Educational data protection & GDPR

The GDPR and data protection laws was enacted into Law back in 2018.  As for many organisations it imposes legal obligations for education and the ways they must manage and process personal data.

The legislation gives the supervisory authority such as Information Commissioner’s Office (ICO) powers to impose significant financial penalties, even the schools UK regulator Ofsted now includes data protection compliance within their inspection criteria and there is a greater chance of reputational damage from bad publicity in education.

Schools today have many activities using personal data

Educational Software such as SIMS, ScholarPack, Arbor etc. 2Simple, Tapestry early years systems

Communications and consent management, how do you manage Photography and displaying pictures. Social media, posting images. Parent communications, satchel post, Teachers2Parents, ParentMail etc.

Policies, Website policies, Privacy, retention and data protection policies, photography, remote working (marking from home) to name a few.

Administration, what do you have to manage:

• Network security
• Email systems
• Staff payroll, pension and other HR records
• Paper records
• Visitors’ book and access systems
• Managing CCTV/Video
• Subject Access Request
• Data Breach Notification

Managing Sensitive Information, how do you manage the data and access to:

• Special educational needs
• Medication and medical data
• Safeguarding and family issues
• DBS Checks

Teaching and getting the job done, what’s in place for

• Children’s workbooks
• Wall displays and name badges
• Pupil premium data
• eports and taking data home
• School printing facilities

Sharing data with others; how do you manage data with

• School trips, peripatetic learning
• Supply teachers
• Feeder and transitional schools
• References for employers and other institutions

Like other organisations, all schools must:

Be transparent in the way they process personal data and accountable for doing so

Appoint a designated data protection officer if they are a state school or a private school. The role is important not to have a “conflict of interest” such as business managers, governors and even teachers.

Understand the data they have, where it is stored and who has access to it

Implement robust processes and procedures to protect personal data

Allow pupils, staff members, governors, parents, guardians, and suppliers to:

• have access to their personal data
• ensure it is correct and modify it as necessary
• have it deleted (unless needed for legitimate reasons)

Be able to detect, manage, report, and respond to data breaches including, if necessary, liaising with the supervisory authority.

Enquire today about how DLM Group could support your sector in achieving compliance.