1. GDPR success: Evidencing outcomes
Dai Durbridge
Browne Jacobson LLP

2. Welcome Partner in the Education team at Browne Jacobson
Lead the Manchester Education team
Act for over 1,300 schools academies and colleges

3. Why all the fuss about GDPR?
Very different data landscape than in 1998

4. Data today

5. GDPR - objectives
Compliance
Accountability
Redress the balance

6. GDPR - impact Compliance - Evidence compliance and evidence outcomes
Accountability – DPO, data breach reporting
Redress the balance – SARs and individual rights

7. Status update Data audit? Policies, procedures and documents updated?
DPO appointed…?
DPO suitably trained?

8. Complete these steps and you are 80% of the way there
Status update
Complete these steps and you are 80% of the way there

9. Changing culture and evidencing compliance
The difficult final 20%…

10. Plan
GDPR success – changing your culture and measuring outcomes to evidence compliance
This session will focus on the importance of embedding culture change to ensure GDPR compliance and provide you with methods, tips and advice to measure the outcomes of your culture change

11. Plan Words to a minimum Slides to a minimum 5 top tips
Behaviours to focus on
Training outcomes
Audit evidence
Policy evidence
Add in toolkit and DPO helpline slides
Peer to peer support

12. 25 May 2018 The world did not end
It was not a deadline – it was a start line
Don’t worry about it

13. Policies, procedures and documents
Get them in place
Reputable source
Approved by governors as appropriate

14. Policies, procedures and documents
Need to evidence:
Creation
Sharing
implementation
How will you do it?
How does that method evidence outcomes?

15. Internal audits - Review: SAR requests and completed disclosures
retention and destruction of documents
information sharing – LAs, third party processors
pupil consents to ensure they are followed
How often?
What evidence would you create to show you carried out an audit?

16. Internal audits – DPO duty
Review:
SAR requests and completed disclosures
retention and destruction of documents
information sharing – LAs, third party processors
pupil consents to ensure they are followed
What evidence would you create to show you carried out an audit?

17. Internal audits Top tip: What does your DSL do…?
If it works for them, it’s likely to work for you
No need to reinvent the wheel…

18. Monitoring compliance
Focus on evidencing outcomes, not inputs
How can you evidence staff understanding and compliance?
Staff meetings?
Stop and question staff?
But what evidence of compliance has been created?

19. Monitoring compliance
Evidence based monitoring:
Staff quiz
Survey
Staff training methods (more later)
What would you include in a staff quiz?
What next?

20. Training and updating
DSL has the same duty as set out in Keeping Children Safe in Education guidance
Don’t reinvent the wheel…

21. Staff training – top tips
Reliable
Where did you get it from?
Who produced it?
When was it produced?
Digestible
If it’s not, it’s not useful
What format works best for your staff – ask them
Lite bites often best – but ask your staff

22. How do you evidence the outcomes?
Important for proving compliance with guidance and satisfying yourself that staff are appropriately updated
Sign in sheets
Copies of s, articles, presentations
What else?
How can you evidence staff engagement as opposed to receipt?

23. Changing culture Some examples…
Use of USB pen drives – encrypted or not
Use of personal addresses
to wrong recipient
Downloading on home computers
access on phones and tablets
Sharing personal data without password protecting
Leaving laptop/personal data in the car overnight

24. Changing behaviour Help them with new skills
How to guides
Top tips
Do it for them!
Remember –outcome is more important than timeframe

25. Get in touch
Please note
The information contained in these notes is based on the position at June It does, of course, only represent a summary of the subject matter covered and is not intended to be a substitute for detailed advice. If you would like to discuss any of the matters covered in further detail, our team would be happy to do so.
© Browne Jacobson LLP Browne Jacobson LLP is a limited liability partnership.
Dai Durbridge | |

26. GDPR success: Evidencing outcomes
Dai Durbridge
Browne Jacobson LLP