All the excitement (if that’s the right word) about GDPR seems to have moved on now so we thought we it was time to conclude our blog and reflect a little on what we have put in place, what we might do differently and what we still want/need to do (as GDPR certainly hasn’t gone away!).

Well, the world hasn’t collapsed following the introduction of GDPR and I’m not aware of any school prosecutions yet, in spite of all the warnings and horror stories from companies trying to get our business. Overall, from our perspective, apart from taking up some time it feels as though the process that we went through has been a good thing: we have tightened up our practice; put training in place for everyone so there are clearer expectations of staff; given more thought to what and where our sensitive data goes to, how it is processed and who it is shared with.

On reflection we’re not sure what we would do differently and this isn’t because we think we’re perfect, but we have stumbled our way through the issues and nobody has said we’re doing anything wrong and there aren’t any prosecutions pending! I know I’m pleased that we didn’t shell out lots of money to a third party to ‘do’ GDPR for us, although I know some headteachers have told us they felt it was money well spent. Having our school business manager as the DPO seems to work as there is appropriate separation given the role of our governors with oversight.

So, we seem to have things in place now: policy, privacy notice, training, roles. But we still think there is more we can do: constant vigilance and monitoring of practice is one as well as building training into our induction programme and regular annual updates. We are also continuing to pursue the idea of a significant overhaul of our website to allow greater interactivity for parents with personalised accounts so they can update their personal details as well as access assessment and attendance information.

Anyway, this is us signing off! We hope you have found our ‘warts and all’ blog helpful.

We had an ‘incident’! OK, here’s the story …

In July we hold Meet the Teacher meetings for parents to meet the new staff team and hear about the next academic year. One of our staff was holding a class list with first names with some asterisked (although there was no key indicating what the symbol indicated). A parent managed to take a photo of it with their smartphone and then posted it on social media, a bit like when some photographers have managed to take sneaky photos of team lists being held by football managers. A parent then let us know this had happened so we needed to make a few decisions.

Was this a data breach? Yes.

Did we feel it was seriously compromising and reportable to the ISO? No.

What other action should we take if any? We decided to write a general letter to parents making them aware of the matter. The incident was also shared with the governing body.

Well, that was exciting! Because of GDPR at least we now have protocols for us to refer to when an incident like this occurs.

Although there is no longer a statutory requirement for home/school agreement we still maintain our at Chase Bridge. We think it’s a good way of reminding ourselves of our shared values and ways that different sections of the school community work together, as well as inducting new staff and families.

So, why is a home/school agreement part of a GDPR blog?!  Our document has been updated to include reference to data, privacy, sharing of information – all the GDPR things that we have been trying to address – for parents, staff, children and governors. It is just a way we have found of systematising and communicating our practice, trying to ensure universal coverage where no one gets missed out. Hope you find it useful.