March 2026
Introduction
As an education professional, it is likely you will regularly need to handle personal and sensitive data about the learners and young people you work with, as well as data involving parents/guardians and colleagues. Due to this responsibility, it is vital that you take all reasonable steps to keep this information secure, and protect its confidentiality where you are expected to do so. This includes ensuring that you understand and follow your organisation’s internal systems, policies, training, and data protection requirements.
Maintaining confidentiality is key to you building accountability and trust as an education practitioner. Whether data is shared with you, or you collect it in order to fulfil your specific professional duties, data subjects will assume you will handle their information correctly. A breach of confidentiality may also damage the public’s confidence in all education professionals, not just you.
This guide explains how registrants should ensure confidential information and data is managed securely, lawfully, and fairly.
This is not regulatory or mandatory guidance and it is not intended to cover every aspect of data protection and confidentiality. Scenarios have been included to help you think about and explore some of the issues which might arise, and how our advice might apply. We have also included examples of unacceptable practices where confidentiality has been breached.
The Code
All Education Workforce Council (EWC) registrants are subject to the Code of Professional Conduct and Practice (the Code), which sets out the key principles of good conduct and practice expected of registrants. This guide should be read in conjunction with the Code.
The principles and expectations in the Code which refer to maintaining confidentiality are:
- Professional Integrity
Registrants:
2.3 handle information and data appropriately, applying the necessary protocols to matters relating to confidentiality, sensitivity, and disclosure
The Code is an important point of reference. Think about the six key principles and the expectations they place upon you. The Code will help you make the right decisions when faced with the challenges covered in this guide.
Maintaining confidentiality in practice
Data protection law
All registrants are required to comply with data protection legislation. The General Data Protection Regulation (GDPR) sets out the main responsibilities for handling personal and special category data. Guidance relating to GDPR can be found on the Information Commissioner’s Office (ICO) website.
In addition, to support the expectations set out in the Code, the following key points of advice and general guidance should help you, as an education practitioner and EWC registrant, maintain confidentiality in your day-to-day practice.
Collecting and recording data
Before collecting any data, think about why you are doing it – what purpose are you aiming to fulfil? It is important that you only collect data that is relevant to your role, and in line with your employer’s guidance.
Ensure that the records you keep are accurate. Record information factually, avoiding any personal opinions.
The data you collect should be recorded in official systems, and you should not use personal devices to store it.
Data should only be kept for a long as is necessary. When data is no longer required to be kept, you should ensure it is destroyed or disposed of responsibly, in line with your employer’s data retention policy
Keeping information safe
As a registrant, you should take all reasonable steps to ensure the confidential information you hold is protected against unauthorised access, destruction, and damage. All confidential information should be stored safely, whether it is physical or electronic.
For physical information, ensure documents are stored securely, in locked cabinets or secure areas, and never leave documents unattended in public spaces.
Electronic files should be password protected or encrypted, and when sending information electronically you should use secure email or file transfer systems.
Do not share logins or store data on personal USB sticks or cloud accounts.
Information sharing
Before sharing any confidential data, make sure you follow guidelines and protocols for doing so, and that:
- sharing is necessary and proportionate
- you only share the data necessary
- you have any required consent before doing so
You should only share information with authorised people who have a legitimate reason to access it. In addition, you should always verify the recipient’s identity before sharing.
Record why data was shared and with whom.
Confidential conversations
Conversations which include confidential information should be held in private spaces, not in corridors, cafés, shared offices, or public places. Be mindful about who may be able to overhear your conversations.
Restrict such conversations to professional settings where possible.
Outside of the workplace
The expectation of maintaining confidentiality is not restricted to the workplace. Similarly, the standards expected of you do not change if you are interacting with others using social media or other virtual communications.
In particular, do not discuss learners, young people or internal, confidential matters on personal social media or messaging apps.
Disclosure
There may be occasions where a confidential disclosure is made to you by a learner or young person, or shared with you by a third party and you must act because, for example, it relates to a safeguarding concern.
In such circumstances, it is important you carefully follow relevant guidelines and protocols, for example, the Wales Safeguarding Procedures, before doing anything. This is particularly important as you may need to share information without consent, especially where seeking consent would increase the risk of harm. Protecting a person from serious harm, such as abuse or neglect is a priority over consent in such situations.
Use formal data-sharing agreements or referral procedures where you are expected to do so.
What if things go wrong?
If you think you have been involved in some form of data breach, however small, seek advice and support at the earliest possible stage from your line manager and/or Data Protection Officer.
It is important that you are open and honest, and do not attempt to cover up what has happened.
If required, your employer may need to notify the Information Commissioner’s Office quickly so you will need to provide the full facts surrounding the breach from the outset.
Breaches of the Code
The examples below are illustrative of cases where registrants (from all the registrant categories), have been subject to EWC disciplinary proceedings as a result of breaching confidentiality.
In all cases, there has been a clear breach of the Code and the registrants received a range of disciplinary sanctions including, in some cases, being prohibited from practicing in the education workforce in the future.
A registrant:
- was overheard discussing a learner during a café conversation
- uploaded videos of learners sharing personal information on the school’s SeeSaw app
- shared personal information with a learner and discussed other learners and colleagues
- informed a parent of confidential staff discussions
- emailed a class list, which included learners’ personal information, to an incorrect recipient
- shared a photograph with a parent which contained an image of another child
- provided their work login and password details to a temporary member of staff
Further support
We offer presentations which focus on fitness to practise and the Code. If you or your employer would like to arrange one in the workplace, please contact us.