Consultant / Advisor and Data Protection

[smarties11]

Hi All,

 

We have someone who is an ex-employee that is doing some consultancy and advisory work around SEN. Essentially this person is our old SENCO who has retired and is now training up an employee for the SENCO role. This is being done on a consultancy basis, i.e. the person is working as a private individual and submitting an invoice.

 

Initially I was told that there would be no need for a computer, network account or SIMS account but now this arrangement has started, I've been asked for all three. This person is viewing and processing data about SEN students.

 

I was wondering how this arrangement works in terms of the data protection act? Do we need some sort of an agreement in place with the invidividual, as presumably now they are classed as a third party and shouldn't be accessing data protected by the DPA. It's a temporary arrangement (until Christmas I am told) so it's just the DP side of things to consider and not GDPR.

 

Thanks!

[pcstru]

I was wondering how this arrangement works in terms of the data protection act? Do we need some sort of an agreement in place with the invidividual, as presumably now they are classed as a third party and shouldn't be accessing data protected by the DPA. It's a temporary arrangement (until Christmas I am told) so it's just the DP side of things to consider and not GDPR.

Yes - you need some kind of agreement in place. An employee will be compelled under contract to read and comply with your policy and procedure - a contractor or supplier won't, unless you put a suitable agreement in place.

[GrumbleDook]

Yep. Perfect answer. Contractor. Get everything you need in their contract. Or make them a fixed term employee?

[smarties11]

Thank you both! I shall get SLT to put an agreement in place.

[Bedders]

...Initially I was told that there would be no need...

 

...It's a temporary arrangement (until Christmas I am told)...

 

Always make the assumption that it could be permanent. Things have changed already based on information you were provided.

 

As others have said, get everything in writing. What their contact is, what their duties are, how they go about accessing data on the network (obviously adhering to whatever policies you have in place relevant to how people should access network material) and whether it requires any special consideration above and beyond what is granted to full-time employees (for example, whether they are allowed to take data off site, or remote access into site)... The list goes on.

 

The clearer the content you have in writing the better it will be for you, for the school, and for your contracted staff member.