(Read this BEFORE sending any letters)

​

This guide explains:

• why the letters exist,

• how the process works,

• what each letter does,

• when to send each letter,

• who to send them to,

• how long replies take,

• what to expect,

• what to do if the school refuses,

• what to do if they try to punish your child,

• where you stand legally,

• and whether letters can be sent together.

This is written in plain English, for real parents, with no jargon.

​

​

⭐ THE TRUTH PARENTS NEED TO KNOW FIRST

​

Schools and trusts have introduced:

• phone bans,

• confiscation policies,

• biometric systems,

• digital behaviour platforms,

• identity systems,

• external data processors,

• automated communication apps,

• behaviour scoring systems,

• retention systems,

​

without giving parents proper legal information or lawful consent forms.

Most parents think these are “just school rules.”

They are not.

They are legal agreements, data‑processing activities, and contract‑based systems — and parents were never properly included.

Your child’s phone is personal property. Your child’s biometric data is sensitive personal data. Your child’s behaviour logs are digital records. Your child’s identity profile is contract‑linked data.

​

Schools cannot:

• confiscate personal property without lawful authority,

• process biometric data without explicit consent,

• process behaviour data without informed consent,

• enforce policies that were never agreed to,

• penalise parents for asserting rights,

• penalise children for a parent’s legal position.

This is why the 8‑letter process exists.

It is not aggressive. It is not confrontational. It is not anti‑school. It is simply parents asserting their rights under:

​

• Consumer Rights Act 2015

• Data Protection Act 2018

• UK GDPR

• Human Rights Act 1998 (Article 8)

• Children Act 1989

• Contract law principles

• Property law principles

• Unfair Terms Regulations

These are public laws, government‑published, non‑political, and fully allowed for parents to use.

​

⭐ THE 8‑LETTER PROCESS — SIMPLE STORY FOR PARENTS

​

Letter 1 — You object.

​

You tell the school:

• I do not accept the phone ban as lawful.

• I do not accept confiscation.

• I do not accept biometric or digital processing without consent.

• Show me the legal authority.

If they refuse, ignore you, or send policy instead of law…

​

Letter 2 — You escalate to the trust.

​

You ask the trust:

• Who approved these systems?

• Who approved biometrics?

• Who approved confiscation?

• Where is the legal authority?

• Where is the parental consent?

If they refuse or ignore you…

​

Letter 3 — You assert the law.

​

You state:

• consent was not informed,

• consent was not freely given,

• consent was not specific,

• therefore enforcement is unlawful.

If they still push…

​

Letter 4 — You demand evidence (SAR).

​

This forces them to reveal:

• every system used,

• every behaviour log,

• every biometric record,

• every external processor,

• every retention period.

If they escalate…

​

Letter 5 — You remove their power (Deletion Demand).

​

This legally forces deletion of:

• identity data,

• behaviour logs,

• biometric data,

• phone‑related incidents.

Once deleted, they cannot enforce anything digitally.

If they still push…

​

Letter 6 — You block all processing (Consent Withdrawal).

​

Processing must stop immediately.

If they still push…

​

Letter 7 — You expose everything (Plain‑English Request).

​

This forces them to rewrite:

• policies,

• contracts,

• system descriptions,

in plain English.

If they STILL push…

​

Letter 8 — You unite parents (Collective Action).

​

This shuts the policy down.

Schools cannot fight organised parents.

​

⭐ WHEN TO SEND EACH LETTER (VERY CLEAR)

​

Letter 1 — Send immediately.

​

This starts the process.

​

Letter 2 — Send ONLY if Letter 1 is ignored or refused.

​

Letter 3 — Send ONLY if Letter 2 is ignored or refused.

​

Letter 4 (SAR) — You have TWO options:

Option A — Send SAR at the correct escalation point (after Letter 3).

​

This is the standard path.

​

Option B — Send SAR at the same time as Letter 1.

​

Parents CAN do this if they want to know:

• which vendors have their child’s data,

• which systems are used,

• what biometric data exists,

• what behaviour logs exist,

• what external processors exist.

This is allowed.

​

Letter 5 (Deletion Demand) — You have TWO options:

​

Option A — Send after SAR reply.

​

This is the standard path.

​

Option B — Send at the same time as SAR.

​

Parents CAN do this if they want to:

• force deletion early,

• block digital enforcement immediately,

• remove behaviour logs,

• remove biometric data,

• remove identity tokens.

This is allowed.

​

Letter 6 — Send if they still push after deletion or SAR.

​

Letter 7 — Send if they still push after consent withdrawal.

​

Letter 8 — Send if they STILL push after everything.

​

⭐ CAN PARENTS SEND MULTIPLE LETTERS AT ONCE?

​

✔ YES — SAR + Deletion Demand can be sent together.

​

This is common and effective.

​

✔ YES — SAR + Consent Withdrawal can be sent together.

​

This blocks all processing immediately.

​

✔ YES — Letter 1 + SAR can be sent together.

​

This gives parents early access to data.

​

❌ NO — Do NOT send all 8 letters at once.

​

It removes the escalation power.

​

⭐ HOW LONG THEY HAVE TO REPLY (EXPANDED)

​

Letter 1 & Letter 3 (School)

​

5–10 working days Schools usually reply quickly because these letters challenge their authority.

​

Letter 2 (Trust)

​

10–20 working days Trusts take longer because they need legal input.

​

Letter 4 (SAR)

​

30 days — legally required They cannot delay. They cannot refuse. They cannot ignore. They must provide:

• all data,

• all systems,

• all vendors,

• all processors,

• all retention periods.

​

Letter 5 (Deletion Demand)

​

Within 30 days They must delete:

• identity data,

• behaviour logs,

• biometric data,

• external processor copies.

​

Letter 6 (Consent Withdrawal)

​

Processing must stop immediately. Confirmation usually within 10–20 days.

​

Letter 7 (Plain‑English Request)

​

20–30 days They must rewrite policies clearly.

​

Letter 8 (Collective Action)

​

Within 10 days Schools respond fast when multiple parents act together.

​

⭐ WHO TO SEND LETTERS TO (EMAIL IS BEST)

​

Email is legally valid.

​

It is:

• timestamped,

• traceable,

• easy to escalate,

• easy to prove.

​

Letter 1

​

Headteacher Deputy Head School Admin Office Behaviour Lead (optional)

​

Letter 2

​

Trust CEO Trust Governance Team Trust Data Protection Officer Trust Complaints Email

​

Letter 3

​

Headteacher Trust Governance Team Trust Data Protection Officer

​

Letter 4 (SAR)

​

Trust Data Protection Officer School Data Protection Officer

​

Letter 5 (Deletion Demand)

​

Trust Data Protection Officer School Data Protection Officer

​

Letter 6 (Consent Withdrawal)

​

Headteacher Trust Governance Team Trust Data Protection Officer

​

Letter 7 (Plain‑English Request)

​

Trust Governance Team Trust Legal/Compliance Team

​

Letter 8 (Collective Action)

​

Headteacher Trust CEO Trust Governance Team Trust Data Protection Officer

​

⭐ WHAT IF THEY TRY TO PUNISH THE PARENT OR CHILD?

​

They cannot. Legally. At all.

​

Punishing a child because a parent asserted legal rights is victimisation, which is unlawful under:

• Equality Act 2010

• Human Rights Act 1998 (Article 8)

• Children Act 1989

• Education Act principles

• Safeguarding rules

​

Punishing a parent for asserting legal rights is also unlawful.

If they try:

• the punishment becomes invalid,

• the behaviour record becomes invalid,

• the sanction becomes invalid,

• the policy becomes unenforceable,

• the trust becomes legally exposed.

​

You then escalate to:

• Trust complaint

• Governor complaint

• Local authority

• ICO (if data involved)

• DfE

• Ofsted (if safeguarding breached)

Schools almost NEVER escalate once parents reach Letter 4.

​

⭐ WHERE THE PARENT STANDS LEGALLY

​

Parents stand on:

• Consumer Rights Act 2015

• Data Protection Act 2018

• UK GDPR

• Human Rights Act 1998

• Children Act 1989

• Contract law principles

• Property law principles

• Unfair Terms Regulations

​

Schools stand on:

• internal policy

• trust rules

• behaviour frameworks

​

Internal policy cannot override statutory law.

Parents are legally protected. Children are legally protected. Schools cannot retaliate.

⭐ NOW WE BEGIN THE LETTERS

⭐ LETTER 1 — PARENT OBJECTION LETTER (PHONE BAN + BIOMETRICS + SYSTEMS)

​

To: Headteacher and Chair of Governors / Trust Board

​

Subject: Formal objection to phone ban, biometric use, and digital behaviour systems

​

Dear [Headteacher / Chair],

​

I am writing to formally object to the school’s mobile phone ban, the confiscation of my child’s personal device, and any use of biometric or digital behaviour systems applied to my child without my informed consent. This letter is to put you on notice that I do not accept the legal validity of these practices as currently implemented.

Under the Consumer Rights Act 2015, any term that restricts or removes a consumer’s personal property must be fair, transparent, and agreed to. I have not been presented with any clear, written agreement that lawfully authorises the school to confiscate my child’s phone, retain it, or impose sanctions linked to its possession or use. My child’s phone is personal property, and neither my child nor I have entered into any contract that permits the school to interfere with that property in the way current policy suggests.

Under UK common law and basic property law principles, an item of personal property cannot be taken or retained without lawful authority, parental consent, or a clear statutory power. I am not aware of any Act of Parliament that grants schools the right to permanently or conditionally confiscate personal devices, nor to penalise a child or parent for refusing to surrender such property. Any confiscation beyond a brief, proportionate classroom management measure risks being unlawful.

Under the Data Protection Act 2018 and UK GDPR, you are required to provide clear, accessible information before processing a child’s personal data. This includes data collected and processed through digital behaviour platforms, identity systems, communication apps, and any biometric tools (such as fingerprints or facial recognition). I have not been given full, plain‑English explanations of what data is being taken, how it is used, who it is shared with, how long it is kept, or what systems are involved. Consent obtained without this information is not informed, specific, or freely given, and therefore cannot be relied upon as a lawful basis for processing.

If my child’s data has been processed through any digital behaviour system (for example, ClassCharts, SIMS, Arbor, Bromcom, CPOMS, MyConcern, Satchel One, or similar), or any biometric system (for example, fingerprint or facial recognition for access, payments, or registration), without my explicit, informed consent, this may constitute unlawful processing under UK GDPR and the Data Protection Act 2018. I do not consent to my child’s data being used to record, track, or enforce mobile phone‑related behaviour incidents.

Under Article 8 of the Human Rights Act 1998, my family has the right to respect for private and family life, which includes personal autonomy and the use of personal property. A blanket phone ban, enforced through sanctions and digital recording, interferes with this right. Any such interference must be lawful, necessary, and proportionate. I do not accept that the current policy meets these tests, particularly where it extends beyond the school day or attempts to control possession rather than misuse.

Under the Children Act 1989, I retain parental responsibility for my child’s welfare, property, and communication. The school cannot override parental responsibility without statutory authority or informed parental consent. I have not given such consent for the school to control my child’s access to their own phone as a matter of blanket policy, nor for the school to use digital or biometric systems to enforce that policy.

Under contract law principles, a valid contract requires offer, acceptance, consideration, capacity, and intention. My child does not have legal capacity to enter corporate contracts. I have not been presented with any clear offer of terms regarding phone confiscation, biometric use, or digital behaviour systems, nor have I accepted such terms. There is therefore no binding contract that allows the school or trust to impose these conditions on my child or on me as a parent.

​

For these reasons, I do not accept:

• that the school has lawful authority to confiscate and retain my child’s phone as a matter of policy;

• that the school has lawful authority to penalise my child or me for possession of a phone;

• that the school has lawful authority to process my child’s data through digital behaviour or biometric systems without my informed consent;

• that any sanctions, detentions, or recorded behaviour incidents linked to phone possession or biometric use are lawful or valid.

​

I require the following:

1. Confirmation in writing of the legal basis (including specific Acts and statutory powers) relied upon to confiscate and retain pupils’ personal phones beyond immediate classroom management.

2. A full list of all digital behaviour, identity, communication, and biometric systems used in relation to my child, including the names of external providers and a description of what data is processed.

3. Copies of any policies, contracts, or agreements that you believe authorise the school or trust to enforce the phone ban and use biometric or digital systems on my child.

4. Confirmation that no further sanctions or penalties will be applied to my child or to me as a parent in relation to phone possession, pending lawful clarification of these issues.

​

This letter is not an attack on staff. It is a formal assertion of my rights and my child’s rights under Consumer Rights Act 2015, Data Protection Act 2018, UK GDPR, Human Rights Act 1998, Children Act 1989, and basic contract and property law principles. I expect a clear, written response.

​

Yours sincerely,

[Parent Name]

[Child Name]

[Date]

⭐ LETTER 2 — TRUST CHALLENGE LETTER

To: Trust CEO, Trust Governance Team, Trust Data Protection Officer

Subject: Formal challenge to phone ban, confiscation policy, biometric use, and digital behaviour systems

​

Dear [Trust CEO / Governance Lead / DPO],

​

I am writing to formally challenge the legal basis of the trust‑wide mobile phone ban, the confiscation of pupils’ personal devices, and the use of biometric and digital behaviour systems applied to my child without my informed consent. This letter follows my initial objection to the school and is now escalated to the trust, as the trust is responsible for policy creation, legal compliance, procurement, and data‑processing agreements.

Under the Consumer Rights Act 2015, any term that restricts or removes a consumer’s personal property must be fair, transparent, and agreed to. I have not been provided with any lawful, contractual agreement that authorises the trust or its schools to confiscate my child’s phone, retain it, or impose sanctions linked to its possession. My child’s phone is personal property, and neither my child nor I have entered into any contract that permits the trust to interfere with that property.

Under UK common law and property law principles, personal property cannot be taken or retained without lawful authority, parental consent, or a clear statutory power. I am not aware of any Act of Parliament granting trusts the right to permanently or conditionally confiscate personal devices, nor to penalise a child or parent for refusing to surrender such property. Any confiscation beyond a brief, proportionate classroom management measure risks being unlawful.

Under the Data Protection Act 2018 and UK GDPR, the trust is required to provide clear, accessible information before processing a child’s personal data. This includes data processed through:

​

• digital behaviour platforms

• identity systems

• communication apps

• external processors

• cloud‑based systems

• biometric tools (fingerprints, facial recognition, etc.)

​

I have not been given plain‑English explanations of:

• what data is taken,

• how it is used,

• who it is shared with,

• how long it is retained,

• what systems are involved,

• what external vendors process the data,

• or what lawful basis is relied upon.

​

Consent obtained without this information is not informed, specific, or freely given, and therefore cannot be relied upon as a lawful basis for processing.

If my child’s data has been processed through any digital behaviour or biometric system (including but not limited to ClassCharts, SIMS, Arbor, Bromcom, CPOMS, MyConcern, Satchel One, or any biometric access/payment system), without my explicit, informed consent, this may constitute unlawful processing under UK GDPR and the Data Protection Act 2018.

Under Article 8 of the Human Rights Act 1998, families have the right to respect for private and family life, including personal autonomy and the use of personal property. A blanket phone ban, enforced through sanctions and digital recording, interferes with this right. Any interference must be lawful, necessary, and proportionate. I do not accept that the trust’s policy meets these tests, particularly where it attempts to control possession rather than misuse.

Under the Children Act 1989, I retain parental responsibility for my child’s welfare, property, and communication. The trust cannot override parental responsibility without statutory authority or informed parental consent. I have not given such consent for the trust to control my child’s access to their own phone, nor for the trust to use digital or biometric systems to enforce that policy.

Under contract law principles, a valid contract requires offer, acceptance, consideration, capacity, and intention. My child does not have legal capacity to enter corporate contracts. I have not been presented with any clear offer of terms regarding phone confiscation, biometric use, or digital behaviour systems, nor have I accepted such terms. There is therefore no binding contract that allows the trust to impose these conditions on my child or on me as a parent.

For these reasons, I do not accept:

• that the trust has lawful authority to confiscate and retain pupils’ personal phones as a matter of policy;

• that the trust has lawful authority to penalise pupils or parents for possession of a phone;

• that the trust has lawful authority to process children’s data through digital behaviour or biometric systems without informed parental consent;

• that any sanctions, detentions, or recorded behaviour incidents linked to phone possession or biometric use are lawful or valid.

​

I require the following:

1. The specific statutory powers the trust relies upon to confiscate and retain pupils’ personal phones beyond immediate classroom management.

2. A full list of all digital behaviour, identity, communication, and biometric systems used across the trust, including all external processors and vendors.

3. Copies of all data‑processing agreements, contracts, and procurement documents relating to these systems.

4. The lawful basis under UK GDPR relied upon for processing children’s data through these systems.

5. Confirmation that no further sanctions or penalties will be applied to my child or to me as a parent in relation to phone possession, pending lawful clarification of these issues.

​

This letter is not an attack on staff. It is a formal assertion of my rights and my child’s rights under Consumer Rights Act 2015, Data Protection Act 2018, UK GDPR, Human Rights Act 1998, Children Act 1989, and basic contract and property law principles. I expect a clear, written response.

​

Yours sincerely,

[Parent Name]

[Child Name]

[Date]

⭐ LETTER 3 — LEGAL WORDING LETTER

To: Headteacher, Trust Governance Team, Trust Data Protection Officer

Subject: Formal notice of invalid consent and unlawful enforcement of phone ban, biometric use, and digital behaviour systems

​

Dear [Headteacher / Governance Lead / DPO],

​

This letter formally states that any consent previously assumed, implied, or bundled regarding the school’s mobile phone ban, confiscation policy, biometric systems, and digital behaviour platforms is not valid under UK law. As a result, any enforcement, sanctions, or data processing linked to these policies cannot be lawfully applied to my child.

​

Under the Data Protection Act 2018 and UK GDPR, consent must be:

​

• informed

• specific

• freely given

• unambiguous

• separate from other agreements

• based on clear, plain‑English information

​

None of these conditions were met.

I was not provided with:

​

• a clear explanation of what data is collected,

• how it is used,

• who it is shared with,

• how long it is retained,

• what systems or vendors process it,

• what lawful basis is relied upon,

• or any meaningful choice to refuse without detriment.

​

Consent obtained through:

• bundled documentation,

• implied acceptance,

• lack of clarity,

• lack of choice,

• or absence of plain‑English information

​

is not valid consent under UK GDPR.

Therefore, any processing of my child’s data through:

​

• digital behaviour systems (ClassCharts, SIMS, Arbor, Bromcom, CPOMS, MyConcern, Satchel One, etc.),

• identity systems,

• communication apps,

• external processors,

• cloud‑based platforms,

• biometric systems (fingerprints, facial recognition, etc.),

is unlawful unless supported by another lawful basis — which has not been provided.

Under the Consumer Rights Act 2015, any term that restricts or removes personal property must be fair, transparent, and agreed to. I have not agreed to any term authorising confiscation or retention of my child’s phone. My child’s phone is personal property, and neither my child nor I have entered into any contract permitting the school or trust to interfere with that property.

Under UK common law and property law principles, personal property cannot be taken or retained without lawful authority, parental consent, or a clear statutory power. I am not aware of any Act of Parliament granting the school or trust the right to confiscate personal devices beyond immediate classroom management.

Under Article 8 of the Human Rights Act 1998, families have the right to respect for private and family life, including personal autonomy and the use of personal property. A blanket phone ban enforced through sanctions and digital recording interferes with this right. Any interference must be lawful, necessary, and proportionate. I do not accept that the current policy meets these tests.

Under the Children Act 1989, I retain parental responsibility for my child’s welfare, property, and communication. The school and trust cannot override parental responsibility without statutory authority or informed parental consent.

Under contract law principles, a valid contract requires offer, acceptance, consideration, capacity, and intention. My child does not have legal capacity to enter corporate contracts. I have not been presented with any clear offer of terms regarding phone confiscation, biometric use, or digital behaviour systems, nor have I accepted such terms. Therefore, no binding contract exists.

For these reasons, I do not accept:

• that any consent previously assumed is valid;

• that the school or trust has lawful authority to confiscate or retain my child’s phone;

• that the school or trust has lawful authority to penalise my child or me for possession of a phone;

• that the school or trust has lawful authority to process my child’s data through digital or biometric systems without valid consent;

• that any sanctions, detentions, or behaviour records linked to phone possession or biometric use are lawful or enforceable.

I require the following:

1. Confirmation that all consent previously assumed or implied is now recognised as invalid under UK GDPR.

2. Confirmation that no further sanctions or penalties will be applied to my child or me in relation to phone possession or refusal to surrender personal property.

3. Confirmation that no further data processing relating to phone‑related behaviour, biometric systems, or digital behaviour platforms will occur without valid, informed parental consent.

4. A written explanation of the lawful basis the school or trust believes it can rely upon in the absence of valid consent.

This letter is not an attack on staff. It is a formal assertion of my rights and my child’s rights under Consumer Rights Act 2015, Data Protection Act 2018, UK GDPR, Human Rights Act 1998, Children Act 1989, and basic contract and property law principles. I expect a clear, written response.

​

Yours sincerely,

[Parent Name]

[Child Name]

[Date]

​