General Data Protection Regular (GDPR) and Freedom of Information (FOI)

The General Data Protection Regulation (GDPR) is a data privacy law that outlines the rights individuals have regarding their personal information processed by organisations and sets out how such organisations must handle personal data.

The Trust has engaged the services of Judicium Education Limited to provide a Data Protection Officer (DPO) service to our schools and colleges, to ensure compliance with the General Data Protection Regulation 2016 and the Data Protection Act 2018.

Judicium is the registered Data Protection Officer for the Trust (from 1st October 2026) with the Information Commissioner’s Office (ICO). Our ICO registration reference is ZA792813. 

The contact details for the Data Protection Officer are as follows:
Judicium Education Ltd., 98 Theobalds Road, London WC1X 8WB / Email: dataservices@judicium.com  

Please quote WMAT in all communications.

These contact details should be included on the school/college website, along with a link to the GDPR information page on the Trust website.

Schools/colleges may receive requests under the Freedom of Information Act and Subject Access Requests. When such requests are received, the Lead GDPR member of staff in each school/college should obtain advice from Judicium regarding the appropriate procedures for handling them. Judicium provides a comprehensive support service as part of the agreement the Trust has with them.

Schools/colleges are required to maintain records of such requests.  These will be recorded by the Lead GDPR member of staff in each school/college on Judicium's online portal.

As part of their service, Judicium also offers GDPR audits to Trust schools/colleges. All schools/colleges will be audited on an agreed schedule. Following the audit, recommendations may be made to ensure the school/college remains compliant with data protection regulations. 

In addition to the advice and support provided by Judicium, the Trust has a suite of GDPR policies to support compliance. These include Fair Processing Notices, also known as Privacy Notices, which are available on the Trust’s website. These are currently being updated to reflect Judicium as the new DPO.

If you: 

• Require GDPR or data protection training,

• Receive a Subject Access Request (SAR),

• Receive a Freedom of Information (FOI) request, or

• Become aware of a potential data breach,

please continue to report this to the GDPR lead within your own school or college in the first instance. They will liaise with Judicium as required.

Protecting personal data remains everyone's responsibility, and we thank you for your continued support in helping us maintain high standards of data protection compliance across the Trust.