Is Your School GDPR Compliant?

How To Prepare Your School For The GDPR

Telephony GDRP Compliance

Does your school use a Tannoy system? How is this information shared? Under the new GDPR legislation, data should be shared in a manner that is sensitive to the individual. Does your school have call recording? How is this information stored, call recordings will need to be stored in a manner that is compliant with GDPR, access to this data can easily implicate your school. Does your school have an analogue answering machine? Analogue answer machines are most likely not GDPR compliant & will need to be replaced with something that is GDPR compliant, bear in mind that an analogue answer phone will broadcast these messages to everyone within your school, hence is not GDPR compliant to sensitive data. Old telephone systems will also not comply with GDPR legislations, if your school uses an old phone system with call recording/ answer phone features, give us a call we can help advise you.

(DPIA)

If your school is considering using data in innovative methods, you should consider implementing a new technology to monitor pupils in some way, it is good practice for your school to carry out privacy impact assessments regularly. This is set to become a legal requirement in some circumstance under the GDPR legislation. For many years it has been good practice to adopt a privacy by design approach & the ICO has recommended that establishments use privacy impact assessments from time to time. GDPR will make this a legal requirement for some projects.

Consent

If you process any personal data on the basis of consent, now, you will need to review how you seek to obtain or record data, consent must be freely given, & cannot be ambiguous. This is very relevant to any contacts you may have set up with parents & perhaps for school fundraising. The data must only be used for the purposes that consent has been given. For example, if you receive an inquiry through your website, this will not give you the right to add them to your email marketing list.

Data Breaches

Make sure your school has the correct procedures in place for the detection, reporting & investigation of personal data breaches. For example, if your school loses personal data or somehow manages to disclose data to the wrong recipient. The new GDPR legislation will create a breach notification. Not all breached will be notified to the ICO – Only ones where the individual whos data has been breached is likely to suffer any form of damages, such as through identity theft or confidentiality breach. Data breaches can also take place through your CRM system, does your school use a CRM system? You will need to review whether or not the CRM system/ connection complies with the GDPR legislation. Any GDPR breach will be subject to a 10% revenue fine.