GDPR – Privacy Notice Guidance

1. GDPR – Privacy Notice Guidance

4. This checklist is designed to help school leaders produce a privacy notice, which is a statutory requirement. It also suggests what you could include in a broader data protection policy. It is based on guidance from the Information Commissioner’s Office (ICO).

8. What to include Tips

9. Privacy notice (statutory requirement)

10. Policy introduction You should explain that the school is a data controller and, as such, is registered with the ICO and complies with the principles of the Data Protection Act 1998.

11. Fair processing You should set out the types of information you hold about pupils, staff and other groups, what you do with it and why you need it.

13. You should also set out the other organisations you share information with. You may wish to make it clear that access to the information is only available to those who need it.

14. Storage and disposal of information You should explain how confidential information will be kept secure while it is being stored or used by the school, and when it is being shared with others.

16. You should also explain how the school will ensure that personal data is safely disposed of.

17. Handling requests for information You should outline procedures for handling requests for information, including individuals’ rights of access to information, timescales for responding, and charges that may be made. This could be in an appendix to the policy/privacy notice.

18. Data protection policy (non-statutory)

19. The data protection principles A broader data protection policy could include information on the eight principles of data protection, along with a statement that the school will commit to them.

20. Responsibilities of different groups A policy might also set out clear procedures for staff and governors to follow when handling personal data.

21. Training for staff and governors A data protection policy could also include a statement on training and development to ensure that staff and governors are aware of their responsibilities under the legislation.

29. Role description: Data Protection Officer (DPO)

31. General information

32. Contract type:[full-time or part-time]

33. Salary:

34. Location:

35. Reporting to:[job title of line manager for the DPO]

36. Responsible for:[job titles of staff members who will report to the DPO, if applicable]

37. Budget responsibilities:[total budget the DPO will manage, if applicable]

39. Purpose

40. The DPO is responsible for monitoring compliance with current data protection law, and has the knowledge, support and authority to do so effectively. They oversee the school’s data protection processes and advise the school on best practice.

42. Key responsibilities

43. To:

44. Advise the school and its employees about their obligations under current data protection law, including the General Data Protection Regulation (GDPR)

45. Develop an in-depth understanding of the school’s processing operations, information systems, data security processes and needs, and administrative rules and procedures

46. Monitor the school’s compliance with data protection law, by:

47. Collecting information to identify data processing activities

48. Analysing and checking the compliance of data processing activities

49. Informing, advising and issuing recommendations to the school

50. Ensuring they remain an expert in data protection issues and changes to the law, attending relevant training as appropriate