Privacy Notice – Covid 19 Testing

Privacy notice

Under data protection law, you have a legal right to be told about how our organisation uses any personal information that is held about you. To do with this, we provide a ‘privacy notice’ to you to explain what we do with your data.

This privacy notice explains how we collect, store and use personal data about you.

To enable the Covid-19 testing to be completed at Leigh Academies Trust, we need to process personal data for staff and pupils taking part, including sharing of personal data where we have a legal obligation. 

  • Document title: Privacy Notice – Covid 19 Testing
  • Version number: 1.1
  • Policy Status: Approved
  • Date of Issue: January 2021
  • Date to be revised: January 2023

Leigh Academies Trust is the Data Controller for the data required for processing the tests and undertaking any actions which are needed by the academies to ensure we meet our public health and safeguarding legal obligations. 

Data Controllership is then passed to the Department for Health and Social Care (DHSC) for all data that we transfer about you and your test results to them. For more information about what they do with your data please see the Test and Trace Privacy Notice. The establishment remains the Data Controller for the data we retain about you.


The personal data we hold

We use the following information to help us manage and process the tests:

  • Name
  • Date of birth (and year group)
  • Gender
  • Ethnicity
  • Home postcode
  • Email address
  • Mobile number
  • Unique barcode assigned to each individual test and which will become the primary reference number for the tests
  • Test result
  • Parent/guardians contact details (if required)

Why we use this data

We will only use information that is collected directly from you specifically for the purpose of the tests, even if you have previously provided us with this information.


How we store this data

The information will only be stored securely.  It will also be entered directly onto DHSC digital services for the NHS Test and Trace purposes.   Academies will not have access to the information on the digital service once it has been entered.


Processing of Personal Data Relating to Positive test results 

The member of staff, pupil, student or parent (depending on contact details provided) will be informed of the result by the academy and advised how to book a confirmatory test. 

We will use this information to enact their own COVID isolation processes without telling anyone who it is that has received the positive test.

The information will be transferred to DHSC, who will share this with the NHS, GPs. PHE and the Local Government will use this information for wider test and trace activities as well as statistical and research purposes.


Processing of Personal Data Relating to Negative test results 

We will record a negative result and the information transferred to DHSC, NHS. PHE and the Local Government who will use the information for statistical and research purposes.


Processing of Personal Data relating to declining a test

We will record that you have declined to participate in a test and this information will not be shared with anyone.


Our legal basis for using this data

Personal data relating to tests for pupils is processed under paragraph 7 of the Schedule to the Education (Independent School Standards) Regulations 2014.

Personal Data relating to staff is processed under the legitimate interest of the data controller to ensure we can minimise the spread of COVID in a timely manner and enable us to continue to deliver education services safely and securely.

If you decline a test, we record your decision under the legitimate interest of school in order to have a record of your decisions and to reduce unnecessary contact with you regarding testing.

The processing of information relating to positive and negative test results is processed under the provisions Section 9.2(i) of GDPR, where it is in the public interest on Public Health Grounds. This data is processed under the obligations set out in Public Health legislation (Regulations 3(1) and (4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI)) which allows the sharing of data for COVID related purposes.

This information will be kept by the Leigh Academies Trust for up to 1 month after the testing programme ends and by the NHS for 8 years.


Data sharing

The personal data associated with test results will be shared with 

  • DHSC, NHS, PHE – to ensure that they can undertake the necessary Test and Trace activities and to conduct research and compile statistics about Coronavirus.
  • Your GP – to maintain your medical records and to offer support and guidance as necessary
  • Local Government to undertake local public health duties and to record and analyse local spreads.


Your rights:

Under data protection law, you have rights including:

Your right of access – You have the right to ask us for copies of your personal information. 

Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. 

Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances. 

Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances. 

Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.

Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

If you want to make a request please contact your



We take any complaints about how we collect and use your personal data very seriously, so please let us know if you think we’ve done something wrong.

You can make a complaint at any time by contacting our Data Protection Officer.

You can also complain to the Information Commissioner’s Office in one of the following ways:

  • Report a concern online at
  • Call 0303 123 1113
  • Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF


Contact us

If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact our data protection officer:

● Stephane Vernoux, Group Data Protection Officer,