Crowdsourcing information on suppliers - Can you help?

[Ceegac]

Hi

Just wondering if it's worth some of us contacting individually and updating as we get replies? So that the onus is spread across the group?

I would be happy to contact some & share results (otherwise I guess I"m contacting all myself anyway!)

Thoughts?

[Andycat]

I thought that was the point of this thread, that we'd all get a response from here?

[Ceegac]

Sure - I was looking at the Spreadsheet and there are no responses received though; if we have contacted suppliers should we just copy in the responses?

Some of them refer to GDPR on their website privacy policies so we could put in links to them?

[Ceegac]

I've filled in the sheet for Groupcall - see what you think - can fill in others as I do them and would be great if others could do the same!

[localzuk]

Has anyone had any responses from anyone else on the list? Going to be hitting our internal list hard soon.

[minimoo]

Is it worth 'crowd sourcing' responses? I'm happy to help set up an open wiki (e.g. on github) of responses/links to the supplier - and even send off a template email to all of the suppliers on the list and upload any responses back into that wiki if someone wants to help draft the information email. Can do the leg work this weekend if it would be helpful.

[tj2419]

Am I correct in thinking this isn't going to be updated by the original poster before 25th May? I see the last update said there would be a post at the beginning of March? I'd be happy to work on one we all update just seems a shame if the work has already been done.

[minimoo]

I've spent 20 minutes drafting a possible template:

 

If the below looks like it might be a good template, i'd look at getting a wiki sorted with a template that responses could be pasted into - for anyone to see / use / edit how they see fit, and then sent off a few emails.

 

Hello,

 

As a company that receives/process personal data on behalf of schools, I'm contacting you to ask if you would kindly make available some information on your preparations so far for the General Data Protection Regulation (GDPR) which comes into force in May 2018.

 

As an individual, I work for a school, however my purpose for contacting you is I would like to make your response available or provide a link to the information that other schools can use. Your response will be uploaded to an open wiki at . Where all schools in the country will need to ensure that they are covered for their GDPR requirements, by making the information available in a public location that anyone can edit, I hope it may be useful to both schools and supplies as they struggle to prepare for the GDPR changes.

 

To do this, I would appreciate if you could answer the following questions:

 

PROCESS

 

a) Could you provide a copy or link to your "data sharing agreement" for schools?

This should include: What data are you processing on our behalf? What are the common legal reasons for processing it?

b) Have you conducted a data mapping exercise. If so, can you provide a copy of this

c) Please provide us with details of your organisation’s GDPR compliance. What processes and procedures do you have in place to protect personal data under the GDPR?

d) Please provide us with a copy of your privacy policy.

e) What technical and organisational security measures do you have in place to protect personal data? Do you have any accreditations ? e.g. ISO27001 or SAE16 .

 

 

DATA STORAGE

 

a) Could you outline your data retention policy (including how long do you keep it, how will you get rid of it)

b) What facilities do you have in place to restore data in the event of a technical incident?

c) Please can you state where you you store/host personal data from schools (e.g. in the EU or outside the EU) and is the data encrypted when stored?

 

ACCESS

 

a) Do you share data from schools with any other 3rd party e.g. data processing sub-contracted to third parties

b) If yes, have you evaluated their use of the data against your policies provided above

 

COMMUNICATION

 

a) In the event that you or a 3rd party is involved in a cyber attack, or a data loss incident, can you outline your communication plan?

b) What is your preferred method of contact for schools with Data protection issues/queries

 

[minimoo]

In terms of this (And thanks for the thanks) - does anyone have any improvements to that template, or see anything obvious missing ? I would send off an initial question on wednesday or thursday evening

 

I contacted github regarding the username 'edugeek' that was dormant, and they've released that username - so whilst I do want to have a check with the admins from here first (and potentially transfer to someone more appropriate), I have got setup and have control of https://github.com/edugeek as an organisation; which could be useful for a collection point for some of the projects i've seen downlaodable on edugeek before, and for a location for a wiki ( assuming there's no plan to fix the current wiki which we couldnt' log onto)

[Sir]

I like the idea of a central resource place such as this. I know it is a little dated and refers to the DPA but this is a good link and an trying to see tif there is an updated matrix.

https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/644845/Cloud-services-software-31.pdf

 

See supplier checklist at the bottom with links.....

[mwnci]

It seems that most suppliers are posting their GDPR response on their websites. I think a starting point would be to populate the 'Response Received' column in the spreadsheet with the link to each relevant page.

 

I've made a start...

[titch]

Just wondering if this is still being updated? If not is there something similar people have been working on that I have missed?

 

Thanks