School Staff: Article 14 Disproportionate-Effort Assessment

School Atlas displays publicly available information about school staff (most commonly the head teacher's name, role, and the contact email/phone number published by the school) on school profile pages. Where personal data is obtained from a source other than the data subject themselves, Article 14 UK GDPR ordinarily requires us to provide privacy information to each affected individual within a reasonable period and at the latest within one month. This document records our reliance on the Article 14(5)(b) exemption (provision of that information would involve a disproportionate effort), the conditions we satisfy to use it, and the safeguards we apply.

1. Scope

This assessment covers personal data fields about identifiable school staff that we publish on school profile pages. In practice this is:

Head teacher name and job title (from DfE GIAS — Get Information About Schools).
Head teacher / school office contact telephone and email, where the school itself publishes them as the official contact route.
Inspector names that already appear on the front page of an inspection report (Ofsted, Estyn, Education Scotland, ETI, ISI), reproduced verbatim.
Trustees / governors / charity trustees, where those names are already published by Companies House or the Charity Commission as part of the statutory disclosure regime.

This assessment does not cover: pupils (we never store pupil personal data), parents (Art. 13 applies — we collect their data directly), or our own subscribers and Pro users (Art. 13 applies via the privacy policy).

2. Lawful basis

The lawful basis for processing the staff fields above is Article 6(1)(f) legitimate interests — the legitimate interest of parents in being able to identify the lead contact at a school they are considering for their child, and our own legitimate interest in offering a comprehensive school-search service. We have completed a Legitimate Interests Assessment that concludes the processing is necessary, proportionate, and would not override the data subjects' rights and freedoms because:

The information is already in the public domain — either in a statutory register (GIAS, Charity Commission, Companies House) or on the school's own published contact page.
The role is a public-facing one and the contact details are published precisely so that parents can use them.
We do not enrich, profile, infer, or combine staff data with anything else — we display the public field as-is and link to the source.

3. Why Article 14 applies

The data was not collected from the staff member directly — it was obtained from a public register or the school's own published page. Article 14(1)–(4) therefore requires us to provide each individual with the standard privacy information (controller identity, purposes, lawful basis, recipients, retention, rights, source) within a reasonable period and at the latest within one month, or before the first communication if we communicate with them, or before disclosure to a third party if we disclose.

4. Reliance on Article 14(5)(b) — disproportionate effort

Article 14(5)(b) permits us to dispense with individual notification where doing so “proves impossible or would involve a disproportionate effort …, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes”. Recital 62 expands on this: the “number of data subjects, the age of the data, and any appropriate safeguards adopted” are relevant factors.

We rely on this exemption for the staff fields in scope on the following grounds:

Number of data subjects. The dataset covers the head teacher of every school in the UK (~37,500 schools after the April 2026 NI back-ingest), plus inspectors named on the latest inspection report for each. Sending Art. 14 notices individually — locating verified personal contact details for each subject (which we do not hold — only the school's switchboard) and writing to them — would require an investment grossly disproportionate to the privacy benefit, particularly given the next two factors.
Sensitivity. The data are minimal (name + work title + work contact route already published by the school itself). They are not special-category, not financial, not location-revealing beyond the school address, and not capable of being combined with other fields we hold to identify or profile the individual outside their professional capacity.
Reasonable expectation. A head teacher whose name is published in GIAS, on the school website, on inspection reports, in OFsted/Estyn/Education Scotland/ETI/ISI letters to parents, in local-authority directories, and on the school's own letter heading would reasonably expect that an information-society service that helps parents choose schools would surface that same name. The processing is unlikely to come as a surprise.
No new processing risk. We do not infer further attributes, run AI inference over staff names, build behavioural profiles, or enable users to message staff through our platform. We display, we attribute the source, we link out.

5. Safeguards required by Article 14(5)(b)

Article 14(5)(b) requires that we take “appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available”. Our safeguards are:

This page is the public Article 14 notice — it is linked from the privacy policy, the legal index, the records-of-processing register, and the data-source transparency pages, so any school staff member who wishes to check what we hold can find the relevant notice within two clicks from any school profile.
Source attribution on every record. Every staff field on a school profile carries the source (GIAS, the inspection report, the school website) and the date it was ingested or last refreshed, so the data subject can immediately verify the upstream record and request correction at the source.
Easy correction route. A staff member can email privacy@schoolatlas.co.uk to ask us to remove or correct a field. We respond within 5 working days in practice (well inside the 1-month UK GDPR deadline) and act on the request without requiring formal Subject Access Request paperwork.
Erasure on request. Where a head teacher has left the post, retired, is no longer the lead contact, or objects to the processing, we either remove the field or replace it with the role title only (e.g. “Head Teacher: contact via school office”). The default is to honour the objection rather than litigate it.
No marketing. We do not send marketing email to staff contact addresses, do not enrol them in any list, and do not transmit their contact details to third-party marketing tools or advertising networks. Outbound communications to schools (when we run them) go to the school's switchboard, not to a named individual's inbox.
Refresh cadence. Staff fields are refreshed from upstream sources on the same schedule as the rest of the school profile, so a name change at the source propagates within the next ingest window.

6. Rights you have in relation to staff data we hold

If you are a member of school staff named on a School Atlas profile, you have the rights set out in Articles 15–22 UK GDPR — in particular access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and objection (Art. 21). To exercise any of these rights, email privacy@schoolatlas.co.uk with the school name and the field you would like changed or removed. We will confirm receipt and complete the action within one month. You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint if you are not satisfied with our response.

7. Review and version control

This assessment is reviewed at least annually, and immediately if (a) we begin to ingest a new staff field, (b) we change the lawful basis, (c) we begin to enrich or combine staff data with other attributes, (d) we begin to send marketing to named staff, or (e) the ICO publishes new guidance on Art. 14(5)(b) materially affecting the analysis above.

1. Scope

This assessment covers personal data fields about identifiable school staff that we publish on school profile pages. In practice this is:

Head teacher name and job title (from DfE GIAS — Get Information About Schools).
Head teacher / school office contact telephone and email, where the school itself publishes them as the official contact route.
Inspector names that already appear on the front page of an inspection report (Ofsted, Estyn, Education Scotland, ETI, ISI), reproduced verbatim.
Trustees / governors / charity trustees, where those names are already published by Companies House or the Charity Commission as part of the statutory disclosure regime.

2. Lawful basis

The information is already in the public domain — either in a statutory register (GIAS, Charity Commission, Companies House) or on the school's own published contact page.
The role is a public-facing one and the contact details are published precisely so that parents can use them.
We do not enrich, profile, infer, or combine staff data with anything else — we display the public field as-is and link to the source.

3. Why Article 14 applies

4. Reliance on Article 14(5)(b) — disproportionate effort

We rely on this exemption for the staff fields in scope on the following grounds:

Number of data subjects. The dataset covers the head teacher of every school in the UK (~37,500 schools after the April 2026 NI back-ingest), plus inspectors named on the latest inspection report for each. Sending Art. 14 notices individually — locating verified personal contact details for each subject (which we do not hold — only the school's switchboard) and writing to them — would require an investment grossly disproportionate to the privacy benefit, particularly given the next two factors.
Sensitivity. The data are minimal (name + work title + work contact route already published by the school itself). They are not special-category, not financial, not location-revealing beyond the school address, and not capable of being combined with other fields we hold to identify or profile the individual outside their professional capacity.
Reasonable expectation. A head teacher whose name is published in GIAS, on the school website, on inspection reports, in OFsted/Estyn/Education Scotland/ETI/ISI letters to parents, in local-authority directories, and on the school's own letter heading would reasonably expect that an information-society service that helps parents choose schools would surface that same name. The processing is unlikely to come as a surprise.
No new processing risk. We do not infer further attributes, run AI inference over staff names, build behavioural profiles, or enable users to message staff through our platform. We display, we attribute the source, we link out.

5. Safeguards required by Article 14(5)(b)

This page is the public Article 14 notice — it is linked from the privacy policy, the legal index, the records-of-processing register, and the data-source transparency pages, so any school staff member who wishes to check what we hold can find the relevant notice within two clicks from any school profile.
Source attribution on every record. Every staff field on a school profile carries the source (GIAS, the inspection report, the school website) and the date it was ingested or last refreshed, so the data subject can immediately verify the upstream record and request correction at the source.
Easy correction route. A staff member can email privacy@schoolatlas.co.uk to ask us to remove or correct a field. We respond within 5 working days in practice (well inside the 1-month UK GDPR deadline) and act on the request without requiring formal Subject Access Request paperwork.
Erasure on request. Where a head teacher has left the post, retired, is no longer the lead contact, or objects to the processing, we either remove the field or replace it with the role title only (e.g. “Head Teacher: contact via school office”). The default is to honour the objection rather than litigate it.
No marketing. We do not send marketing email to staff contact addresses, do not enrol them in any list, and do not transmit their contact details to third-party marketing tools or advertising networks. Outbound communications to schools (when we run them) go to the school's switchboard, not to a named individual's inbox.
Refresh cadence. Staff fields are refreshed from upstream sources on the same schedule as the rest of the school profile, so a name change at the source propagates within the next ingest window.

School Staff — Article 14 Disproportionate-Effort Assessment

1. Scope

2. Lawful basis

3. Why Article 14 applies

4. Reliance on Article 14(5)(b) — disproportionate effort

5. Safeguards required by Article 14(5)(b)

6. Rights you have in relation to staff data we hold

7. Review and version control

School Staff — Article 14 Disproportionate-Effort Assessment

1. Scope

2. Lawful basis

3. Why Article 14 applies

4. Reliance on Article 14(5)(b) — disproportionate effort

5. Safeguards required by Article 14(5)(b)

6. Rights you have in relation to staff data we hold

7. Review and version control