GDPR for staff laptops and phones

[genesis]

Hi

 

As GDPR going to be effective from May. We have staff carrying school laptops with offline files on it.

I think still the offline data can be recovered when fallen to wrong hands and please let me know how the laptops can be encrypted.

Also they have school emails on their phones and is there a way that we can ask them to keep the school data safe on the phones.

 

Any suggestions much appreciated

[Roberto]

Hi

 

As GDPR going to be effective from May. We have staff carrying school laptops with offline files on it.

I think still the offline data can be recovered when fallen to wrong hands and please let me know how the laptops can be encrypted.

Also they have school emails on their phones and is there a way that we can ask them to keep the school data safe on the phones.

 

Any suggestions much appreciated

 

In these cases you can do things like use Bitlocker to encrypt laptops (if your laptops support this), use things like MDM to regulate both organisation and personal user devices' access to data (including email). Tools are readily available in Exchange/Office 365 policies to lock this down and can potentially allow you to reset and erase a phone remotely whenever you're concerned, and other platforms have similar tools available.

 

As for "ask them to keep the school data safe on the phones." I'm a little worried by this statement. GDPR is a process that should be in place across your whole organisation which should include things like risk assessments of use of personal phones for work and policies created and pushed by your SLT at the highest level to regulate this, not something that can be dealt with as "ask the IT whiz to push a few buttons".

 

To paraphrase myself in an earlier post, there simply isn't "One Weird Trick To Be GDPR Compliant" - every part of the org should be thinking about how it gathers, stores, uses and disposes of data and technical changes to laptops and phones need to be part of this overall set of policies. SLT needs to be telling people to keep data safe, rather than IT 'asking' them.

Edited April 13, 2018 by Roberto

[djrscally]

Use Bitlocker to encrypt the laptops asap. Or if that's not available for some reason, Veracrypt.

 

The problem as I see it with emails on phones is two-fold;

 

1) They sync, and so store sensitive data on the device itself, which will usually be unencrypted (unless it's an iphone or the newest Android).

2) The phones are the personal property of those staff so you won't get them back when they leave, which means you can't verify that any personal data has been removed.

 

You can use exchange's policy thingies to enforce encryption on devices which sync, so that's a good idea. You can of course remotely wipe the phones, but probably most staff won't realise they signed up to that and there'll be hell to pay if you actually do it. The compromise we've gone for is to insist that staff only use the Microsoft outlook app to sync emails to their phones, as that app gives you a "Wipe Outlook data only" option in 365 as well as the "Wipe the whole phone" one, which means we can remove those emails when they leave without it touching their personal stuff. This doesn't prevent them downloading attachments and what have you, so we've written that prohibition into our policies and training (same as for Personal computers at home).

 

As Roberto says, these things need to be formal policy​ - this is bigger than just "IT would like this to happen".

[Sir]

That's what I was going for yet it requires multi factor to be set up in the portal and when I tried that, suggested by 365 support... On my own account.. It was a nightmare as my one time codes for each device I was using kept asking for the code... I had copied mine down to a secure file... But I can just imagine the support tickets I would get from all the staff trying to sort this for them all!