DPO Request

[HBPS]

Our DPO (External) is intending to commission an independent audit from his technical colleagues anyone had any experience of this?

 

not that i'm worried just think its a lot of money to pay for his colleagues to come and look at a school network cctv and door access system

 

Thanks

[Ditto]

Are you saying they want the school to pay for an audit? It sort of has a slight conflict of interest feel too. If yes, I'd suggest trying ICO's advisory audit - https://ico.org.uk/for-organisations/audits/apply-for-an-advisory-visit/. If they've done their job well, you should get a good report.

[HBPS]

Yes close to 1000 pound

[Ditto]

I wouldn't agree to that, it's just not independent enough. Have a look at the ICO link - I'm sure it was a free service - not sure if it is still. Hopefully @GrumbleDook will pick up on this thread - he will have pertinent comments to make.

[GrumbleDook]

You can have two arms of a company work independently of each other so that one provides a service and then recommends others.

It is a fine line but possible. To some extent it comes down to how much you trust the company and their ethics.

 

We tend to veer towards self assessment and where that has gaps then address as needed, including using independent services.

 

To some extent, this is the model for Cyber Essentials too.

 

It may be that the DPO has already identified a need to review something and this is part of the process.

 

As I’ve said though ... it is a fine line.

[HBPS]

Are you saying they want the school to pay for an audit? It sort of has a slight conflict of interest feel too. If yes, I'd suggest trying ICO's advisory audit - https://ico.org.uk/for-organisations/audits/apply-for-an-advisory-visit/. If they've done their job well, you should get a good report.

 

So i passed this link to our SBM and raised the concern that the colleagues he is intending to send out do primary school IT support packages and seems a way to try make money out of it for another department

[GrumbleDook]

ICO Advisory visits have been really good in many respects but you have to remember that they have a consistent approach and language no matter if you are a school, a charity, a large company with a turnover of £12m, someone with 300 employees and 20000 customers ... for some schools it becomes very scary, very quickly and some schools will need reassuring. ICO do their best with this from what we have seen but schools tend to have a very worried approach to anyone coming in to audit things.

 

Sometimes having people who know schools better, are more aware of the language in place, the context and issues ... they are valuable and worth the time and money. Also, they can be constructive about options as well ... ICO cannot advise on specific technologies really, only say where there are gaps, where improvement is needed, where you meet the requirements ...

 

It really does depend on what you are getting from the service.

[Ditto]

ICO Advisory visits have been really good in many respects but you have to remember that they have a consistent approach and language no matter if you are a school, a charity, a large company with a turnover of £12m, someone with 300 employees and 20000 customers ... for some schools it becomes very scary, very quickly and some schools will need reassuring. ICO do their best with this from what we have seen but schools tend to have a very worried approach to anyone coming in to audit things.

Sometimes having people who know schools better, are more aware of the language in place, the context and issues ... they are valuable and worth the time and money. Also, they can be constructive about options as well ... ICO cannot advise on specific technologies really, only say where there are gaps, where improvement is needed, where you meet the requirements ...

It really does depend on what you are getting from the service.

Whilst I agree with what's said here, I just couldn't bring myself to accept a near £1000 spend is value for money when there are other options. As pointed out, if you can keep in perspective the language the ICO may use, it can be helpful. For me it helps you along the journey which is a key factor. Don't try to fix everything at once though! Also, look to collaborate with other schools - I bet if you audited another school and they returned the favour, you would find improvements to make at both sites.

Edited April 30, 2019 by Ditto