DfE privacy notice – Report a Cyber Incident

This privacy notice explains how Department for Education (DfE) uses (processes) any personal data you give to us, or any that we may collect about you. This Privacy Notice should be read alongside the DfE Personal Information Charter, this has further information on the standards you can expect when we collect, hold or use your personal information.

For the purposes of relevant data protection legislation, the DfE is the data controller for personal data processed by DfE.

The Report a Cyber Incident Service allows schools to report cyber incidents to DfE. DfE uses information reported through this service to identify trends on types of incidents schools experience, identify iterations that can be made to guidance & support to help schools prevent similar incidents occurring through updates made on the Cyber Security Hub.

Please refer to the DfE’s privacy notices for details of what personal data DfE processes on the Cyber Security Hub, how this is used, and how long this is retained for. The DfE privacy notices relevant to the Hub can be found here:

Section 18 of Privacy Information: Education Providers’ workforce, including teachers

Section 8 of Privacy information: members of the public

Purpose and lawful basis for processing

The lawful basis we rely on for this processing of your personal data is Public Task under article 6(1)(e) of the UK GDPR. This allows us to process personal data when this is necessary to do our work as a government department. This is done under Section 10 of the Education Act 1996 to promote education of the people of England and Wales.

Data we collect

DfE collect and use the following personal information:

Name of individual completing the form
Email Address of the individual completing the form

DfE also collect information about the cyber incident and the affected educational setting to help us assess, respond & report against submitted incidents.

What we do with your data

This data is collected to allow schools to notify DfE of Cyber incidents that they experience.

Personal information collected through this service will be used to document who an incident was reported by and the school affected by the incident. Personal data could also be used we need to contact an individual for further information about an incident that is reported through this service.

We will use data about the incident to prioritise incident severity & escalate where required. We will also complete trend analysis and metric reporting so that DfE have a view on the types of incidents that are affecting schools & educational settings. These reports will be anonymised and shared internally within DfE.

Information collected about incidents via this service will be used to identify possible updates to the Cyber Security Hub to provide additional guidance & resources on commonly reported incidents.

Anonymised data will be shared internally within DfE for reporting purposes only. If an incident needs to be escalated further, a summary of the incident may be shared with external parties (e.g., Police, NCSC) if it is an extremely severe incident which highlighted sever risk to children or members of the public

How long we will keep your personal data

We only keep your personal information for as long as we need it. We decide how long to keep your information based on what we need and what the law says. All data is securely and permanently deleted at the end of the retention period. We call this our retention and disposal schedule.

We keep your personal information for: 10 years

Your rights

We are relying on public task for this processing, this means you have the right to:

be informed about the collection and use of your personal data – this is called the ‘right to be informed’
ask us for copies of the personal information we have about you – this is called the ‘right of access’, also known as a subject access request (SAR), data subject access request (DSAR) or right of access request (RAR)
ask us to change any information you think is not accurate or complete – this is called the ‘right to rectification’
ask us to stop using your information – this is called the ‘right to restriction of processing’
object to us processing your information, in certain circumstances
complain to the Information Commissioner’s Officer (ICO) if you feel we have not used your information in the right way

There are legitimate reasons why we may refuse your information rights request, which depend on why we are processing it.

Data processors

A data processor is an organisation that processes your information on DfE’s behalf. DfE uses a data processor for the following activities:

The Department for Science, Innovation and Technology, through the Government Digital Service (GDS) is a data processor for DfE. GDS provide Gov.UK Forms which DfE uses for the Report a Cyber Incident form. The Gov.UK Forms Privacy Notice explains how personal data is processed through this service.

How to make a subject access request (SAR)

See Requesting your personal information for more on what you’re entitled to ask us, or any of our executive agencies, and your rights about how your information is collected and used.

How to contact us and how to make a complaint

If you would like more information about how we process your personal data or your data protection rights or to contact our Data Protection Officer.

You can contact us in the following ways:

Using our secure online contact form
Or in writing to:

Data Protection Officer

Department for Education

2 St Paul’s Place

125 Norfolk Street

Sheffield

S1 2FJ

If you have any concerns about our use of your personal information, you can make a complaint to the Data Protection Officer at:

Department for Education

2 St Paul’s Place

125 Norfolk Street

Sheffield

S1 2FJ

You can also complain to the ICO if you are unhappy with how we have used your data by writing to:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

Changes to this privacy notice

We may change this privacy notice and we encourage you to check this privacy notice from time to time.

Date last updated: 29th October 2026

Page last reviewed
30 October 2026