DPIA for Microsoft 365 or Google Workspace?

[Ditto]

After a dangerously dismissive reaction from one of our SLT when I asked about a DPIA, as I have learnt they are using a cloud based application (and it turns out they have for 2 years!), I will be rattling some cages. We deal with special category data of enormous sensitive all the time. It made me ponder other cloud based applications. MS 365 and/or Google for Workspace are both candidates and I just wondered if they are often forgotten. So my question is:

 

In your environment, do you have DPIA for those products?

[3s-gtech]

Yes, we do. It’s worth looking at every service, and assess based on what data you share. For instance, just usernames is a bit different to disability and religion data!

 

Also bear in mind the services which plug into M365 for auth…

[synaesthesia]

Yes absolutely. MS, Google and many other large suppliers make doing DPIA's extremely easy so there's little reason not to do one, even retrospectively. Do remind SLT that you're doing it to protect them and the school!

[noelmm]

Our IT provision is supplied by the LA so they complete the DPIA for systems that they provide however when we moved to remote learning as part of the lockdown a few years ago I insisted on a school one for using Teams as it has recording facilities etc. My SLT thought it may be a little overkill, but that's better than not considering these things. I know from feedback from our LA I was the only school who appeared to have done this process.

 

In my opinion, you should always do a DPIA for any new system, even if you don't think you currently need one, that way no one can say you're not doing your due diligence.

[DPOB]

Has anyone been able to square their Google classroom use with their DPIA? I have been alerted to parents seeing lists of student names (which we would not give out on paper but they can get off google classroom). Has anyone read the link and got an opinion on how we should be using google classrooms?

Microsoft Word - Problems with data governance in UK schools- the cases of Google Classroom and ClassDojo.docx (digitalfuturescommission.org.uk)