GDPR compliant software

[genesis]

Hi

 

We have subscribed for autodesk software and they give it free for schools. If students have to use the software they have to register putting their name and email address on autodesk website . In regards to GDPR do we need to fill in DPIA Form.

I assume Autodesk are GDPR compliant and please advise.

 

Thanks and any help much appreciated.

[msi_school]

All software should have a DPIA assessment, the outcome may be that one is not required but by undertaking and recording the process you have shown due diligence. The first question on our DPIA for is does this software require a DPIA and if not why not.

 

I would say that this does because the students are giving their Names and Emails two potentially identifying pieces of information also as Autodesk is an American company you need to find out where this information is stored.

[GrumbleDook]

If the software is being given away for free and registration is on the publisher's site, then you really need to check the terms and any agreements. You may find that they set themselves as the Data Controller and the school has a minimal role. It may also be that consent is the lawful basis ... and that should not be used in software that a student is *required* to use ... as it would not truly be consent!

Speak with your DPO or DPOaaS provider.

[Dos_Box]

Moving to Data Protection froum.

[genesis]

Will the DPIA form be specific to a school or if it generic , please post.

Or

Will the software vendor produce the DPIA form to us if we are going to use the software?

Thanks

[jmak]

The DPIA is to ensure that you have assessed the risks of giving someone your data - don't trust the person you're giving the data to to check that they're suitable people to give data to.

 

There's a template on the ICO website:

 

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/accountability-and-governance/data-protection-impact-assessments/

 

But your school should already have a template. It is a requirement every time you share data. So your DPO should be able to give you a template - and show you the ones they completed for each of the online services your school has signed up to.

[GrumbleDook]

Will the DPIA form be specific to a school or if it generic , please post.

Or

Will the software vendor produce the DPIA form to us if we are going to use the software?

Thanks

 

DPIAs are a risk assessment. Vendors won’t (can’t) know all your risks as they are relevant to your school, though they are likely to be aware of most possible risks … as it is (or should be) part of a suitable development programme (and yes, our Devs just love me ;-) ). However, we cannot guarantee the software will be used as designed. We just try to give as much info as we can.

 

A good vendor will provide with a clear Data Processing Agreement (see https://classroom.cloud/data-processing-agreement/ as an example), with associated technical information (https://classroom.cloud/wp-content/uploads/2021/11/classroom.cloud-Security-Request-for-Information.pdf for our example) and further guidance to support how you make decisions on security and privacy (https://classroom.cloud/privacy-by-design/ for our example).

 

The ICO has a general DPIA template (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/accountability-and-governance/data-protection-impact-assessments/), but If your DPO does not have appropriate templates then working with people like the Education Data Hub at Derbyshire County Council, and compliance tools like GDPR in Schools, might be the best bet.