The GDPR Turns 2! – SchoolPro TLC Monthly Newsletter – Issue 9 – May ’20

Later this month, it will have been two years since the introduction of the GDPR and the Data Protection Act 2018. Here are some of the key lessons that we have learnt in that time:
​

• Many Data Protection Officers (DPOs) are still not compliant.
  Following a Belgian ruling where an organisation was fined, organisations really need to identify a DPO with relevant experience and no conflict of interest.
  If you have colleagues in other schools or organisations where there is a concern that this is still an issue, don’t forget that we still offer you our 10% referral discount if they take on our DPO service through your referral.
• Schools need to ensure that DPIAs are written and in place.
  These are the impact assessments that demonstrate that you are mitigating risk when you are mass processing data or you are processing high risk data. We are here to support you with getting these in place if you haven’t already so please speak to us and we can arrange this with you.
• It is important to maintain good communication with your DPO.
  Schools must involve their DPO in decisions where new processing is being considered. It is important that we, as the DPO, are aware of new processing and can provide advice and guidance where required. Using the Data Decision log on the SchoolPro portal assists with this link.
• Schools need to maintain ongoing compliance.
  Schools need to be keeping data maps up to date, recording processing activities, and ensuring that new processors are compliance checked. All of these things can be supported by us as your DPO.
• Ensure that staff practice matches policy and processes.
  Although schools are moving towards better compliance, staff practice is slower to follow. Lots of breaches arise from avoidable human error which indicates a need for more training and regular refresher training so that staff don’t forget after the initial push. So book training in with us as soon as the national situation allows!
• Common trends are arising in breaches.
  The most common type of breaches that we are supporting schools with at the moment involve electronic communication. Examples include personal information sent to unintended recipients by mistake, or email addresses CC’d into group emails instead of being blind copied. Procedures should be in place to ensure that personal information is always password protected, encrypted or sent by other secure systems, and staff need to be following these procedures. This would, on its own, hugely reduce the number of breaches reported to us by our schools.
• Common trends are arising in SARs.
  More than 90% of the Subject Access Requests (SARs) that we support schools with come from parents rather than any other stakeholder.