Is your school registered as a Data Controller?

[elsiegee40]

It should be!
Register of data controllers - Search here
Data Protection Guidance for Education Establishments - ICO
Notification under the DPA - Must I notify and how do I maintain my register entry?


"Notification is a statutory requirement and every organisation that processes personal information must notify the Information Commissioner’s Office (ICO), unless they are exempt. Failure to notify is a criminal offence.

Notification is the process by which a data controller gives the ICO details about their processing of personal information. The ICO publishes certain details in the register of data controllers, which is available to the public for inspection.

The main purpose of the public register is transparency and openness. The register includes the name and address of data controllers and a description of the kind of processing they do"

In other words, to cover youself under the DPA, your school MUST register with the ICO or your school is breaking the law.

I've just checked our registration and it's fine, but two near neighbours in the independent sector are not. Both have changed hands in recent years and I think that's where the slip has happened.

I can see schools falling foul of this particularly with Academy Conversions. It is easily missed.

[GrumbleDook]

And if you are asked to be the SIRO ... politely tell your Head to go away, as it should be the appropriate member of Senior Leadership.

[john]

and for those who think the Data Protection act isn't an issue for them and doesn't apply an they don't need a Data Protection Policy within school, then they need a quick read of the latest press release from The ICO - Laptop thefts highlight the need for encryption - ICO news release Look at the details of the Holly Park School case!

For those of you who have bursars / heads / business managers who ignore them ensure they read School Financial Management magazine as the November issue has a 2 page feature on Data Protection in schools covering those two breaches and some simple advice on how the DPA affects IT systems (covering usb / portable hard drives, emails, laptops and PCs and mobile phones so not an endless list but some key ones to get you going!)

[glennda]

we are although it expires next year - is this something which just automatically renews?

[john]

we are although it expires next year - is this something which just automatically renews?

You usually get a notification about 30 days before it runs out requesting £££ and confirmation of the names and details on it so write a cheque and voilla

[glennda]

You usually get a notification about 30 days before it runs out requesting £££ and confirmation of the names and details on it so write a cheque and voilla

i'm sure our bus manager can sort that out

[nephilim]

Who do we phone up if it isn't and make it so?

And are there any fines/legal issues if we are not?

[elsiegee40]

Who do we phone up if it isn't and make it so?

And are there any fines/legal issues if we are not?

This link tells you what to do and how much

Notification under the DPA - Must I notify and how do I maintain my register entry?