Cost of an outsourced DPO

[maturelady]

I'm investigating the costs associated with schools implementing GDPR.

 

Does anyone know of the costs relating to engaging an outsourced DPO? What do these people offer in terms of understanding what goes on in schools?

 

Has anyone got any quotes? Your thoughts on what is being offered?

 

It would be good to share this with others, rather than guessing what should be charged.

 

Thanks

[MrWrighty]

I don't think this would work The responsibility is huge and a DPO would need representation on the SLT and be in charge of policy making. An external DPO would be very very expensive even if it were an option. Consultant fees for the likes of Risk Management and Health and Safety can be anything from £350 to £650 per day so you would soon run up a very large bill for an external DPO.

 

See this from @GrumbleDook

 

And breathe ... and relax.

 

This is a significant role with a lot of responsibilities.

Operationally, yes ... you are likely to be involved in a lot of the work, but in the same way Heads of Year have a significant pastoral role... it is the Designated Safeguardian Lead that holds the responsibility.

 

Data protection is not just about cloud or electronic records ...

 

You will be setting strategy for the whole school, possibly rewriting sections of school policies ... even to the point of getting T&Cs of staff changed!

 

You will be instructing teachers in their work. You will be holding them accountable for any breaches of policies, including raising of disciplinary actions. You will need a designated budget to make any relevant changes as well ... which I can see going down well.

 

In the same way a DSL does not have to sit on SLT, but they are an acknowledged responsibility holder with legal obligations.

 

The trainer got us good, but it should be a two parter ... you handle operations and a member of SLT holds responsibility and accountability, and you work together on strategy (but the SLT member has final say on any proposals to take to the rest of SLT and Governors)

Edited August 29, 2017 by MrWrighty

[GrumbleDook]

@maturelady and I have been chatting about this already ...

 

I've already heard some LAs are looking at what they can do, as well as some folk offering it in other sectors. To some extent this is more about whether any EG Members have heard of any offers.

[MrWrighty]

@GrumbleDook, based on me quoting your text above, do you think that an external DPO is an option. Given your response I would have thought it a difficult role to fulfil for an external DPO.

[GrumbleDook]

This is a difficult one ... technically the school is the authority ... so does this mean that if using the LA or exec arm of a MAT / Trust is this outsourcing?

 

I'm looking for examples to see what is being offered so that we can raise specific points with ICO, DfE, lawyers and general GDPR experts across a range of sectors.

Edited August 29, 2017 by GrumbleDook

[maturelady]

Sadly one of the authorities I mentioned to you @GrumbleDook have been instructed 'from above' to NOT offer the service. They were really keen too. They have been told that there is too much risk.

 

I despair!

 

Let us know if you know of any LAs in England, Wales or N Ireland offering a DPO service. Scottish schools are different, the LA not the school is data controller - the buck is 100% passed north of the border.

[GrumbleDook]

To some extent I am not that surprised ... many LAs are being risk averse at the moment.

 

Time to chat to SOCITM perhaps.