Questions you should ask your MIS about GDPR

James Weatherill - 5 September, 2018

School Operations

Category : Blog

Questions you should ask your MIS about GDPR

Questions you should ask your MIS about GDPR

As you’ve no-doubt seen from the relentless marketing by third-parties – GDPR came into force in schools in May 2018! The below is our take on the questions you should ask your suppliers, including your MIS to ensure you’re GDPR ready. Just copy and paste!

Why should schools & MATs care about GDPR?

GDPR introduced significant new compliance obligations for schools and new requirements for the processing of children’s data, notably increased governance requirements and much higher fines if schools & MATs fail to comply (upto the greater of €20m or 4% turnover). Ensuring compliance is unfortunately a good deal of work, but you can lean on your systems providers to do a lot of the heavy lifting for you.

Questions to ask your MIS

Your MIS is the key source of student and staff information you have in your school, including most of what GDPR would constitute ‘personal data.’ It’s important when preparing for GDPR that you ensure that your MIS is compliant, then you can switch attention to other suppliers and systems that feed off the data in your MIS.

What should your schools be doing now?

There’s a lot of scaremongering by third parties, but Iain Bradley (Head of Data Modernisation) at the DfE has written what I think is a very useful blog that discusses the steps schools should be taking now.

1. Think where personal data is captured during school life – this is likely to include admissions, parental forms, assessment, school trips etc
2. Think about where that data is used – generally it’s for contacting people, for tracking education, or for maintaining regular school facilities and activities like libraries and canteens.  Several, but not all of your systems, may interconnect with the core management information system (MIS)
3. Think who you share that data with – for schools this commonly includes local authorities, multi-academy trusts, the DfE and beyond.
4. Start to ask questions to your system providers – you can use our list above for MIS.

The above steps are often best captured in a data mapping exercise which we’ve done at Arbor, and which Iain from the DfE has done at the primary school where he’s a governor. A copy of the picture is below.

How Arbor can help

Arbor exceeds current data security recommendations. We’re ISO 27001 compliant (the standard in data protection certification), on the government’s G-Cloud framework and accredited to hold sensitive data. We also stress test our processes and procedures by getting tested by third parties and holding cyber qualifications.

We’ve put a presentation together that sums up these points which you can read by clicking here. All in all, GDPR is something that schools should consider seriously, but you should lean on your providers to help alleviate the burden.