Just Because You Can Access It Doesn’t Mean You Should

Steve Cullen

Oct 17

5 min read

The danger of looking without a reason

Recent reports of NHS and police personnel being disciplined or dismissed for viewing records without a legitimate work-related reason raise an important question for schools: could the same thing happen to a teacher, administrator or safeguarding professional? The answer is yes. Access to a system is not unrestricted permission to inspect everything within it.

Schools hold extensive information about pupils, parents, carers and staff: attendance, behaviour, family circumstances, health, special educational needs, safeguarding concerns and employment matters. Much of it is sensitive. The fact that an employee can open a record does not mean that opening it is necessary or lawful.

What the Department for Education says

The Department for Education’s Data protection in schools guidance is explicit. Its Responsibilities section says that staff who collect, store or view personal data must make sure they have a legitimate need to process it. The guidance applies across maintained schools, academies and trusts and places responsibility on all staff, not only the data protection officer (DPO).

The DfE’s Managing Breaches of Data section also recognises unauthorised access as a potential personal data breach. It expects schools to recognise, investigate and record incidents and to take appropriate preventative measures. This is not merely an NHS or police issue: the principle is already embedded in school-sector guidance.

A school case: misuse of CPOMS

An especially instructive example is A v Nottinghamshire County Council (Employment Tribunal case 2600413/2023; judgment published in 2025). The case involved a teacher who repeatedly accessed confidential safeguarding records concerning a pupil outside her class, copied information onto a personal computer and memory stick, and shared material with her solicitor in connection with judicial review proceedings.

The tribunal recorded that the teacher accessed CPOMS on 15 separate days during one period and did not log any safeguarding concern about that pupil. The school reported the incident to the ICO and dismissed the teacher. The tribunal rejected the employment claims brought against the council, finding that the dismissal related to the inappropriate use of CPOMS rather than the teacher’s protected beliefs.

The wider dispute involved sensitive and contested issues. The relevant lesson here is narrower: a staff member’s technical access to a safeguarding platform did not authorise repeated inspection and onward use of a child’s confidential information for an unrelated purpose. Genuine safeguarding concerns should be raised through appropriate channels, not used as a blanket justification for browsing records.

A warning from children’s services

In July 2026, the ICO reported that a Herefordshire Council employee in its Children and Young People directorate had unlawfully accessed approximately 490 records and downloaded 94 documents over four days. The records included sensitive information about children and families known to him. He pleaded guilty to an offence under section 1 of the Computer Misuse Act 1990 and received a suspended prison sentence.

This was a local authority case, not a school case, but the parallel is clear. Employees entrusted with sensitive information must use their access only for authorised purposes. The consequences can extend beyond internal disciplinary procedures.

What the ICO has found in education

In September 2025, the ICO published an analysis of 215 education-sector personal data breach reports involving insider attacks between January 2022 and August 2024. It reported that 23% involved poor data protection practices, including staff accessing or using data without a legitimate need, unattended devices and pupils using staff devices. It also identified problems with permissions and account security.

The 23% figure must not be presented as the proportion of school staff who snoop: it combines several kinds of poor practice and relates to a particular set of reported incidents. Nevertheless, it confirms that inappropriate internal access is a recognised education-sector risk.

Everyday situations that schools should recognise

Imagine an administrator checking the attendance of a neighbour’s child, a teacher reading the safeguarding history of a pupil they do not teach, or an employee opening a colleague’s personnel file out of curiosity. Even if nothing is printed, downloaded or passed to anyone else, the access itself may be improper.

Equally, schools must not create barriers to legitimate safeguarding work. A teacher who needs information to protect a child or fulfil a pastoral responsibility may have a proper reason to access it. The key question is whether the particular access was necessary and authorised for that professional purpose, not merely whether the user had a password.

The legal and employment implications

The UK GDPR requires personal data to be processed lawfully, fairly and transparently, for specified purposes, and with appropriate security. Access should be limited to what is necessary for legitimate duties. Schools, as controllers, must adopt suitable organisational and technical measures; individual employees must follow lawful instructions and confidentiality requirements.

Improper access can lead to disciplinary action, including dismissal where justified by the facts and a fair process. Depending on the circumstances, offences under section 170 of the Data Protection Act 2018 or the Computer Misuse Act 1990 may also be relevant. However, not every inappropriate viewing is automatically a criminal offence, nor is every incident reportable to the ICO.

A suspected breach should be assessed promptly, documented, and reported to the ICO within 72 hours of awareness where it is likely to result in a risk to individuals’ rights and freedoms. Affected individuals must be informed without undue delay where the breach is likely to result in a high risk. The school should take advice from its DPO and consider employment, safeguarding and criminal matters separately.

Practical action for school leaders

Schools should review access rights to management information, safeguarding, HR and other systems so that permissions match actual roles. Where possible, use role-based controls, audit trails and proportionate reviews of unusual access. Staff should understand that audit logs may show which records they have opened, subject to appropriate transparency and monitoring arrangements.

Codes of conduct, confidentiality policies and staff training should explicitly prohibit browsing information about relatives, neighbours, colleagues or high-profile incidents without a genuine professional reason. Training should distinguish authorised safeguarding access from curiosity, and explain how to report concerns or suspected misuse.

Finally, ensure there is a clear route for reporting and investigating suspected misuse, with proper preservation of evidence, appropriate confidentiality and fair disciplinary procedures. The DPO advises on data protection obligations; senior leaders and governors or trustees must ensure the school has the resources and management arrangements to meet them.

The message for every member of staff

Information governance is not simply the responsibility of the DPO or the IT team. It is part of everyday professional conduct. The most useful question before opening a record is straightforward: “Do I need this information to do my job or protect someone, and am I authorised to see it?”

If the answer is no, do not open it. A school’s trustworthiness depends not only on preventing outsiders from getting in, but also on ensuring that those already inside use information responsibly.