1. www.eani.org.uk/thinkdata #eaThinkData
Get Ready for GDPR
#eaThinkData

2. What GDPR replaces the UK Data Protection Act 1998
GDPR: The Basics
What GDPR replaces the UK Data Protection Act 1998
When 25 May 2018
Who Any organisation that holds or processes personal information- including schools

3. Basic GDPR Principles Personal Information must be:
processed lawfully, fairly & in a transparent manner
collected for specified, explicit and legitimate purposes
limited to what is necessary
accurate and, where necessary, kept up to date
kept for no longer than is necessary
processed securely

4. Reputational damage & loss of trust
GDPR: Non-compliance
Compensation claims
Financial Penalties
Reputational damage & loss of trust

5. Worth Knowing Schools are ‘Data Controllers’ BOG is accountable
72 hours to report a data breach to ICO
C2K is a ‘Data Processor’
Both Processor and Controller may be liable.

6. Practical Data Security
Filing immediately after use
Locking safes and cabinets
Computer passwords
Locking computers
Policy on USB Sticks and other removable media

7. ICO 12 Step Plan - Getting Ready for GDPR
EA GDPR Readiness
ICO 12 Step Plan - Getting Ready for GDPR
1. Awareness
2. Information we hold – Information Asset Register (IAR)
3. Communicating Privacy Information (Privacy Notice)
4. 7 Individual Rights
5. Subject Access Requests (SAR)
6. Lawful Basis for Processing Data
7. Consent
8. Children’s data
9. Data Breaches
10. Data Protection By Design
11. Data Protection Officer
12. International

8. Schools’ GDPR Readiness
EA Think Data Awareness Campaign
ICO/EA video
Dedicated telephone line and
Online support hub
Schools’ Training Programme
Online and EA GDPR workshops

9. School GDPR Readiness Appoint a DPO School Action Plan
Schools and Youth Working Group
Model documents and templates
Online GDPR training for schools
GDPR Workshops

10. 144 93% 613 Data Breaches Failure to redact information Human error
Information sent to the wrong person
613

11. We Are Getting Ready for GDPR
#eaThinkData