From 25 May 2018 the law around data protection has changed.
The old Data Protection Act (1998) will be replaced by the new Data Protection Act (2018), which includes the European General Data Protection Regulation and the new European Crime Directive. This will have significant consequences for schools and other organisations.
Guide to the GDPR:
https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/
source: ICO