Data protection and GDPR

General Data Protection Regulation (GDPR)

From 25 May 2018 schools need to be compliant with the new legislation. Links to information, resources and tools that schools may find useful in making preparations are listed below.

General guidance on GDPR

• GOV.UK – Data protection: toolkit for schools
• Information Commissioner’s Office
• National Governors Association 
• London Grid for Learning (LGfL) – select GDPR from the dropdown Topic menu
• Times Education Supplement

Webinars and blogs

• DfE
• Browne Jacobson
• Optimus Education GDPR BLOG

Checklists and action plans

• ICO Preparing for GDPR (12 steps to take now)
• ICO Checklist for Data Controllers
• ICO Checklist for Data Processors

Roles and responsibilities

• Data Manager and Data Processor – (ICO definitions)
• DPO – The role of the Data Protection Officer (ICO)

Data mapping

All schools will need to undertake an exercise to map the personal data they hold and the data flows.  The Council has produced a data mapping template (Excel spreadsheet) which schools may choose to use but there are a number of others available including the LGfL School Data Audit which can be found on the London Grid for Learning website (see above).

Data protection impact assessments

• Conducting Privacy Impact Assessments ICO – contains specimen DPIA 
• Example data protection impact assessment template

Procurement policy note (PPN)

Procurement Policy Note 03/17: Changes to Data Protection Legislation & General Data Protection Regulation – contains specimen statements for new and existing contracts and specimen letter to suppliers

Other specimen documents, letters etc

• DfE Specimen privacy notice for pupils/students
• DfE Specimen privacy notice for employees
• Model privacy notice for school governors
• BFC model data protection polic