GDPR Data Audit - template for all staff to use

[BlueSkies]

Hi there,

 

We have been looking at designing an audit form that individual teachers can use to identify the PII data they currently hold in their "My Documents" area of the network. I imagine that they will all have copies of annual reports, class lists, IEPs, assessment data, check lists, photographs, etc - some possibly going back a number of years.

We were thinking of issuing each teacher with an audit form onto which they can record what they currently have saved in their My Docs areas in order that we can "see" where all the data is in order to then be able to apply some data retention policies to - resulting in the deletion of quite a proportion of it I imagine!

I have seen some data audit templates posted on here recently (thank you for sharing!) and am looking at whether I can use a similar type of document.

 

Has anyone else gone down this route for individual teachers/admin staff?

[enjay]

I'm not sure you need to know which teacher has what, you just need to identify the types of data which a teacher might hold and then assume all teachers hold all that information (they're all doing the same job, after all). Alternatively, for simplicity, assume ALL data which is held in SIMS has at some point been exported into a staff member's MyDocs folder, and define your policy from there.

 

We are probably going to tell staff to keep student information in sub-folders by year then they just need to delete the 2016-17 folder at the start of 2017-18, 2021/22 or whenever is appropriate. No audit necessary, and no need to police thousands of files in hundreds of MyDocs folders.

 

Remember some data has a longer statutory retention period though, so staff will need educating in that and to store it separately.

[Andycat]

Remember some data has a longer statutory retention period though, so staff will need educating in that and to store it separately.

 

Can you advise on this ? (Honest question!)

[enjay]

Can you advise on this ? (Honest question!)

 

Page 37 of https://c.ymcdn.com/sites/irms.site-ym.com/resource/collection/8BCEF755-0353-4F66-9877-CCDA4BFEEAC4/2016_IRMS_Toolkit_for_Schools_v5_Master.pdf

[BlueSkies]

Thanks @enjay - yes, thinking about it ... you are right in your assumption that all teachers will probably be holding SIMS related exports, etc. We really also wanted to use it as an exercise to have a good old clear-out of archived files that people really do not need to hold onto (armed with retention policy) and to set out a way forward - just as you have described, with each teacher having a folder per academic year that can then be archived/deleted accordingly. Perhaps the way forward is to create the retention policy first and then have staff use it as an initial "spring cleaning" guide with a view to then using it as an ongoing "housekeeping" guide in future.

[enjay]

Perhaps the way forward is to create the retention policy first and then have staff use it as an initial "spring cleaning" guide with a view to then using it as an ongoing "housekeeping" guide in future.

 

100%. You can't ask staff to clear out files they no longer need until you have defined what they don't need, or rather what they mustn't still have.

[mthomas08]

I'm not sure you need to know which teacher has what, you just need to identify the types of data which a teacher might hold and then assume all teachers hold all that information (they're all doing the same job, after all). Alternatively, for simplicity, assume ALL data which is held in SIMS has at some point been exported into a staff member's MyDocs folder, and define your policy from there.

 

This, it makes life simple. Our audit is not far from being complete - bar all the generic stuff we know most staff hold in their areas.

 

Staff will hold a load of copies of student names in their areas or the shared drive - we know why 99.99% of this is being held. We are going to double check with everyone anyway just to be safe.

 

A dozen staff are down for data controllers, they hold sensitive data outside of SIMs and it's paper/electronic copies. This is the main priority which is almost finished.