DATA PROTECTION SERVICES

---

Schools are a target for cyber crime criminals. Motives vary from financial gain (selling email addresses, fraud, identity theft), to students testing their abilities. School staff are busy managing conflicting demands. Data breaches are inevitable and can be devastating for individuals and for the reputation of the school/trust. A major breach could lead to a significant fine. 

Individuals are increasingly exercising their right of access to their personal data. Many are employing legal teams to do so. Balancing the right of individuals to access their personal data with the rights and freedoms of others, applying exemptions and disclosing the data while avoiding a data breach can be a minefield.  

Clear 7 Data Protection Officer service is a comprehensive service designed to minimise the risk and impact of data breaches, streamline Subject Access Requests and to provide peace of mind for the Senior Leadership Team.  

In the event of a major data breach, having an experienced Data Protection Officer and embedded training and practices in place, will demonstrate to the Information Commissioners’ Office that the school/trust takes it’s responsibilities to protect personal data seriously and reduce the liklihood of regulatory action.  The service includes:  

• A named Data Protection Officer. 
• Access to expert guidance and support with practice and processes. 
• Bite-sized reminders for staff: Regular updates on topical issues to ensure that data protection remains at the forefront of school activities. 
• Support with data breaches: Advice on immediate containment, next steps and preparation of bespoke written correspondence for all parties. 
• Liaison with the Information Commissioners’ Office (ICO): Responding to enquiries, reporting breaches and all communications following an investigation by the ICO. 
• Support with Subject Access Requests:  
  • Preparation of bespoke written correspondence,  
  • Advice and guidance on collation and redaction,  
  • Application of exemptions and 
  • Independent review of data prior to release.  

               The service also includes the option of securely providing the data via a GDPR portal,                     avoiding the risks and expense of emailing sensitive personal data or postal/courier services.  

• Access to a GDPR portal:  for reporting data breaches and strategic monitoring at trust as well as school level, securely responding to Subject Access Requests, and monitoring and reporting GDPR training uptake across your school/trust.  

The accountability principle requires you to take responsibility for what you do with personal data and how you comply with the other principles. You must have appropriate measures and records in place to be able to demonstrate your compliance.  

The Health Check is a due diligence review to ensure that each school within the trust has robust foundations in place to protect the personal data it is responsible for. It covers the trust website, policies, building security, IT set up, data storage and disposal and includes review of the processes in place to protect your most vulnerable special category data.   

Following the review, you will receive a detailed report for each site highlighting any areas of concern and recommended actions, plus an editable action plans at trust and individual school level for trustees and governors to risk assess and implement accordingly.  

These reports provide excellent evidence of compliance with the regulations.