The EU General Data Protection Regulations 2016 (the GDPR), is new legislation which comes into effect on the 25 May 2018. It is designed to protect and empower European citizens with regard to their data privacy, and places greater obligations and sanctions on organisations that process (e.g. obtain, use, store, share and destroy) personal data.
This legislation applies to schools and other organisations and will continue to do so even now the UK has left the European Union.