Who does what in the SAR process?

[leegcvcc]

Hi All,

 

I was wondering who does what in the SAR process in your place?

 

Here, I.T. collate the raw contents based on searches of the network, email, OneDrive etc and go through it (removing duplicates or whatever isn't required)

CPOMS is looked at by DSL person

 

 

-Who does the redaction? (and what do they use if known?)

 

-Who actually finalises the data to be provided to the parents/staff requesting the SAR?

 

-Should IT be more involved than just giving someone senior the data for redaction and sifting more finely?

 

Any help appreciated.

[Brax]

Hi All,

 

I was wondering who does what in the SAR process in your place?

 

Here, I.T. collate the raw contents based on searches of the network, email, OneDrive etc and go through it (removing duplicates or whatever isn't required)

CPOMS is looked at by DSL person

 

 

-Who does the redaction? (and what do they use if known?)

 

-Who actually finalises the data to be provided to the parents/staff requesting the SAR?

 

-Should IT be more involved than just giving someone senior the data for redaction and sifting more finely?

 

Any help appreciated.

The school should have a DPO to deal with all the points mentioned. Assume there isn't one? IT should not be involved beyond gathering data requested.

[techy32]

The IT department collects data from various sources such as email, Workspace, Arbor (typically managed by the MIS personnel), and CPOSM (DSL). The responsibility for deciding on data redaction lies with the school, and ultimately, it is the headteacher who holds the responsibility for determining which data is disclosed.

[leegcvcc]

The school should have a DPO to deal with all the points mentioned. Assume there isn't one? IT should not be involved beyond gathering data requested.

 

Thanks for the reply. We do have a DPO but they are external and want paying for the redaction of the SAR etc (which SLT aren't happy about the cost) , hence my question. I'm pretty sure SLT should be more involved in the process, but hard for me to say that's what other schools do, as I don't actually know what other schools do.

Edited January 5, 2024 by leegcvcc

[jthompson]

IT get the raw data and run some dedupe scripts on email exports before providing it all in PDF. The Google Vault searches are generally as broad as possible, but might become more focussed depending on the scope of the SAR. The redaction is then done by whichever member of SLT is handling it. The data manager prepares an XML file for use with Libre Office redaction tools. The XML file contains a big list of names, email addresses and email signatures to try and automate as much of the redaction as possible. All of that can be done pretty quickly now, but ultimately, a member of SLT needs to read through everything, which is where the personhours can really stack up.

[leegcvcc]

The IT department collects data from various sources such as email, Workspace, Arbor (typically managed by the MIS personnel), and CPOSM (DSL). The responsibility for deciding on data redaction lies with the school, and ultimately, it is the headteacher who holds the responsibility for determining which data is disclosed.

 

Thanks, but whose responsibility? Who actually does this in schools? Or what do schools do? The Headteacher is responsible for most things

[techy32]

In our school, the head's PA and SLT now handle it. We previously had a DPO managing it, but we opted for outsourcing, requiring us to handle it internally.

[GrumbleDook]

External DPO services come in a variety of flavours and that is usually explained at the beginning. There is a balance to be had as some schools get simple SARs and some have more work to do or get them more frequently. That said, where redactions are needed, it is the people using the data on a regular basis or those dealing with the strategy of what is being used (DSL, etc.) who know what needs to be redacted. Even if you do outsource, those members of the school staff still need to be involved.

[psydii]

Our (external) DPO audits our work and is available to answer any queries and provide guidance. For big complex matters they review the work in progress and the final "package" before it gets sent off.

 

I have day to day responsibility for Data Protection and manage the processes. A nominated member of SLT has oversight and is made aware of any requests and the progress thereof.

 

I complete the validating and scoping of the request (ensuring we have a good audit trail), and the communication with the Data Subject.

 

eDiscovery is performed by IT Services, (which is self auditing), run the SAR export from the MIS, and they reach out to system owners (safeguarding, SEN etc) for other data in scope.

 

Review and redaction depends on the nature of the request. In all cases we have two members of the admin team who specifically have supporting me fulfilling our obligations under the Data Protection Act as part of the their job description. Usually I do the initial filter of the data from eDiscovery and other services then bundle the output into work packages for the admin team who complete the redaction.

 

I review their work and pull the completed bundles together, and again depending on the nature of the request run it past the DPO and/or the nominated member of SLT with oversight. Often though the requests are trivial and are sent through with no further review. Other times we bring in the individuals who are most familiar with the data.

 

The more complex and sensitive the matter the more involvement from SLT / The Head and our solicitors and DPO.

 

Initially we did not have specific members of the admin staff for data protection activities, but it became clear that the review and redaction work could take significant amounts of time and it was not a good use of the school's resources for that to be my time or that of a member of SLT.

 

 

In my absence the member of SLT would run the process, and in the absence of both of us the PA would co-ordinate with the IT team, the admin staff and the DPO to shepherd the request through.

Edited January 5, 2024 by psydii

[pete]

-Who does the redaction? (and what do they use if known?)

[/Quote]

 

For email it's run through Hexamail (automates some of the redaction - still needs checking though) by IT. You can achieve similar results with PowerBI so long as you have some test data for tuning, but Hexamail's cheap and can preserve email threads.

 

For other areas it's converted to PDF by the data owner(s) or (if they're judged a poor choice) by a member of SLT/admin team and redacted using Adobe Reader.

 

Who actually finalises the data to be provided to the parents/staff requesting the SAR?

 

Typically the appropriate headteacher or a member of SLT.

 

Should IT be more involved than just giving someone senior the data for redaction and sifting more finely?

 

From a "provide/source a tool so people can do X more efficiently" or a "OK, if I don't nip this in the bud, there'll be a trainwreck / Bob's about to commit a criminal act" point-of-view? I'd say yes. The former's in-scope as an IT task and the latter avoids reputational damage to the school/trust.

 

From a "should IT be doing data protection work"? Not unless the request involves data for which IT is the data owner or you're explicitly being compensated for having an overview* of data protection.

 

 

*help, point in right directions, remove guns from feet, review SAR before it goes out, etc. Not "do the work instead of the data owners".

[MartinT]

IT (me) does the filtered pull of data in Microsoft Purview plus the conversion to PDFs for redaction.

 

The Compliance Officer and, sometimes, Director of Finance, do the redaction in Adobe Acrobat.

 

The DSL does anything to do with CPOMS.

[leegcvcc]

Our (external) DPO audits our work and is available to answer any queries and provide guidance. For big complex matters they review the work in progress and the final "package" before it gets sent off.

 

I have day to day responsibility for Data Protection and manage the processes. A nominated member of SLT has oversight and is made aware of any requests and the progress thereof.

 

I complete the validating and scoping of the request (ensuring we have a good audit trail), and the communication with the Data Subject.

 

eDiscovery is performed by IT Services, (which is self auditing), run the SAR export from the MIS, and they reach out to system owners (safeguarding, SEN etc) for other data in scope.

 

Review and redaction depends on the nature of the request. In all cases we have two members of the admin team who specifically have supporting me fulfilling our obligations under the Data Protection Act as part of the their job description. Usually I do the initial filter of the data from eDiscovery and other services then bundle the output into work packages for the admin team who complete the redaction.

 

I review their work and pull the completed bundles together, and again depending on the nature of the request run it past the DPO and/or the nominated member of SLT with oversight. Often though the requests are trivial and are sent through with no further review. Other times we bring in the individuals who are most familiar with the data.

 

The more complex and sensitive the matter the more involvement from SLT / The Head and our solicitors and DPO.

 

Initially we did not have specific members of the admin staff for data protection activities, but it became clear that the review and redaction work could take significant amounts of time and it was not a good use of the school's resources for that to be my time or that of a member of SLT.

 

 

In my absence the member of SLT would run the process, and in the absence of both of us the PA would co-ordinate with the IT team, the admin staff and the DPO to shepherd the request through.

 

Great thanks. It sounds like there are a lot of staff resources being used; we're a single school and not part of a MAT and SARs are very uncommon and processes aren't embedded at all, hence all the questions. Appreciate the responses

[psydii]

we're a single school and not part of a MAT

Same here, but we are quite big so we get a few SAR's a month.

[StevieM]

Curveball - What if it's IT that submits the SAR?

[synaesthesia]

If anyone is involved in redaction or going through any of the data, make sure you are paid and titled for this appropriately - otherwise hands off. Collate & provide data is where the line should be drawn for IT otherwise not involved in GDPR. Been there, done that and it is NOT worth a TLR alone; it should absolutely be done by someone senior level if not in-house DPO.

[psydii]

Curveball - What if it's IT that submits the SAR?

 

We've seen it all already :-/

 

But I refer to my previous response - it would be run by either the PA or other member of SLT and the search would be carried out by a different member of the team.

[leegcvcc]

Same here, but we are quite big so we get a few SAR's a month.

OMG I would jump off a cliff if I had a few a month. A few a year would be bad. Must have good staff and good processes for that to work well! It took me hours to sift through emails. I had 17k from first sift and so many replies to emails regarding other people than the name mentioned initially. I probably need to now find out how to export PST files to PDF!

[dmj]

OMG I would jump off a cliff if I had a few a month. A few a year would be bad. Must have good staff and good processes for that to work well! It took me hours to sift through emails. I had 17k from first sift and so many replies to emails regarding other people than the name mentioned initially. I probably need to now find out how to export PST files to PDF!

 

pretty much as soon as GDPR became law our SLT chose to limit the data we collected. Email just got deleted after 12months, safeguarding data must be kept on a separate system, etc etc. It must have saved the school thousands of pounds over the last five years. If you don't have the data you don't have to report/redact it.

[paulkerton]

IT being involved with this work is very poacher turned gamekeeper. Complete lack of separation of duty.

[psydii]

IT being involved with this work is very poacher turned gamekeeper.

game keeping pays better, so valid move if you’ve got the personal integrity to make it.

 

But not one SAR in the last five years has involved a conflict of interest from within my team. The complex/sensitive SARs are all HR and SEN matters, and so on several occasions the member of SLT overseeing my DP role has had to recuse themselves from the process.

 

Most of our SAR’s are actually straightforward Education Record Requests… but depending on the specifics these sometime need to be treated as SARs, so the bulk of my work on the is really checking whether SAR rules or ERR rules need to be applied and signing off on the admin teams’ export of basic MIS data.

[MartinT]

I probably need to now find out how to export PST files to PDF!

 

Add the PST to your Outlook then use the integrated Adobe Save As... PDF function after selecting all messages. Warning, it takes time and makes massive files.

 

You will need full Acrobat for this and the redaction work.

 

Put it all in a Team Channel with restricted members depending on who will do the redaction work.