DPIA for moving from an on prem MIS to cloud MIS

[Primus]

Hi all, I was wondering if anyone had recently been through the process of a DPIA for moving from an on prem MIS to a cloud MIS - specifically Arbor?

[vikpaw]

[jonathan.lees]

My school is in the process of moving to Arbor and we haven't completed a DPIA either. Since we are doing nothing new with processing the personal data we have, and solely moving what we have from one system to another, would it require one? I'd just assumed we'd update our privacy statement.

[paulkerton]

Yes, you should absolutely do one. Its a change of provider, a change of cirumstances with the data too.

[CyBeRkId2002]

View the DPIA as a risk assessment - for something like an MIS it would be essential if only to demonstrate due diligence in how you are handling data.

 

Nothing to worry about and shouldn't take too long - the provider should have everything you need. Basically just need to document where data is stored, how it is protected etc.

[dmj]

Here is our template

DPIA template (1).docx

Edited June 2, 2021 by dmj

[vikpaw]

Two things to consider here, 1) data in transit 2) data in new system/location.

 

1) Should be relatively straightforward to cover, secure, password protected method. 2) Requires some effort to map out.

 

For the example given, it was moving from on-prem to cloud, so lots of potential changes happening, in terms of accessibility of the data and additional exposure risks. Cached files, downloaded reports etc. These may already be relevant depending on how access was granted to the on-prem system.

[blueday]

Just wondering how those who have moved away from SIMS to a cloud based MIS have coped with continuing to access the SIMS data. Presumably not all the student info is transferred - there must be many leavers going back years whose data still needs to be retained but wouldn't be transferred over? How do you handle access, or do you export as much info as possible out and store it that way?

[Bigbird7]

My school is in the process of moving to Arbor and we haven't completed a DPIA either. Since we are doing nothing new with processing the personal data we have, and solely moving what we have from one system to another, would it require one? I'd just assumed we'd update our privacy statement.

 

Absolutely a DPIA should be carried out and it should have been thought of as part of the procurement process not an afterthought. Not only is this a new system, but also one that will process high volumes of data and special category data.

[vikpaw]

Just wondering how those who have moved away from SIMS to a cloud based MIS have coped with continuing to access the SIMS data. Presumably not all the student info is transferred - there must be many leavers going back years whose data still needs to be retained but wouldn't be transferred over? How do you handle access, or do you export as much info as possible out and store it that way?

 

I would say all required data should be carried forward. We do lots of migrations and import leavers as well as current students.

 

However, it’s not easy to pull in all historic assessments so exporting reports is a good idea. As well as other important data e.g. staff lists, pupil numbers, finance.

 

With SIMS specifically, check you agreement but the licenses were generally granted in perpetuity. It’s annual support, maintenance and upgrades you pay for. So, when your contract ends you can just keep an old version running on a VM somewhere for access to old data.

 

This was the case when contracted directly with them. It may vary if you got your license via an LA, some other agreement or it was a hosted service.

 

Generally though it’s your data and you have the right to request all of it supplied in a readable format to take with you.

[MrMDHarrison]

Hey, is there any chance this can be sent to me? It's not letting me download from the forum!