Lancashire Virtual School

To comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.

Contact details of this Lancashire County Council service:

Note that for queries intended for this specific service, do not contact the Data Protection Officer (DPO) mailbox, instead please direct your query to the following point of contact:

Virtualschool@lancashire.gov.uk

Reasons for processing your personal data

The Lancashire Virtual School exists to promote the educational achievement and progress of children looked after (CLA), previously looked-after children (PLAC), and children with a social worker (CWSW). It fulfils the local authority’s statutory duties by:

  • Maintaining oversight of the education of these cohorts, including monitoring attendance, attainment, and progress.
  • Supporting schools, carers, and professionals through advice, training, and challenge to ensure high-quality Personal Education Plans (PEPs) and effective interventions.
  • Managing and allocating Pupil Premium Plus funding to improve educational outcomes.
  • Working in partnership with education settings, social care, and other agencies to remove barriers to learning and raise aspirations.
  • Providing strategic leadership and data analysis to inform policy and practice for vulnerable learners.

The service does not operate as a physical school but acts as a central team coordinating support and resources to ensure every child has access to suitable education and opportunities to achieve their potential.

As part of these activities, we may share relevant personal data with trusted partners involved in Virtual School programmes, including:

  • The Dollywood Foundation (for the Imagination Library book gifting scheme).
  • Storytime Magazine (for literacy and reading engagement initiatives).

These organisations receive only the minimum data necessary to deliver these services and are contractually required to comply with data protection legislation.

Use of artificial intelligence (AI) technologies

We are increasingly utilising AI technologies to process your personal data. This is primarily utilised within Lancashire County Council using Microsoft Copilot Web and Microsoft Copilot 365. Please consult our Artificial Intelligence privacy notice for more details of how we use these specific platforms.

We do not use AI to make automated decisions. There is always a human intervention to review and approve any outputs from the AI tools. Decisions are not made solely by automated means.

Legal basis for processing personal data

The legal basis for processing your personal data, in accordance with the UK GDPR Article 6 is:

(e) Public Task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law. We will cite the applicable task/function and its' basis in law if we wish to rely on this basis for processing.

This basis applies because the Virtual School performs statutory duties on behalf of Lancashire County Council to promote the educational achievement of looked-after children, previously looked-after children, and other vulnerable groups. These duties are set out in legislation such as:

  • Children Act 1989, as amended by the Children and Families Act 2014 and Children and Social Work Act 2017
  • Education Act 1996, Section 19
  • Care Planning, Placement and Case Review Regulations 2010
  • Statutory guidance on promoting the education of looked-after children and previously looked-after children (2017)

Legal basis for processing special categories of personal data

The legal basis for processing special categories of personal data relating to you, in accordance with the UK GDPR Article 9 is:

(g) Processing is necessary for reasons of substantial public interest.

This is supported by Schedule 1, Part 2 of the Data Protection Act 2018, which includes conditions such as:

  • Safeguarding of children and individuals at risk
  • Statutory and government purposes
  • Equality of opportunity or treatment

These conditions apply because the Virtual School’s role is to promote educational outcomes for looked-after and previously looked-after children, and children with a social worker, which is a statutory duty under the Children Act 1989, Children and Families Act 2014, and Children and Social Work Act 2017.

Legal basis for processing criminal offence data

Our service will process criminal offence data where we have a legitimate requirement to do so. Where we process such data, we will rely on the following legal basis to do so:

Data Protection Act (2018) Schedule 1

For Lancashire Virtual School, this means:

Processing is permitted because the local authority acts under official authority and statutory duties set out in UK law, such as the Children Act 1989, Children and Families Act 2014, and Children and Social Work Act 2017.

Any processing of criminal offence data must be necessary for fulfilling these duties (e.g., safeguarding, education planning for looked-after children).

Information we process about you

To deliver the Lancashire Virtual School service and meet our statutory duties, we may collect and process the following categories of personal data:

  1. Personal Identifiers and Contact Details
  • Name, date of birth, gender
  • Unique identifiers (e.g., pupil ID, NHS number)
  • Address, telephone number, email address
  1. Education and Attendance Information
  • School or education setting details
  • Personal Education Plans (PEPs)
  • Attendance records, exclusions, attainment and progress data
  • Special Educational Needs (SEN) status and support plans
  1. Social Care and Placement Information
  • Looked-after child status and care arrangements
  • Social worker details and involvement
  • Foster carer or placement provider details
  1. Health and Wellbeing Information
  • Information relating to physical or mental health where relevant to educational support
  • Disability and accessibility need
  1. Safeguarding and Support Information
  • Risk assessments and safeguarding concerns
  • Multi-agency support plans
  1. Financial Information (where applicable)
  • Details relating to Pupil Premium Plus or other funding allocations

Special Category Data We may process special category data such as:

  • Health information (physical or mental health)
  • Ethnicity and language
  • Information relating to SEN or disability

This information is collected from schools, social care teams, health professionals, and other relevant agencies to ensure appropriate educational support and fulfil our legal obligations under the Children Act 1989, Children and Families Act 2014, and related statutory guidance.

Recipients of the personal data that we process about you

To deliver our statutory duties and support the education of looked-after children, previously looked-after children, and children with a social worker, Lancashire Virtual School may share personal data with:

  • Education providers: Schools, academies, colleges, early years settings, and alternative education providers to ensure appropriate educational support and planning.
  • Local authority teams: Other Lancashire County Council departments such as Children’s Social Care, SEND services, and Education Improvement teams for safeguarding and service coordination.
  • Social workers and carers: Including foster carers, adoptive parents, and guardians to support the child’s education and welfare.
  • Government bodies: The Department for Education (DfE) for statutory returns, performance monitoring, and funding purposes.
  • Health services: NHS and other health professionals where necessary for meeting special educational needs or safeguarding requirements.
  • Third-party service providers: Organisations commissioned to deliver educational support, training, or data collection (e.g., attendance monitoring systems).
  • Regulatory and inspection bodies: Such as Ofsted, where required by law.
  • Other local authorities: When a child resides or attends school outside Lancashire, to ensure continuity of education and care.

All recipients are bound by data protection legislation and contractual obligations to keep your information secure and use it only for lawful purposes

Any transfers to another country

  • Yes – specifically for the provision of the delivery of the Dollywood Foundation work, The Dollywood Foundation UK's servers are situated in the USA

Retention periods

Lancashire County Council will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice.

File type Description Security Retention period

Personal Education Plan (PEP) files

Records of PEP meetings, targets, and progress for looked-after children.

Encrypted storage, role-based access controls.

Until child reaches age 25 (in line with statutory guidance).

Attendance records

Daily and termly attendance data for monitoring educational engagement.

Secure database with restricted access.

6 years after case closure.

Safeguarding records

Information relating to child protection concerns and actions taken.

Encrypted storage, multi-factor authentication for access.

Until child reaches 25 or longer if required for legal purposes.

Communication logs

Emails, meeting notes, and correspondence with schools, carers, and professionals.

Secure email archive and document management system.

6 years after case closure.

Your rights

You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are those rights:

  • to be informed via Privacy Notices such as this.
  • to withdraw your consent. If we are relying on your consent to process your data, then you can remove this at any point.
  • of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this, we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
  • of rectification, we must correct inaccurate or incomplete data within one month.
  • to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
  • to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
  • to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
  • to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
  • in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights, then you can do so by contacting:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ

Email: dpo@lancashire.gov.uk

To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.

Identity and contact details of the data controller

  • Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Contact details of the data protection officer

  • Our Data Protection Officer is Joanne Winston. You can contact her at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Further information

For more information about how we use personal information see Lancashire County Council's full privacy notice.

If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).