Data Protection - Transfer data to others

[Dancer]

We transfer lots of data with lots of other companies/organistions.

I've yet to find a company that dosen't tell you that they fully comply with the data protection act and your data will be completely secure.

but what checks (due diligence) do you carry out prior to transfering data that all is secure and above board?

 

Often decisions have been made to transfer the data before it gets to me to do and when I ask questions about the organistations and their security I get vague answers and told to get on with it.

Does anyone have a "checklist" I could issue to senior/middle management to use when signing up to transfer data?

[Dos_Box]

You should have written and signed agreements from the receiving company about the steps they take to keep the data protected with if it is an outside organisation. For schools this would be, for example, to another LEA outside of your own, as you would fall under the umbrella of your LEAs data protection policy.

[Dancer]

You should have written and signed agreements from the receiving company about the steps they take to keep the data protected

 

Thanks Dos_Box

Will add a requirement to have written agreement on how the data will protected and used to the schools data protection policy.

 

Is it enough to just to accept these assurances?

[GrumbleDook]

2 key things ... the written statement (or in the contract) should state that they will comply with all data protection laws and follow *your* data compliance (ie only make use of the data for the things that *you* state the data should be used for).

 

You may need to inform the data owners (ie tell parents and students) who will have access to the data outside of the schools (from the LA point of view, usually communicated via the Fair Processing notice) but you might have to just add it in an appendix to your published data protection policy.