GDPR Updates
Preparing for Ofsted
The DfE have talked more about preparing for the GDPR in their blogs for schools.
- Twelve steps to take now, or twelve steps to take then?
- Talking with Staff on GDPR
- GDPR Readiness: Focus on Catering
You can find all the articles here: https://teaching.blog.gov.uk
Information Commissioner’s Office (ICO)
The ‘twelve steps to take now’ guidance referred to above can be found here: https://ico.org.uk/media/1624219/preparing -for-the-gdpr-12-steps.pdf
An ‘at a glance’ guide and checklist about GDPR can be found here: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/documentation
Data Protection: Toolkit for Schools
On April 23rd the DfE produced a Data protection: toolkit for schools; a guidance document to support schools with data protections activity, including compliance with GDPR.
(A copy of the document has been uploaded to the WES Document Library and to GovernorHub).
Privacy Notices for all schools to issue for 2018 - 19 academic year
Every year the DfE release privacy notices for schools to issue to all pupils. The latest version of the privacy notice was issued by the DfE in January 2018 in preparation for GDPR. It is recommended that schools issue this notice in line with their usual privacy notice distribution for 2018/19.
As usual, schools should issue this by the end of the Autumn Term 2018.
There are some gaps in this edition of the privacy notice to allow schools to insert their own information; the DfE has provided links to key guidance to help schools to do this.
In terms of including the retention information, we recommend that schools include details of the link on their website to their retention policy rather than trying to replicate it in the privacy notice.
The ICO has a link which will help schools populate the gaps in the privacy notice:
See Privacy notice – suggested text for pupils:
https://www.gov.uk/government/publications/data-protection-and-privacy-privacy-notices
Record Retention Schedule
The Information and Records Management Society (IRMS) is a professional association for those who work in records or information management. It has produced an information management toolkit for schools.
A table on pages 37 - 56 shows the retention periods for different types of school records, and the actions to take at the end of a record's administrative life.
For some records, there are statutory retention periods. For others, the table shows retention guidelines following best practice
The IRMS also says that the toolkit has been designed as guidance and should “not be quoted to users as being a ‘standard’”.
Recommendations from the IRMS
In its information management toolkit for schools, the Information and Records Management Society (IRMS) recommends retaining some governing board documents permanently.
These documents are:
The principal set of signed minutes
- Instruments of government
- Trusts and endowments
It recommends retaining some other documents for 6 years. These are:
- Reports from meetings
- Complaints files
- Annual parents' meeting papers
The IRMS also advises that:
- One copy of the agenda for meetings be retained permanently with the master set of minutes, and all other copies to be disposed of
- Policy documents be disposed of 3 years after they expire
- Action plans be securely disposed of 3 years after they expire
- Inspection copies of minutes be securely disposed of after 3 years
- Annual reports to the DfE be kept for 10 years
It notes that these retention guidelines are considered to be "normal processing" under the Data Protection Act 1998 and the Freedom of Information Act 2000.
If records are to be kept for longer or shorter periods, the reasons should be documented.