Security for Boarding Schools and Student Protection for HNWI Families

Premium boarding schools in the UK – Eton, Harrow, Winchester, Marlborough, Cheltenham Ladies’ College, Rugby, Charterhouse, and their peers – educate a student population that includes children from HNWI families, children of senior political figures, and children from wealthy international families whose parents may face specific threat profiles in their home markets.

James Whitfield, Senior Security Consultant, works with HNWI families to integrate their children’s school security into the broader family security programme. His consistent observation is that the school environment is frequently treated as a security boundary – the child is safe at school, so no further planning is needed – when in reality the school is simply one environment in a threat landscape that does not pause at the school gates.

The duty of care framework for boarding schools

Boarding schools operate under a more demanding duty of care framework than day schools. The child is in the school’s care at all hours, creating obligations that extend beyond the classroom to residential accommodation, social activities, sports, and travel.

The Independent School Standards Regulations 2014, enforced through ISI (Independent Schools Inspectorate) inspections, set specific standards for welfare and safeguarding in boarding schools. The National Minimum Standards for Boarding Schools (2022, updated) specify residential safeguarding requirements including: DBS and overseas criminal record checks for all staff in regulated activity, safer recruitment processes, and safeguarding policies that address the specific risks of the residential environment.

The Terrorism (Protection of Premises) Act 2024 (Martyn’s Law) imposes specific obligations. Large boarding schools with 800+ combined capacity for students, staff, and visitors will fall into the Enhanced tier, requiring a documented Security Plan, a qualified Security Lead, and formal registration with the Security Industry Authority. Standard tier schools (200-799 capacity) have lighter but still mandatory requirements.

For governors and senior leadership, the HSWA 1974 general duty of care frames the overall obligation: risks must be identified, assessed, and reasonably controlled. This applies to the residential environment, school trips, and the management of any specific threats related to the profile of individual students.

Threat profile: children from high-profile families

Children from HNWI and politically prominent families have a threat profile that the school’s general safeguarding framework is not specifically designed to address.

Kidnap for ransom risk extends to children in several documented markets. OSAC country reports for Colombia, Mexico, Nigeria, and the Philippines consistently document cases where children of wealthy parents have been targeted. Even within the UK, Control Risks’ domestic threat assessments acknowledge that KFR risk is not negligible for families with very high profiles. A child attending a publicly identifiable school, whose family is documented in the Sunday Times Rich List or equivalent, has a predictable location and routine that an adversary can use.

Targeted social engineering is a more common and more likely threat for most children from HNWI families: cultivating the child’s trust through a peer relationship or online contact to extract family information – the principal’s schedule, financial details, travel plans – or to induce the child to take an action (opening a link, sharing a password) that compromises the family’s security. Children are not trained in counter-elicitation and are naturally trusting.

Extortion directed at the child themselves – threatening to reveal embarrassing material unless a payment is made or an action is taken – is a documented pattern that has been particularly associated with social media and online gaming platforms where anonymous contact with minors is possible.

Exeat security: the highest-risk window

The exeat – the period when a student leaves the school premises for a weekend, half-term, or occasional visit – represents the transition from the school’s controlled environment back to the family’s security programme. This transition period is the highest-risk window for students with an elevated threat profile.

The key controls are:

Authorised collection register. Schools should maintain, for every student, a list of adults who are authorised to collect them. This list should include verified contact information that has been confirmed by direct communication with the parent or guardian, not taken solely from documents submitted at admission. The list should be reviewed at the start of each academic year and whenever the family’s circumstances change.

Collection verification. When a student is collected at exeat, the collecting adult’s identity should be verified against the authorised collection register. Familiarity is not verification: a regular driver who collects every half-term should still provide identification on each occasion. Any request to transfer collection to an unlisted person should require direct verbal confirmation from the parent before the student is released.

For high-risk students, coordinated transport. Where a student’s threat profile justifies it, exeat transport should be coordinated between the school and the family’s security programme: a vetted vehicle and driver, varied timing, and a collection protocol agreed between the school’s safeguarding lead and the family’s security team.

School trips and overseas travel

Schools have a duty of care obligation for students during school trips that mirrors employer duty of care under HSWA 1974 and the Management of Health and Safety at Work Regulations 1999. A school trip to a P1 city or an elevated-risk destination – a ski trip to Georgia, a history trip to Egypt, a cultural exchange to Manila – requires a risk assessment that goes beyond the standard educational trip checklist.

The specific security elements for trips to elevated-risk destinations: pre-travel threat assessment for the destination (FCDO travel advice, OSAC country reports), communication protocols for emergencies (including out-of-hours contact for parents), crisis response arrangements, and specific briefing for the accompanying teachers on situational awareness and emergency response.

For schools that regularly take students to international destinations, an annual review of destinations against current threat intelligence is appropriate practice. A destination that was low-risk five years ago may have deteriorated; a school that has not reviewed its risk framework since the last trip may be operating on outdated assumptions.

Digital security for students

Students from HNWI families who are active on social media have inadvertently created public-facing profiles that can be used to identify their school, their family, and their daily routine. Instagram stories from the school’s sports field, tagged location posts from the local town, and photographs that identify the school uniform or the school building provide an adversary with location confirmation.

Age-appropriate digital security education – which most boarding schools provide in some form, though typically focused on online safety rather than personal operational security – should include: the family information that should not be shared in social contexts (travel plans, parental movements, family financial information), awareness of suspicious contact from unfamiliar individuals online, and basic social media privacy settings.

CPOMS (Child Protection Online Management System) and equivalent platforms used by schools for safeguarding records contain sensitive data about students; the school’s information security arrangements for these systems are relevant to the overall security of the student’s personal information.

See our guide on protecting children in high-net-worth families for the broader family security programme within which school security sits, and our security for international schools and expat families for the considerations that apply when the school itself is in an overseas or elevated-risk location.

Sources: Independent School Standards Regulations 2014; National Minimum Standards for Boarding Schools 2022 (revised); Independent Schools Inspectorate Welfare Framework 2024; Terrorism (Protection of Premises) Act 2024 (Martyn’s Law); Health and Safety at Work Act 1974; Management of Health and Safety at Work Regulations 1999; OSAC Country Security Reports (Colombia, Mexico, Nigeria, Philippines) 2025; Control Risks Child and Family Security Assessment 2025; NSPCC Boarding School Safeguarding 2024; DBS Code of Practice 2024; FCDO Travel Advisories April 2026; CPNI Protective Security for Private Individuals 2023.