Staff removing school data from storage devices after leaving

[maxrebo]

Just been thinking about all the data staff store on pen drives and what they should do with this data when they leave the school, I`m sure they wont remove any of this when they do leave to go to another school, how could we manage\enforce they remove this when leaving?

I was thinking that they should sign something when they leave stating that they have removed all possible pupil information from all their storage devices?

[ShellfishClive]

With GDPR being enfocred in the very near furture this is going to be an issue for most IT support.

 

The only real way we have found to combat this is to make USB sticks not work whatsoever. If a staff member brings a USB stick in and take data home then leaves the school there isn't much you can do about it. So the best solution we have come up with is to stop USB sticks working at all via GPO.

 

If you really need USB sticks to work you could create a school policy that says you have to use a USB that was assigned by the school and it must be returned to the school when you leave, other than that there isn't much you can do.

[jdoyle]

involve HR/personnel as they should own the staff joining and leaving processes

[djrscally]

You can't enforce it on leaving; better to do what you can immediately. We've got IT support providing a "Data deletion" service and told staff they need to bring their USBs/Hard Drives to ICT with all the personal data dropped into a particular folder, and we'll have IT use sdelete to clean that out. That should mitigate it somewhat, but some is always going to slip through, so like you say it'll have to be in one of the policies they sign on joining that they won't store personal data on their own kit.

 

Has to be on joining because realistically, who's gonna sign anything when you're leaving a job anyway?

[enjay]

The only real way we have found to combat this is to make USB sticks not work whatsoever. If a staff member brings a USB stick in and take data home then leaves the school there isn't much you can do about it. So the best solution we have come up with is to stop USB sticks working at all via GPO.

 

That doesn't cover everything. They could have emailed files home, taken them home on memory sticks before the USB was introduced and of course taken information home on paper.

 

This is an HR policy matter.