This article is a reminder that Microsoft will stop support for both Windows Server 2012 and Windows Server 2012 R2 after October 10th 2023. Keeping software up to date on devices is best practice to help prevent cyber attacks and data breaches.
This article lists the ways that Data Protection Education can be contacted for general data protection queries, data breaches, subject access requests and freedom of information requests.
While all our customers have a dedicated consultant who can be contact directly, if there is an urgent issue we would always advise emailing
When you email
If you email a reply to the original email notification or any updates you received, then the ticket will be automatically be updated and is something we would recommend. If you send a new email to
You could also login to the Knowledge Bank:
https://dataprotection.education/
and update your ticket directly with the information.
How to add a Subject Access Request:
By logging a subject access request on the Knowledge Bank as soon as you receive it, we can guide you through the process and give any additional support and advice.
Login to the Knowledge Bank and go to 'Data Rights Log', select the white text in the title bar. Choose 
on the next screen to add a new data breach log. Then complete as much detail as you can in the data breach form.
You can also report a subject access request by emailing
The ICO says you must keep a record of any personal data breaches, regardless of whether you are required to notify them. Logging those breaches in the DPE Knowledge Bank is a good way of keeping a record that your DPO can access and advise on.
Login to the Knowledge Bank and go to 'Breach Log', select the white text in the title bar. Choose on the next screen to add a new data breach log. Then complete the form with as much detail as you can.
You can can also report a data breach by emailing
By logging a freedom of information request on the Knowledge Bank as soon as you receive it, we can guide you through the process and give any additional support and advice.
Login to the Knowledge Bank and go to 'FOI Log', select the white text in the title bar. Choose on the next screen to add a FOI. Complete as much detail as you can in the form.
You can also raise a ticket to ask for advice about an FOI by emailing
https://dataprotection.education/news-top/news
It is also possible to contact us on: 0800 0862018
The following article talks about how a school thwarted a cyber attack, more through luck than judgement. Our advice is for the whole organisation to be cyber aware and review how your organisation might respond when attacked. The article gives ideas on how to begin making a cyber ready plan.
In October 2020 Kellett School was subject to a ransomware denial-of-service (DoS) attack orchestrated by a Russian criminal hacker group. After the attack, a post mortem diagnostic showed that they had most likely got into the school's system through a member of staff clicking on a link in a phishing email, which, because staff had admin rights to their school devices, installed malware on the school system. The full article can be read here:
Things to note from this attack:
Recommendations:
Further resources can be found in our Information Security best practice area:
https://dataprotection.education/index.php/best-practice-library/best-practice/information-security
and our Cyber Security checklist:
https://dataprotection.education/component/tjucm/itemform/cyber-security?id=90881&cluster_id=114
Incidents or attacks where any security breaches may have taken place, or other damage was caused, should be reported to an external body.
The SLT digital lead will be responsible for assigning someone to report any suspicious cyber incidents or attacks. This person will need to report this to:
You may also need to report to:
You must act in accordance with:
Police investigations may find out if any compromised data has been published or sold and identify the perpetrator.
Preserving evidence is as important as recovering from the crime.
Forward suspicious emails to
This article is linked to a series of articles about different types of Cyber Attacks. They can be viewed in the Information/Cyber Security News section of the Data Protection Education website or as part of the Information & Cyber Security Best Practice Area. Each article discusses a different type of cyber attack, steps to try to minimise the risk and guidance
With the increase in Cyber crime against schools in the UK we are focusing in on what can be done to help prevent cyber crime in a way mangeable for school budgets.
To assign courses to your staff, we should use the to-do functionality via the Course Assignment and Progress Report.
When we assign a to-do via this report, and the user completes the course, the to-do will be automatically marked as complete in the to-do list.
A recent study conducted by Check Point Research which can be found at the bottom of this article has found that there has been a 29% increase in cyberattacks on organisations in the education sector since 2020, the highest increase of any sector.
The National Cyber Security Centre has today upgraded it's advice to schools relating to the prevalence of cybers attacks in the sector:
In light of recent ICO reprimands to schools it is important schools remember best practice for managing photos. The formal legal warnings issued by the ICO recently to schools both related to the processing of photos where no consent had been given.
We've released version 1 of the Compliance Manager tool.
What is it?
The Compliance Manager allows you to assign any document to staff and enable the following interactions
or
Any standard document type can be uploaded and interactions selected. Then select the users to assign the document too and a date by which the users should have responded.
By changing the culture of email use within an organisation will not only benefit the organisation towards GDPR compliance and beyond, it will also save a significant amount of time by reducing staff workload and hopefully support staff wellbeing too.
©2026 Data Protection Education Ltd.