Your institution has an appropriate data protection policy:
Your institution provides data protection awareness training for all staff:
Your institution has a written contract with any processors you use:
We process sensitive personal data or data relating to children or vulnerable groups:
Your institution manages information risks in a structured way so that management understands the business impact of personal data related risks and manages them effectively.
Your institution has implemented appropriate technical and Institutional measures to integrate data protection into your processing activities;
Your institution understands when you must conduct a DPIA and has processes in place to action this:
Your institution has a DPIA framework which links to your existing risk management and project management processes.
Your institution has nominated a data protection lead or Data Protection Officer (DPO).
Decision makers and key people in Your institution demonstrate support for data protection legislation and promote a positive culture of data protection compliance across the business.
Senior leaders understand their responsibilities and have attended detailed training:
Administrative staff understand their responsibilities:
Teaching staff understand their responsibilities
There is a record of which staff have taken Data Protection training and when
We have appointed a data protection officer who is impartial.
The DPO’s contact details have been shared with all data subjects
We have reviewed all our data processors – everyone we share data with and the software we enter data into
We have also reviewed software and apps used in classrooms by teachers.
We use due diligence with suppliers and have data processing agreements in place
Your institution ensures an adequate level of protection for any personal data processed by others on your behalf that is transferred outside the country
We understand when we would need to conduct a data protection impact assessment (DPIA)
Your institution monitors your own compliance with data protection policies and regularly reviews the effectiveness of data handling and security controls.
We only collect data we need to process
It is clear why we are processing the data in our privacy policy and privacy notices
We only keep data that we have a documented reason to keep
We have updated our privacy notices for each group of data subjects
The personal data we hold is accurate and, where necessary, kept up to date; taking every reasonable step to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay
We have implemented school-wide data and cyber security measures
We have updated our consent procedures
Your institution has provided privacy information to individuals.
If Your institution offers online services directly to children, you communicate privacy information in a way that a child will understand.
Your institution has a process to recognise and respond to individuals' requests to access their personal data.
Your institution has processes to ensure that the personal data you hold remains accurate and up to date.
Your institution has a process to securely dispose of personal data that is no longer required or where an individual has asked you to erase it.