The ICO has published some guidance on their website:
https://ico.org.uk/for-organisations/data-protection-reform/guidance-what-to-expect-and-when/
This is a useful starting point and something I shall be building on in the services I offer to schools and other organisations.