School website GDPR compliance boils down to a few clear duties: tell people what data you collect, get consent where needed, and keep everything secure. Here is your visual checklist for getting it right.
Your GDPR compliance checklist
Privacy notice
Publish a clear, plain-English privacy notice explaining what data the website collects, why, and how long it is kept. Link it from every page footer so it is never more than a scroll away. Review it whenever you add new forms or tools, because each new feature can change what you collect.
Photo consent
Keep written consent for every child pictured on the site, review it at least annually, and remove photos promptly when consent is withdrawn. Maintain a simple register linking each published photo to its consent record, so any staff member can verify status in seconds.
Cookie control
Use a proper consent banner letting visitors accept or reject non-essential cookies, rather than a vague notice that cookies exist. Analytics, embedded videos and social feeds all set cookies, so your banner must cover them honestly and remember choices.
Secure forms
Contact, admission and trip forms must use encryption, collect only the fields genuinely needed, and state how long data is retained. Test that submissions go to the right inbox and that old entries are deleted on schedule, not hoarded indefinitely.
Three steps to get compliant
Step 1: Audit your data
List everything the website collects: contact forms, analytics, newsletter signups, photos and any third-party embeds. For each item, note the lawful basis and retention period. Most schools are surprised by how much has accumulated unnoticed.
Step 2: Fix notices and consent
Update privacy notices in plain language, install proper cookie consent, and trim every form to only essential fields. Check that consent checkboxes are never pre-ticked and that withdrawing consent is as easy as giving it.
Step 3: Train and review
Make one person responsible for website data protection, train everyone who publishes content on the basics, and schedule an annual review. Compliance decays quietly, so calendar reminders beat good intentions.
Key takeaway: GDPR compliance is mostly good housekeeping: know what you hold, tell people about it, keep it minimal and keep it secure.
Can we use Google Analytics?
Yes, with proper visitor consent and privacy-friendly settings. Declare it clearly in your cookie banner and privacy notice, and consider whether you truly need the data it collects.
What about parent email lists?
You need a lawful basis for every list and clear unsubscribe options on every message. Keep records of consent for marketing emails, and separate them from operational communications.
Who is responsible?
Your data protection officer oversees compliance, but everyone who publishes website content shares the duty. Make responsibilities explicit, not assumed.
Ready to grow?
We build school websites with GDPR baked in from the start: proper consent flows, secure forms and clear notices. Firm fixed price once we understand your project.
