DPO Service Update
For all Schools
Update to the Data Protection Team
We’d like to update you on changes to the Data Protection Team. Our team members are now:
Andrea Kilby, Head of Legal Practice and Compliance, DPO
Mark Agnew, Deputy DPO
Rohini Chandran, Data Protection Paralegal
If you need support or advice relating to data protection, please use the central mailbox schools.data.protection.officer@enfield.gov.uk, which is monitored daily by the data protection team. This will support us to provide you the quickest response possible.
We look forward to meeting you soon.
Data Use and Access Act 2025
From 19 June 2026 organisations are legally required to tell people they can raise a data protection complaint, how to do this and have a process for handling these complaints.
We advise that you use your existing complaints policy to manage this requirement.
Many of your policies will already set out that a complaint is defined as “an expression of dissatisfaction however made, about actions taken or a lack of action”. In relation to data protection this would cover any complaint about the way the school has collected, used, stored, or shared personal data.
We recommend adding to your policy the following wording set out in red, the reason being that should any data protection complaints be related to a cyber incident or complex IT system issue it is unlikely that you will be able to meet your complaints policy deadlines. If you need to extend the time to investigate you will remain compliant with the law which does not have an obligated deadline but requires data protection complaints to be investigated without undue delay and the complainant informed of progress and outcome.
Data Protection Complaints: Under the Data Use and Access Act 2025 we are required to acknowledged data protection complaints within 30 days. Our aim is to do better than this statutory minimum and deal with such complaints in the same timescales as our existing complaints procedure. However, should investigations require a longer timeframe than set out in the complaints policy we commit to ensuring that investigations are completed without undue delay and that we will keep you informed of progress, as per our legal obligation. If you have raised a data protection complaint our final review will remind you that if remain dissatisfied your right to escalate the matter to the Information Commissioner’s Office (ICO). Under the Data Use and Access Act 2025, the ICO will generally expect you to complete the internal complaints process before it will investigate.
Please therefore ensure that any templates for your final stage complaint that relate to data protection complaints include the following:
This letter represents the final position of [school] in relation to your data protection complaint. If you remain dissatisfied, you have a right to appeal to the Information Commissioner’s Office (ICO). The ICO contact details are:
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Tel: 0303 123 1113
Web: www.ico.org.uk
If you have any questions relating to the data protection complaints requirements, either send them by email or feel free to join a Teams drop-in session on Thursday 11 June 2026 between 11 and 11:30am to ask your question.
Microsoft Teams meeting
Join: https://teams.microsoft.com/meet/364110592811550?p=WhGNjONB43ob56yHxP
Meeting ID: 364 110 592 811 550
Passcode: dq6xU3Ft