he UK General Data Protection Regulation and Data Protection Act 2018: privacy notices Being transparent and providing accessible information to individuals about how you will process their personal data is a key element of UK GDPR and the DPA 2018. The most common way to provide such information is through a privacy notice. Please refer to the ICO website for further guidance on privacy notices. DfE provides suggested wording for privacy notices that local authorities may wish to use. However, where the suggested wording is used, the local authority must review and amend the wording to reflect local business needs and circumstances. This is especially important, as the local authority will process data that is not solely for use within DfE data collections. It is recommended that the privacy notice is made available to data subjects via the internet as well as handed out in paper form or placed on an accessible noticeboard. Privacy notices do not need to be issued on an annual basis as long as new children or young people, parents and staff are made aware of the notices, and they are readily available electronically or in paper format. 8 Legal duties under the UK General Data Protection Regulation and Data Protection Act 2018: data security Providers and local authorities have a (legal) duty under the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018 to ensure that any personal data they process is handled and stored securely. Further information on data security is available from the Information Commissioner’s Office. Where personal data is not properly safeguarded, it could compromise the safety of individuals and damage your organisation’s reputation. Your responsibility as a data controller extends to those who have access to your organi