A simple way to recognise phishing emails and protect your school from cyber criminals Every day, schools receive hundreds of emails. Most are perfectly legitimate, but hidden among them may be messages designed to deceive staff into revealing confidential information, handing over passwords, transferring money or opening the door to a cyber attack. Phishing is not new, but the methods used by cyber criminals are becoming increasingly sophisticated. Artificial intelligence (A

When a major technology outage hits, schools feel it quickly. Emails stop sending. Staff cannot access shared files. Parents wait for updates that may never arrive. A simple message about lunch, transport, attendance, safeguarding or school closure can become hard to deliver at the exact moment people most need clarity. The recent Microsoft outage is a clear reminder of how connected school operations have become. Many schools rely on Microsoft 365, Outlook, Teams, SharePoint

The Department for Education (DfE) published new guidance on Martyn's Law in education on 3rd November 2026, providing an important opportunity for schools and academy trusts to review their security arrangements and emergency preparedness. In response, Insight MSIG Ltd has updated its School Lockdown & Emergency Preparedness Policy, incorporating the latest guidance alongside existing safeguarding, health and safety, emergency planning and data protection requirements. Why i

Why Schools Are Facing an Unprecedented Surge in Complex SARs, FOIs and Complaints Why Schools Are Facing an Unprecedented Surge in Complex SARs, FOIs and Complaints Is artificial intelligence making it easier to complain than to resolve a complaint? Across schools and academy trusts in England and Wales, a growing administrative problem is emerging. Headteachers, school business managers, governors and Data Protection Officers (DPOs) are increasingly having to deal with leng

There's always something going on in the world that is not so good at the moment, so I thought would offer an article that may amuse some of you out there! Having attended a grammar school many years ago... as a pupil for those who were wondering... I had the rules of clear writing drummed into me from the age of eleven, although I suspect it was happening at primary school too, in readiness for the "King Edward's exam" and Eleven + that we got to take in those long forgotten

Passwords have been part of school life for decades. Teachers use them to access emails, safeguarding systems, management information systems and learning platforms. Pupils use them to access homework, educational resources and online accounts. But could the familiar password soon become a thing of the past? The National Cyber Security Centre (NCSC) certainly believes that passkeys offer a better alternative. In April 2026, it strengthened its recommendation that people shoul

The National Cyber Security Centre has issued an urgent warning about serious vulnerabilities in widely used web technology. For schools and academies, the message goes far beyond installing a software update. Cyber resilience must be part of everyday school management, safeguarding and information governance. A serious warning for organisations across the UK On 21 October 2026, the UK's National Cyber Security Centre (NCSC) published an alert concerning critical security vul

The evolving cyber threat landscape and why schools and academies must rethink their approach to information security. Cybercrime is changing, and schools are increasingly exposed to threats that would have seemed extraordinary just a few years ago. Artificial intelligence, sophisticated ransomware and convincing financial scams have transformed the risks facing educational establishments. For school leaders, governors, trustees and staff, cyber security is no longer simply a

When does a statistic become personal information? Schools and academies regularly receive Freedom of Information (FOI) requests asking for statistical information about pupils, staff, attendance, exclusions, behaviour, special educational needs and other aspects of school life. Many of these requests come from university students, researchers, journalists, campaign groups and members of the public. Most appear perfectly straightforward. The requester wants numbers, not names

A small mistake today could prevent a serious data breach tomorrow. But only if somebody records it, learns from it and takes action. Schools are accustomed to recording accidents, injuries and near misses. A pupil trips over a loose carpet, a member of staff notices a damaged electrical cable, or somebody slips on a wet floor. Even when nobody is injured, the incident may be recorded so that the hazard can be removed before something more serious happens. But what happen

When the police or social services ask for information about a pupil, should schools share it immediately, insist on a warrant, or refuse because of GDPR? For many school staff, an unexpected telephone call from the police or children's social care can create an uncomfortable dilemma. A police officer requests a pupil's home address. A social worker urgently needs attendance information. The Local Authority Designated Officer (LADO) asks for records relating to an allegatio

Why human error, everyday administration and simple mistakes deserve as much attention as cyber security When schools consider the risks of personal data breaches, their thoughts often turn to cyber attacks, ransomware, hackers and sophisticated attempts to gain access to confidential information. These are undoubtedly serious threats, and schools must take appropriate steps to protect themselves. However, some of the most common data protection incidents arise from something

International sharing of personal information: why schools need to know where their data goes, who can access it and what safeguards are in place. When a pupil moves to another country, it is perfectly understandable that their new school may need information about their education, additional needs or safeguarding arrangements. But what about the information that travels overseas without anyone physically leaving the country? Every day, schools use management information syst

The danger of looking without a reason Recent reports of NHS and police personnel being disciplined or dismissed for viewing records without a legitimate work-related reason raise an important question for schools: could the same thing happen to a teacher, administrator or safeguarding professional? The answer is yes. Access to a system is not unrestricted permission to inspect everything within it. Schools hold extensive information about pupils, parents, carers and staff: a

When I first became involved in dealing with Freedom of Information requests at Birmingham City Council, one of the earliest requests I encountered concerned the number of pot plants the Council paid to have placed and maintained in its offices. I remember being tempted to seek clarification from the requester. Did they mean ordinary plants growing in pots, or cannabis plants? Fortunately, common sense prevailed, and I resisted the temptation. It was an amusing introduction t

A small change in a school can have a big effect on personal information. A new behaviour system, a revised safeguarding form, a visitor sign-in process, a parent app, or an AI tool might all change who sees information, where it goes, how long it is kept, and what could happen if something goes wrong. That is where a Data Protection Impact Assessment, or DPIA, helps. Insight has produced Guidance on Producing DPIAs in Schools, a practical document for schools, academies and

Phones are no longer the only device causing policy headaches in schools. Smart watches, camera-enabled glasses and other wearable devices can now be used to message, record, photograph, share information or access online content, often in ways that are less visible than a phone in a pupil’s hand. Insight has produced two new guidance documents to help schools in England review their approach: Mobile Phones in Schools Smart Watches and Smart Glasses in Schools The guidance ha

The UK Government has confirmed that the Information Commissioner’s Office will transition to the Information Commission on 30 September 2026, marking a formal change to the regulator’s governance structure while keeping its current regulatory role in place. The change follows the Data (Use and Access) Act 2025, which introduces a new governance model for the organisation. The ICO has confirmed that its existing functions and responsibilities will continue through the transit

Schools and trusts are seeing more parental emails that read like legal submissions. Some quote FOI, UK GDPR, safeguarding duties, complaints policies and education law in the same paragraph. Some are drafted with AI. Many are long, formal and confident, even when the rights described do not quite fit the situation. That does not mean the concern is invalid. A parent may use the wrong label but still make a valid request. The school’s job is to work out what the parent is rea

Steve Cullen | Insight MSIG | September 2026 Schools do not need to rewrite their whole data protection framework because of the Data (Use and Access) Act 2025. They do need to make sure the parts that have changed are reflected in everyday practice. The Act changes parts of the UK’s data protection regime. It does not replace the UK GDPR or the Data Protection Act 2018. For schools, academies and trusts in England, and maintained schools in Wales, the sensible response is pr