All agencies that hold personal data must say what they do with it. This is normal in the form of the Fair Processing (or Privacy Notice) which should be placed on your website.
In schools there are a few issues.
Does your Fair Processing notice include all the uses of personal data? Have you included things such as sending a limited amount of data to VLE? Have you recorded the fact that you use the data for data analysis and that teachers could take this home?
Do you know all the uses of personal data? Do any of yours teachers use personal data for things that you do not know about – for example Action Research? A quick survey of some staff and how they work with data should expose any issues.
There are issues with displaying some personal data – the allergies notice on the staff notice board, for example. In these cases you must tell the users what you intend to do? Have you trapped these in your information to parents?
Information for people taking trips also can cause some issues. Because of the nature of these expeditions the personal data that the teachers take with them less secure. Have you told parents what data the teachers will be taking with them and how it will be made secure?
The main point behind all of these is to let people know what you are doing with their personal data. The more you tell them the less chance of an issue.
Mostly Secure 