GDPR and printing - do we need a managed print solution?

[NotSoFast]

As per the title, really. We currently have department rather than individual codes and some photocopiers in public areas, which is obviously not great as sometimes printouts are left out for all to see. If we move the copiers into staffrooms, and implement a policy/procedure which states staff must collect confidential documents immediately, is that good enough, or do we need to find the money for Papercut (or something else - cheap recommendations gratefully received!). One argument I have heard is that in the case of a breach we have to be able to pin down who sent the print job.

[RichCowell]

Depending which printers/copiers you have, you may be able to print to a user box on the devices so they need to be released with the code at the device rather than being printed immediately. Worth checking to see if they support that - could save you a fortune...

[pete]

As per the title, really. We currently have department rather than individual codes and some photocopiers in public areas, which is obviously not great as sometimes printouts are left out for all to see. If we move the copiers into staffrooms, and implement a policy/procedure which states staff must collect confidential documents immediately, is that good enough, or do we need to find the money for Papercut (or something else - cheap recommendations gratefully received!). One argument I have heard is that in the case of a breach we have to be able to pin down who sent the print job.

 

It's a risk assessment. If you (school) know your staff do daft things and education (or lack of enforcement) doesn't fix the problem, then yeah...you need to do something.

 

I'd say you at least need to make it harder for people to do daft things. Set staff default printers to those in staff-only areas, for example. Providing you're keeping event logs for long enough, you should be able to work out who printed something (assumes everyone prints to a shared printer hanging off a printserver), but something like PaperCut does make that much easier.

 

You should be able to set user box codes on each copier and your copier vendor should have tools to replicate those settings across all your copiers.

Edited January 16, 2018 by pete

[HollandSchool]

We've just renewed our copier contract and at the same time installed additional software called Papercut or Follow Me Print. Rather than sending the document to a specific copier to be printed you choose Papercut to print from. This is then held on the server until the user swipes their ID card over a scanner on any printer (stickers for card provided by Papercut supplier) which then releases their document. You can choose how long documents are held for before being deleted.

[dry]

Thought it'd be worth mentioning that PaperCut's Print Logger is free: https://www.papercut.com/products/free-software/print-logger/

[TMBS]

We used to only allow staff to print to a 'secure' area, usually the staffroom where students aren't allowed. We now use PCounter which has follow me printing so all staff have to input their own pin to print. Obviously no staff share their code, or give it to students on a post it note...

[free780]

The ideal from a GDPR perspective is to not print at all. As it's very easy for data to leak. Comparable to unencrypted USB sticks or laptops. Files can been controlled. ACLs, Azure information Protection etc. But it would be very hard to implement this.

[Big_Ted]

from a GDPR POV you wouldnt hold any data or ever print anything. But... in the real world you will and people will be careless. Print systems like papercut can help in all sorts of ways here so you have acountability.

I would start here:

https://www.papercut.com/download/?http=https%3A%2F%2Fcdn1.papercut.com%2Fdocs%2Fsecurity%2FGDPR-Compliance-Guide-2018-01-29.pdf