GDPR Now Live - What Does This Mean for Schools and Academy Trusts?
Following the implementation of the GDPR on 25 May, many schools and academy trusts are reporting that they still have work to do. Is it too late, or is this just the beginning?
Before its implementation, Elizabeth Denham of the ICO provided a reassuring message: "For those that still feel there is work to be done – and there are many of those too – I want to reassure you that there is no deadline. 25 May is not the end. It is the beginning".
We will all be expected to prioritise high risk areas, such as information security, but in our view the ICO will focus on an organisation's compliance journey.
There are plenty of materials available to help you with your GDPR compliance. The ICO has updated its own resources which may be helpful. Their GDPR guide contains useful guidance, toolkits, checklists and FAQs based on real queries received by their customer contact team. In addition, the DfE published a Data Protection toolkit for schools, although this is still expressed to be a 'beta' version and may be subject to refinement following the closure of its recent consultation.
We have developed detailed sector-specific documents, training and resources to help you with your GDPR obligations. This includes:
- A Data Protection policy for staff
- An Information Security policy (which could be part of, or separate to, the Data Protection policy)
- An Information and Records Retention policy
- Privacy Notices for pupils, parents and staff (including prospective, parents and staff) which are an explicit requirement under the GDPR
In addition, it is important that academy trusts update many other contracts and policies to ensure compliance with the GDPR and the expectations of transparency at its core. We would recommend that you focus on Employment first, and then on other high risk areas, such as third party contracts.
Training - GDPR Events and VWV Plus eLearning Solutions
We have been delighted to welcome many of you to updates and GDPR-related events which we have run or at which we have spoken at over the last year or so.
Many schools have recognised the value of training all staff on the essentials of data protection and information security, to introduce their new policies, to reinforce learning and help manage data compliance and to manage the school's exposure in the event of a breach. To help you deliver this, we have developed eLearning Solutions under VWV Plus, our eLearning platform which includes academy-focussed training, a quiz to test understanding and confirmation that staff have read and understood your staff privacy notice and up to date policies and procedures.
To find out more about how eLearning Solutions can help you and your school, get in touch with Imogen Street on 07384 545998 or complete the below form.