comprehensive data protection law, which sets out the rules for collecting, processing, storing and sharing personal data, and the rights of data subjects.
• Federal Decree-Law No. (44) of 2021 establishing the UAE Data Office, the federal authority responsible for the PDPL's implementation and oversight.
• Federal Law No. (3) of 2016 concerning Child Rights (Wadeema's Law), which reinforces the need for particular care when handling children's personal data and safeguarding information.
• The National Child Protection Policy in Educational Institutions in the UAE, which sets confidentiality requirements for child protection records held by schools.

Note: the PDPL does not apply to government data, and certain categories of health data are separately regulated; where PEPS holds health data (for example, in the school clinic), it is handled with the same care as other sensitive personal data described in this policy, alongside any sector-specific requirements.

Key Definitions

Data Protection Principles

PEPS processes personal data in accordance with the following principles:

• Processed fairly, transparently and lawfully.
• Collected for specified, explicit and legitimate purposes, and not further processed in a way incompatible with those purposes.
• Adequate, relevant and limited to what is necessary for the purposes for which it is processed.
• Accurate, and kept up to date where necessary.
• Kept in a form that permits identification of the data subject for no longer than necessary for the purposes for which it is processed.
• Processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing, accidental loss, destruction or damage.

What Personal Data We Collect

How and Why We Use Personal Data

PEPS processes personal data for the following purposes, on the following legal bases under the PDPL:

• To provide education, pastoral care and support — necessary for the performance of the school's contract with parents, or to protect the vital interests of the student.
• To meet our legal and regulatory obligations, including reporting to the Ministry of Education, SPEA, and, where required, child protection or law enforcement authorities — necessary to comply with a legal obligation.
• To keep students safe, including safeguarding and health and safety records — necessary to protect the vital interests of the student, or the public interest in student welfare.
• To communicate with parents about their child's progress, conduct and school life — necessary for the performance of the school's contract with parents.
• To administer external examinations, in accordance with Cambridge, Pearson Edexcel, Oxford AQA and JCQ requirements — necessary to comply with a legal/contractual obligation to the awarding bodies.
• To promote the school, including through photographs and stories on the school website, portal or social media — based on consent, which may be withdrawn at any time (see Section 8).
• To manage staff employment — necessary for the performance of the employment contract and compliance with UAE labour law.

Sharing Personal Data

PEPS shares personal data only where necessary, and only with the following categories of recipient:

• The UAE Ministry of Education and the Sharjah Private Education Authority (SPEA), for regulatory, licensing and inspection purposes.
• Cambridge International Examinations, Pearson Edexcel, Oxford AQA and the Joint Council for Qualifications (JCQ), for the administration of external examinations.
• The Ministry of Education's Child Protection Unit, the Sharjah Child Protection Centre, the Ministry of Interior, and the Police, where necessary to protect a child's safety, in accordance with the Child Protection & Safeguarding Policy.
• School transport providers, medical clinics and other service providers, strictly for the purpose of delivering the relevant service to students.
• A student's next school, where a student transfers, to support a smooth and safe transition.
• Professional advisers (such as legal or insurance providers), where necessary.

PEPS does not sell personal data, and does not share personal data with third parties for their own independent marketing purposes.

Photography and Images

• Parental consent is obtained at admission, and may be reviewed periodically, for the use of a student's photograph or video in school publications, the school website, the school portal, and official school social media accounts.
• Parents may withdraw this consent at any time by notifying the school office in writing; the school will stop using new images of the student from that point, though it may not always be practical to remove images from previously distributed printed materials.
• Photography and videography by parents at school events is a matter of courtesy between families; parents are asked not to publish images of other people's children on personal social media without that family's consent.

Data Security

• Access to personal data is restricted to staff who need it to carry out their role, with additional restrictions on the most sensitive records (safeguarding, medical, and disciplinary data).
• Electronic records are held on password-protected systems, with access rights reviewed periodically; paper records are stored in locked cabinets or rooms.
• Staff receive guidance on handling personal data responsibly as part of their induction, including not sharing login credentials, and not storing school data on personal, unsecured devices.
• Contracts with third-party service providers (such as the school portal or transport provider) require them to protect personal data to a standard consistent with this policy.

Data Retention

Personal data is kept only for as long as necessary for the purposes described in this policy, taking account of legal and regulatory requirements:

• Core student academic and admission records are retained for the duration of a student's enrolment and for a defined period after they leave, to support future reference requests (such as transcripts or references).
• Safeguarding records are retained in accordance with the Child Protection & Safeguarding Policy and applicable legal requirements, and are transferred securely to a student's next school where doing so is in the child's best interests.
• External examination records (entries, results, certificates) are retained in accordance with the retention periods set out in the school's External Examinations Policies (for example, certificate records are kept for 4 years, per JCQ requirements).
• Staff employment records are retained in accordance with UAE labour law requirements.
• CCTV footage is retained for a limited period, and reviewed only where necessary for security or safeguarding purposes.

Data Subject Rights

Under the PDPL, individuals (or, for a student, their parent/guardian on their behalf, subject to the student's own evolving capacity) have the right to:

• Access the personal data the school holds about them, and information about how it is processed.
• Request correction of inaccurate or incomplete personal data.
• Request erasure of personal data, where the school is not required to retain it for a legal, regulatory or legitimate purpose.
• Request that processing be restricted in certain circumstances.
• Object to processing based on legitimate interest, or withdraw consent where processing is based on consent (such as use of images, see Section 8).
• Request a copy of their personal data in a structured, commonly used, machine-readable format, where technically feasible.

Requests can be made in writing to the school office. The school will respond within a reasonable timeframe, and may need to verify the identity of the requester before releasing information.

If a parent or member of staff is not satisfied with the school's response, they may raise a complaint with the school under the Complaints Policy, or with the UAE Data Office.

Data Breach Procedure

• Any suspected loss, unauthorised access, or unauthorised disclosure of personal data is reported immediately to the Data Protection Lead.
• The Data Protection Lead assesses the severity and risk of the breach, and takes immediate steps to contain it and limit any further exposure.
• Where a breach is likely to result in a risk to individuals' rights, the school notifies the UAE Data Office and, where the risk is high, the affected individuals, in accordance with PDPL requirements and timescales.
• A written record of the breach, its impact and the school's response is maintained.

Roles and Responsibilities

13.1 Principal

Has overall accountability for the school's compliance with this policy and the PDPL.

13.2 Data Protection Lead

• Acts as the school's main point of contact for data protection matters, including data subject access requests and data breaches.
• Advises staff on data protection questions and maintains this policy.
• Maintains a record of the school's data processing activities.

13.3 All Staff

• Handle personal data they encounter in the course of their role responsibly, securely, and only for its intended purpose.
• Report any suspected data breach immediately to the Data Protection Lead.

Monitoring and Review

This policy is reviewed annually by the Data Protection Lead, in consultation with the Principal, and sooner if required by a change in UAE data protection legislation or guidance from the UAE Data Office.

Links to Other Policies

• Child Protection & Safeguarding Policy — the confidentiality and record-keeping requirements for safeguarding data.
• Digital Citizenship Policy — safe and responsible use of technology, including by students.
• External Examinations Policies — retention of examination and certificate records.
• Complaints Policy — how a concern about handling of personal data can be raised.

Categories of Personal Data — Summary

Legislative References

Note: legislative references should be periodically verified against the UAE Data Office's current published guidance.