Privacy & data processors

Three ways to run a DPO

Every school's data controller must register with the ICO, and that public register names its Data Protection Officer — the authoritative source we've used here. Four use an external specialist firm: SchoolPro TLC covers both Cambridge and U-Maths, Judicium covers Imperial, and Data Protection People covers Leeds's trust. King's names King's College London (the University) itself. The rest keep it in-house — Exeter in its finance office, Aston's trust Operations Director, Lancaster's trust at Cardinal Newman College, Surrey's trust. Liverpool names no DPO on its website, yet the ICO register lists the school as its own DPO. Only the two pre-opening schools aren't ICO-registered at all: Durham operates under Durham Sixth Form Centre's registration, and Nottingham's partner trust (East Midlands Education Trust) is registered but doesn't yet list the school.

The MIS map

The student information system is the database that holds the most sensitive pupil records. Three schools share Bromcom — Exeter, King's and Liverpool — a genuine cluster among otherwise-unconnected institutions. Lancaster runs its admissions on CEDAR instead. And although few privacy policies name it, Applicaa (Admissions+) is the de-facto admissions platform across the network: it's named outright by Imperial and Aston, and visible in the application links of Exeter, Cambridge, Liverpool and Surrey (all *.applicaa.com). 1729 is the exception, testing applicants through Atom Learning.

Aston publishes the most candid processor list of anyone — naming not just Applicaa and Microsoft 365 but the Plaude AI note-taker, ONVU classroom-observation cameras and Flashpark ANPR in its car park. It also, unusually, blocks AI crawlers (GPTBot, Google-Extended, PerplexityBot) in its robots.txt.

When the banner doesn't match the page

This is the most consistent finding across the network: what a site loads is often not what its policy discloses. A handful get it right — Exeter (Cookiebot) and Cambridge (Complianz) genuinely gate analytics behind consent, Aston's trackers are consent-gated, and U-Maths avoids third-party analytics entirely by running the first-party AnalyticsWP. But several don't:

• Leeds runs no consent banner at all while firing Google Analytics (two properties), Tag Manager and three separate Meta Pixels.
• Liverpool also has no banner; its generated template policy omits the Meta script that actually loads.
• Imperial's banner is notice-only — GA4, Tag Manager and a Meta Pixel set cookies before any consent, and the cookies page names none of them.
• Lancaster has a proper CookieYes banner, but the site loads a Meta Pixel, LinkedIn Insight, an X/Twitter ads pixel and Google Ads remarketing that the cookie policy never mentions.
• 1729 runs the heaviest stack of all — HubSpot, Meta, Reddit and Google Ads — while its only privacy notice is Mill Hill's group document, which never mentions 1729 or any of these tools.