Not long now until the GDPR comes into force. What progress have we made and how ready are we?
In my last post I talked about the work I’ve been doing in school to help us prepare for the GDPR. It feels a little like my life has been taken over by data protection and the GDPR but I confess, quietly, that I have been enjoying it.
When I wrote my previous post, I had just finished putting together my compliance document and information audit. I sent the audit to the leadership team because there were areas that I simply couldn’t answer because I don’t know what data teachers process themselves. I haven’t had any comments back yet so am now on a mission to chase for them. I can’t finalise the information audit without their input.
I’m waiting for our HR team to send me a job description that would suit our school. The governors and headteacher have decided that they want my current job description to be reviewed so that it can accommodate the DPO role. As the SBM many will balk at the idea but we think we’ve come up with a valid justification for me doing it.
Our theory is that the idea that a SBM can’t be the DPO is based on decision-making around data processing. As a maintained school I don’t decide what data we collect, why we collect it or how we collect it. We are told by the DfE and the local authority what data we’re required to collect, how and why.
I read an article that gave a good example of this: a school wants to change its management information system and a person in school makes the decision of which one to purchase – that person cannot be the DPO.
If the DPO is in place and is asked to make the decision they would need to refuse. Again, in maintained schools this isn’t such a big issue because those kinds of decisions are ultimately taken by the governing body. So, the question of the SBM being a DPO depends really on the context of the role and the school type.
Our GDPR for Schools conference will be providing more information and guidance on the new ePR, as well as an update from the ICO.
Taking place in London on 27 November and Manchester on 24 January 2019, you can secure your place now.