Privacy Impact Assessment- GSuite for Education and GMail

[carchibald2]

Hello

Just discovered this website and it's so good to read the forums and find that there are lots of other people out there asking the same questions that I'm brooding over. I keep raising these questions to senior managers in school and in my area but feel my words are falling on deaf ears. I'm a school business officer in a tiny school.

We've decided to go ahead with GSuite as a first step into Cloud-based services, prompted by a realisation that our current data storage is all unencrypted. Starting off with using GSuite instead of a server and adding in GMail while we are at it. I'm really excited and raring to go. I'm working on a PIA as I know this is an essential part of the project. However, I'm really aware that I'm doing it in a bit of a tunnel- sitting on my own in my office with a huge sheet of paper posing questions I know the answer to and then answering them. Has anyone else gone through this experience? I really need to talk to someone who may have questions I haven't thought of!

At the moment I'm just using the ICO paperwork, the Data Protection Toolkit for Schools and the Cloud Computing Services (DoE documents) and Googles own self- certification document. Going through those and scanning for any issues that they advise schools to consider. It all feels just a bit 'simple'.

Any experiences or willingness to share PIA's would be very welcomed

[SMN]

Hi There,

 

Do you have a data protection officer? I'd sit down with them and go through the DPIA with them. They can ask questions and they need to sign off on project as it were or highlight any risks.

 

IT doesn't have to feel complicated for it to be the right thing to do. The DPIA guidance the ICO give is clear and simple, it has to be or people wouldn't complete them.