The Curriculum Network Data Protection Policy
Last reviewed: September 2026
1. Introduction
This Data Protection Policy outlines the principles and procedures adopted by The Curriculum Network to protect the personal information of its members and other individuals whose data we process.
The Curriculum Network is committed to protecting personal information and processing it fairly, lawfully and transparently.
We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
2. Scope
This policy applies to all employees, contractors, volunteers and third-party service providers who have access to personal information processed by The Curriculum Network.
It covers personal information collected and processed in connection with the operation of The Curriculum Network and the services, resources, communications and activities we provide to our members.
3. Responsibility for Data Protection
The Curriculum Network takes responsibility for ensuring that personal information is handled appropriately and in accordance with applicable data protection legislation.
Responsibility for overseeing data protection compliance will be assigned to an appropriate individual within the organisation.
Where required by law, The Curriculum Network will appoint a Data Protection Officer (DPO).
4. Data Collection and Processing
4.1 Purpose
Personal information will only be collected for specified, explicit and legitimate purposes. We will not use personal information for purposes that are incompatible with the reasons for which it was originally collected unless permitted by law.
4.2 Lawful Basis
The Curriculum Network will ensure that it has an appropriate lawful basis for collecting and processing personal information.
Depending on the circumstances, this may include consent, contractual necessity, compliance with a legal obligation, vital interests, performance of a public task or legitimate interests.
Where we rely on consent, individuals will have the right to withdraw their consent.
4.3 Data Minimisation
The Curriculum Network will only collect and process personal information that is adequate, relevant and necessary for the purposes for which it is required.
4.4 Accuracy
Reasonable steps will be taken to ensure that personal information is accurate and kept up to date. Individuals are encouraged to inform The Curriculum Network if their information changes or they believe information held about them is inaccurate.
4.5 Storage and Retention
Personal information will not be retained for longer than is necessary for the purposes for which it is processed.
The Curriculum Network will regularly review the personal information it holds and securely delete or anonymise information that is no longer required.
5. Data Security
5.1 Confidentiality
Personal information will be treated as confidential and will only be accessible to individuals who require access for legitimate purposes.
5.2 Security Measures
The Curriculum Network will implement appropriate technical and organisational measures to protect personal information against unauthorised access, accidental loss, destruction, alteration or disclosure.
This may include encryption and other appropriate security measures when storing or transmitting personal information.
5.3 Access Controls
Access to personal information will be restricted according to job roles and responsibilities. Access permissions will be reviewed where appropriate.
5.4 Third Parties
Where third-party organisations process personal information on behalf of The Curriculum Network, appropriate measures will be taken to ensure that those organisations provide suitable data protection and security safeguards.
6. Individual Rights
Individuals have a number of rights in relation to their personal information under UK data protection legislation.
Depending on the circumstances, these may include:
The right to be informed about how their information is used
The right to access their personal information
The right to have inaccurate information corrected
The right to request deletion of their information
The right to restrict the processing of their information
The right to data portability
The right to object to certain processing
Rights relating to automated decision-making and profiling
The Curriculum Network will respond to requests from individuals wishing to exercise their data protection rights in accordance with the applicable legal requirements.
7. Data Breach Response
The Curriculum Network will maintain appropriate procedures for identifying, assessing and responding to personal data breaches.
Where a breach occurs, we will take appropriate steps to contain and investigate it, assess the potential impact on affected individuals and take action to minimise any potential harm.
Where a breach is likely to result in a risk to individuals' rights and freedoms, The Curriculum Network will notify the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
Where a breach is likely to result in a high risk to affected individuals, those individuals will also be informed without undue delay where required by law.
The Curriculum Network will maintain appropriate records of personal data breaches.
8. Data Protection Complaints
Individuals who have concerns about how The Curriculum Network has collected, used, stored or otherwise processed their personal information have the right to raise a data protection complaint with us.
The Curriculum Network will provide an appropriate and accessible method for individuals to submit data protection complaints.
We will acknowledge data protection complaints within 30 days, investigate them appropriately and communicate the outcome to the individual without undue delay.
Individuals also have the right to raise concerns about the handling of their personal information with the Information Commissioner's Office (ICO).
9. Training and Awareness
Employees, contractors and volunteers who have access to personal information will receive appropriate information, guidance and, where necessary, training on data protection principles and their responsibilities.
The Curriculum Network will promote appropriate awareness of data protection and information security throughout the organisation.
10. Compliance Monitoring
The Curriculum Network will periodically review its data protection practices to ensure that personal information continues to be processed appropriately and in accordance with this policy and applicable legislation.
Any identified non-compliance will be investigated and addressed appropriately.
11. Policy Review
This policy will be reviewed at least annually, or sooner where there are significant changes to legislation, regulatory guidance, our activities or the way in which we process personal information.
Any material changes will be communicated to relevant employees, contractors, service providers and other stakeholders where appropriate.