Sharing Data Externally

[pleipper]

Hi Guys,

 

Our school would like to set up an external dedicated server with the intention of storing "some" information about students in a database on there, used for a web application.

 

My question is, does anyone know what protocol our school will need to follow in order to do this all legally? I heard something about a data sharing agreement? Not quite sure how it would all work though.

 

Kind Regards,

 

Phil.

[GREED]

Realistically your school should already have some sort of data sharing agreement in place between the school and parents. This should layout what information you collect for what purposes and what third party organisations have access to it. The only exception is the statutory collections for the DfE (although you should still tell your parents this).

 

If you have a data sharing agreement in place, check the wording to see if this new venture covers this, if not you should reissue and inform parents of this. Many DSAs simply cover broad data areas and uses as a catch all.

 

If you do not have a data sharing agreement in place and you are collecting and sharing data about students/parents... suggest you get one as a first port of call, lest the LA or ICO decide to pay a visit!

 

You should also read up on the Data Protection Act to ensure your venture falls within this remit - and above all ensure parents know about it too. Out of interest what is it you are trying to do?

[Banjo]

This site is worth taking a look at. https://www.gov.uk/government/publications/data-protection-and-privacy-privacy-notices

 

Include any changes or sharing of data into your schools privacy notice. The priviacy notice should be available on request at the school office and should ideally go out to students/parents as part of the "induction pack".

[Oaktech]

If you satisfy the above, then be really, really careful about your security. Depending on what you are sharing, you are opening up a really juicy target here!