chekmate1984 Posted September 25, 2020 Posted September 25, 2020 Hi all Been told to create DPIA for the list below by the SBM. Do you guys usually create one for each or is it just few of the listed below? os is it overkill and only need specifics done? Also do you usually just write 1 or 2 sentence in each section or go in detail and essay style? AD Classcharts Office 365 Papercut PArent Pay Ruler Senso Shared drive Sims Website Thanks
GrumbleDook Posted September 25, 2020 Posted September 25, 2020 Have a look at https://www.educationdatamatters.org.uk for examples of DPIAs.
paulkerton Posted September 25, 2020 Posted September 25, 2020 Have a look at https://www.educationdatamatters.org.uk for examples of DPIAs. Can we get GrumbleDook his sceptre and crown as the deserved King of Education Data Protection already? Never seen this resource before. It's great! Thanks for sharing it.
Ditto Posted September 25, 2020 Posted September 25, 2020 This is a typical example of confusing IT and data. Some of those in the list really ought to be completed by those that own the data. SIMS for example. IT might setup and support the system, but the data is probably everyone's apart from IT. At the very least, collaborate with the data owners. When I installed CPOMS, I had the SENDCO fill in the DPIA. She was absolutely fine about it and I provided support, such as explaining the meaning of some terminology. The added benefit was they developed a much better understand of GDPR. 1
DrBeaker Posted September 25, 2020 Posted September 25, 2020 This is a typical example of confusing IT and data. Some of those in the list really ought to be completed by those that own the data. SIMS for example. IT might setup and support the system, but the data is probably everyone's apart from IT. At the very least, collaborate with the data owners. When I installed CPOMS, I had the SENDCO fill in the DPIA. She was absolutely fine about it and I provided support, such as explaining the meaning of some terminology. The added benefit was they developed a much better understand of GDPR. I was thinking this too. As long as you can get the data in/out, what they do with it is up to the service owner e.g. CPOMs is safeguarding etc. 1
GrumbleDook Posted October 1, 2020 Posted October 1, 2020 Hi all Been told to create DPIA for the list below by the SBM. Do you guys usually create one for each or is it just few of the listed below? os is it overkill and only need specifics done? Also do you usually just write 1 or 2 sentence in each section or go in detail and essay style? AD Classcharts Office 365 Papercut PArent Pay Ruler Senso Shared drive Sims Website Thanks Does your DPO not have templates or tools for this? (Declaration of interest ... this is my day job) 1
AndyCrow Posted October 16, 2020 Posted October 16, 2020 Following on from @GrumbleDook@s point. The process should not be purely an IT issue. The DPO should provide the template with the questions, the area of the school that want to introduce the new product/process should fill in the document ( as they are using it) and IT should be asked only in specific areas. The DPO will then read and give the OK if all is fine and ask for Governors to sign off. 2
DrBeaker Posted October 16, 2020 Posted October 16, 2020 Does your DPO not have templates or tools for this? (Declaration of interest ... this is my day job) Following on from @GrumbleDook@s point. The process should not be purely an IT issue. The DPO should provide the template with the questions, the area of the school that want to introduce the new product/process should fill in the document ( as they are using it) and IT should be asked only in specific areas. The DPO will then read and give the OK if all is fine and ask for Governors to sign off. Thanks these especially will be useful tips for something I'm having to get involved with. Are you both of the opinion it should be what I called the "service owner" e.g. English department completing the document mainly?
Ditto Posted October 16, 2020 Posted October 16, 2020 Thanks these especially will be useful tips for something I'm having to get involved with. Are you both of the opinion it should be what I called the "service owner" e.g. English department completing the document mainly? Absolutely yes. As I said earlier in the thread, support and help, but it needs to be the data 'owner' leading completion of the document. 1
GrumbleDook Posted October 19, 2020 Posted October 19, 2020 Thanks these especially will be useful tips for something I'm having to get involved with. Are you both of the opinion it should be what I called the "service owner" e.g. English department completing the document mainly? Yes and no .... There are large parts of a DPIA that might not be understood by the 'project' owner (We'll call them that, rather than the data owner ... or more correctly, the Information Asset Owner) but they will be key for establishing the purpose for processing, what data needs to be processed (not what they 'want' but what is needed) and how long they need to keep it for (again, need not want). Evaluation on the security of the data during transfer, within the tools that are being used, any safeguarding and privacy concerns ... it is a group effort. Doing a bit yourself and passing to the next person can be done, but it really is not the best way of doing it. Of course, your methods may vary, depending on the templates you use (declaration of interest again ... I work at a company supporting schools with this) but there are a number of good ones out there that are available as templates (Including some of ours). Where possible, work as a group, not in multiple silos. 1
Waringmeout Posted January 18, 2021 Posted January 18, 2021 Hi, did you create the DPIA for all those systems? Would you be able to share (especially the SEnso) them with me? Thanks.
nomad711 Posted February 5, 2021 Posted February 5, 2021 Hi, I was wondering if anyone has been asked to produce or help with DPIA's for software that is installed on classroom PC's, say Flowol, Scratch, and other's like Audacity and VLC if staff are using them? These sort of programs don't really feel like they are going to need DPIA's. After all staff were asked to put forward all the applications that are used in school to the GDPR officer It's now fallen on IT to either provide them or help support with their writing. Has anyone gone into this much depth having to account for every piece of software deployed or downloaded? Thanks.
Steve21 Posted February 5, 2021 Posted February 5, 2021 Nope, because they aren't using personal data etc or special categories. But if you really are being forced to, surely it's a one-liner that says it doesn't use personal data, no risk Steve
nomad711 Posted February 5, 2021 Posted February 5, 2021 Thanks Steve, that's what I was suggesting and hoping for!
robyholmes Posted February 5, 2021 Posted February 5, 2021 I understand them to be a tool you use, no external access to data used in them, stored locally (or in a cloud system you already use). Bit like a pen or filing cabinet.
GrumbleDook Posted February 9, 2021 Posted February 9, 2021 If you look at the exemplar DPIA that Derbyshire CC did on Zoom/Teams, you will see there is a set of screening questions. I would also look at compliance systems have these templates too. This is an easy way of checking through a lot of software and systems to see where personal data might be used, directly or indirectly (viewing and monitoring of screens is going to show some personal data!).
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now