GDPR: lawful and limited processing
Child-safety purposes still need a lawful basis, proportionate processing, transparency, security and appropriate safeguards. A school’s existing records are not automatic permission for a new purpose.
GDPR — official text

