The GDPR (General Data Protection Regulation) brings responsibility for schools to inform parents and stakeholders about how they are using pupils' data and who it is being used by.