14 steps to being ready for GDPR

Al Kingsley

Al Kingsley is managing director of NetSupport and, in addition, is the chair of a Multi Academy Trust and a local Governors’ Leadership Group. NetSupport produce a range of solutions including an IT Asset Management solution to manage and support IT assets across a school network, campus or schools in a multi-academy trust.

Follow @AlKingsley_Edu

Website: www.netsupportdna.com/education Email This email address is being protected from spambots. You need JavaScript enabled to view it.
Image credit: Flickr // Mark Watson. Image credit: Flickr // Mark Watson.

GDPR is coming and schools need to be clear on what it means for them, as well as how to handle it ahead of when the regulations come into force on 25th May 2018. Currently, it seems that confusion reigns over what schools actually need to be doing to ensure they can comply with the new GDPR regulations – not just by that date, but sustainably thereafter.

So why the uncertainty? Firstly, GDPR isn’t a piece of legislation exclusive to the education sector; it’s intended to protect the data of all individuals. Educational institutions are hugely affected though, because the number of individuals’ data they hold far exceeds that of many businesses. However, as they are already more procedure-led than many corporate organisations, this puts them one step ahead of the rest.

To a large extent, schools have been left to decide what is relevant to them and what is not - plus, there has only been limited official and local authority guidance. Why is this when it is such a big issue? Well, mainly because the legislation is generic - it would be impossible to document GDPR in detail to take account of the unique circumstances of every single organisation - and it’s therefore open to interpretation.

What’s the best way forward?

GDPR is complicated, but it needn’t be scary. Preparation is crucial. If your school hasn’t yet started to action steps to becoming GDPR compliant, don’t panic – but do take action now. If you want to be a school able to take this on board and handle it into the future, now is the time to get your ducks in a row.

You’ve probably seen the recommended 12 steps to GDPR, so here are some further ideas to help you tackle this issue in your school…

1. Dedicate time to prepare for GDPR. It’s definitely not something that you can put aside a spare five minutes for here and there.

2. Draw up your own checklists applicable to your school based on each of the 12 steps. Work through them methodically, allocating responsibilities as appropriate.

3. Create a reference log of all the new policies and procedures you’re putting in place, so that all staff have a consistent set of rules to refer to.

4. Ensure you have the right tools to discover and find out where your critical data is located.

5. Make it a priority to sort out who will be your data protection officer. Even if it’s not a going to be a permanent solution, you will most definitely need someone to cover the role as soon as the regulations come into force. Get your governors and SLT on board. GDPR is the responsibility of the organisation as a whole, so everyone needs to be pulling together to make it happen for your school. In a multi-academy trust, perhaps a suitably experienced trustee could take on the role.

6. Consider creating a rotating bank of go-to GDPR staff champions who can answer others’ questions. Make this a shared responsibility; don’t let the burden fall on just one person, as there will be many, many questions until new systems bed in.

7. Find all files that contain personal data - right now. These can be either paper or online files. Make sure you know exactly what you have and exactly where it is. This will make it easier for you to formulate your policies for data storage and what to do if someone requests their data from you at a later date. Also, document all software products that your school is using and be satisfied that they’re GDPR compliant; know what data they store locally and remotely – and why. Software inventory is particularly useful as it will highlight any non-standard apps that individual teachers may be using.

8. Project plan: If you need technical help (with, for example, setting up systems to manage and record consent or identify a data breach), call a meeting, set a clear, documented project plan and get the process underway now. Alternatively, look at online solutions that can help step you through the process.

9. Procedure plan: Where new procedures will be required under GDPR, plan these in detail and implement new strategies for dealing with them as soon as you can. Use “what if” scenarios to help you plan. For example: What if a USB stick gets left in a PC overnight? How would you report/provide evidence of whether it was accessed? And how would you record that breach? Or, what if a parent contacts us asking to provide all data we hold about their child? How would you find it? How would you ensure none was missed? How would you collate it? Whose responsibility would it be to find and provide it? How would you achieve this in the set timescale? And so on.

10. Keep a comprehensive evidence data trail of everything that you do so that you can provide records of your compliance activity.

11. Get advice – if there are requirements that you’re unsure of how to deal with: ask for help. Ask other schools how they’re handling it, research it online or post a question on social media. Everyone is in the same boat in trying to find their way through this, so it’s likely others will be more than willing to share and discuss potential solutions.

12. Know where to go to for official information in case queries arise. The authority on GDPR in the UK is the Information Commissioner’s Office.

13. Hold staff GDPR briefings and outline their roles in adhering to the rules, then follow up with training for those with a more prominent part to play.

14. Above all, be organised, be methodical: be prepared!

The countdown is on…

As GDPR requirements will be ongoing, it makes sense for schools to learn to be largely self-sufficient, so speaking to organisations that provide tools to allow them to do this will mean the process can be much more sustainable for the future. It’s better for schools to get to grips with this now, rather than leave it until near the deadline and end up paying a consultant for something they could easily have done themselves.

The important thing to remember is that there’s still time. If, despite all of your best efforts, your processes aren’t quite in place by then, it’s highly unlikely that you’ll be fined on day one.

In summary, this is what schools need to do: gather the facts about your data and know where it is stored; discover how and why the data is used; protect it; record and report and keep all evidence if it goes astray. Yes, it will take some dedicated effort to do that, but it’s nothing that schools can’t handle.

Want to receive cutting-edge insights from leading educators each week? Sign up to our Community Update and be part of the action!

Register for free to continue reading
Registration is a free and easy way to support us.
When you register, you'll join a grassroots community where you can:
• Enjoy unlimited access to articles
• Get recommendations tailored to your interests
• Attend virtual events with our leading contributors
Register Now
Try Later

Latest stories

  • Free recycling-themed resources for KS1 and KS2
    Free recycling-themed resources for KS1 and KS2

    The Action Pack is back for the start of the brand new school year, just in time for Recycle Week 2021 on 20 - 26 September, to empower pupils to make the world a better and more sustainable place. The free recycling-themed resources are designed for KS1 and KS2 and cover the topics of Art, English, PSHE, Science and Maths and have been created to easily fit into day-to-day lesson planning.

  • Inspire your pupils with Emma Raducanu
    Inspire your pupils with Emma Raducanu

    Following the exceptional performance from British breakthrough star Emma Raducanu, who captured her first Grand Slam at the US Open recently, Emmamania is already inspiring pupils aged 4 - 11 to get more involved in tennis - and LTA Youth, the flagship
    programme from The LTA, the governing body of tennis in Britain, has teachers across the country covered.

  • 5 ways to boost your school's eSafety
    5 ways to boost your school's eSafety

    eSafety is a term that constantly comes up in school communities, and with good reason. Students across the world are engaging with technology in ways that have never been seen before. This article addresses 5 beginning tips to help you boost your school’s eSafety. 

  • Tackling inequality in EdTech
    Tackling inequality in EdTech

    We have all been devastated by this pandemic that has swept the world in a matter of weeks. Schools have rapidly had to change the way they operate and be available for key workers' children. The inequalities that have long existed in communities and schools are now being amplified by the virus.

  • EdTech review & The Curriculum Lab
    EdTech review & The Curriculum Lab

    The world is catching up with a truth that we’ve championed at Learning Ladders for the last 5 years - that children’s learning outcomes are greatly improved by teachers, parents and learners working in partnership. 

  • Reducing primary to secondary transition stress
    Reducing primary to secondary transition stress

    As school leaders grapple with the near impossible mission to start bringing more students into schools from 1st June, there are hundreds of thousands of Year 6 pupils thinking anxiously about their move to secondary school.

  • Generation Z and online tutoring: natural bedfellows?
    Generation Z and online tutoring: natural bedfellows?

    The K-12 online tutoring market is booming around the world, with recent research estimating it to grow by 12% per year over the next five years, a USD $60bn increase. By breaking down geographic barriers and moving beyond the limits of local teaching expertise, online tutoring platforms are an especially valuable tool for those looking to supplement their studies in the developing world, and students globally are increasingly signing up to online tuition early on in their secondary education schooling. 

  • Employable young people or human robots?
    Employable young people or human robots?

    STEM skills have been a major focus in education for over a decade and more young people are taking science, technology, engineering, and maths subjects at university than ever before, according to statistics published by UCAS. The downside of this is that the UK is now facing a soft skills crisis and the modern world will also require children to develop strong social skills as the workplaces are transformed by technology. 

  • What it’s like to be a teacher with an anxiety disorder
    What it’s like to be a teacher with an anxiety disorder

    We all feel anxious sometimes. Maybe it is going into a new situation such as starting a new job, or having to have a difficult conversation. The feeling of nervousness and anxiousness is completely normal, and an evolutionary necessity. However, for some people, like me, that feeling of anxiousness never goes away. You live with it day in, day out, and it can have quite a detrimental effect on your life and mental health.

  • How Tassomai transformed our school
    How Tassomai transformed our school

    An online learning programme called Tassomai is playing its part in the rapid transformation of Torquay Academy. Reece Broome, who is leading the project at the school, explains.

In order to make our website better for you, we use cookies!

Some firefox users may experience missing content, to fix this, click the shield in the top left and "disable tracking protection"