GDPR checklist for schools and multi-academy trusts
Read our 7-step checklist covering key areas to help your school or trust achieve GDPR compliance.
1. Appoint a data protection officer (DPO)
365体育外围投注You must appoint a DPO if you are a public authority. Some schools share a DPO via their multi-academy trust or if they are in a federation with other schools. Each school must (whether they have their own DPO or not) have sufficient staff and skills to discharge obligations under the GDPR.
2. Update your school's or trusts privacy notice
365体育外围投注The privacy notice discloses the ways a school gathers, uses, discloses, and manages a child/Parent/Guardian’s data. It fulfils a legal requirement to protect privacy. The GDPR sets out the information you should supply and when individuals should be informed. You can find .
3. Process personal data securely
365体育外围投注The regulations require that all the personal data you hold in your school is processed in a manner that ensures its security. This includes protection against unauthorised or unlawful processing and against accidental loss, destruction or damage. More guidance is available on the .
4. Understand what to do if there is a data breach
365体育外围投注A personal data breach is where a lapse in security leads to the destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. If there is a personal data breach, you must report it to the Information Commissioner's Office within 72 hours of becoming aware of the breach. If there is a high risk to an individual, you should also inform the individual right away.
Make sure that you have a process in place to detect, investigate and report breaches, and keep records of any breaches that do occur. You can find more information on .
5. Know how to deal with a Subject Access Request (SAR)
People can now ask for access to personal data about them that is held by your school. This can be a verbal or written request to any person within your school, and you must respond within one month. Whereas previously you could charge for this service, in most circumstances this is now not the case.
365体育外围投注In summary, people can expect to receive the following:
- confirmation that you are processing their data
- a copy of their personal data
- other related information as outlined in your privacy notice
You can read more about .
6. Get signed contracts with relevant third party suppliers
Third parties who manage data can include web uniform providers, school photographers and even website providers! Whenever you use third parties who handle data, you must have a written contract (also known as a data processor agreement) that outlines the responsibilities of both parties when handling personal data.
365体育外围投注You can find out more about .
7. Publish a statement of compliance
365体育外围投注Schools need to publish a statement of compliance, outlining what they are doing to achieve GDPR compliance. This should be clear and visible on your website.
For more information please refer to the .