Data protection officers help to make sure schools are compliant with data protection laws – what should you be looking out for when you are filling the role?
CREDIT: This is an edited version of an article that originally appeared on gov.uk
All schools must have a designated data protection officer. The data protection officer in your school is responsible for:
advising school leaders and staff about their data obligations;
monitoring compliance;
conducting regular data audits;
developing and updating data protection policies and procedures;
monitoring who in the school has access to personal data;
advising when data protection impact assessments are needed;
answering data protection enquiries from staff, parents and pupils;
making sure privacy notices are regularly reviewed and updated;
supporting and advising staff who have data protection queries;
communicating with the Information Commissioner’s Office;
reporting to the governing board or trustees about data protection;
advising the governing board or trustees on data protection risks;
advising on, and co-ordinating, responses to information rights requests;
making sure all assets containing personal data are appropriately managed and secure.
There are many different options for who to appoint as your data protection officer or data protection lead. You could:
re-align responsibilities in your current team;
share the data protection officer role between a group of schools;
ask for volunteers within the wider school community;
consider procuring a contracted service.
Whoever you decide to employ, it is crucial that your data protection officer is familiar with:
data protection;
UK GDPR;
the way your school operates;
the technology and systems you use;
cyber-security.
The data protection officer role includes a significant level of responsibility so you should make sure they the individual employed has the appropriate amount of time, resources and support to carry out the role effectively.
Be the first to comment