Contingency Planning & Data Protection – SchoolPro TLC Monthly Newsletter – Issue 7 – March ’20

Common Breaches – Use of IT Systems

We discussed these tips last month but felt it important to reiterate the messages as well as add an additional tip to the list. As we said then, we deal with a large number of data breaches involving the mis-use of IT systems including emailing sensitive data to an incorrect recipient. Many of these breaches can be avoided by following a few simple tips:

• Send email via secure or encrypted systems – if you have to send personal data electronically, wherever possible, don’t use unencrypted or unsecure email. Tools like Egress are designed for sending information securely. Similarly, uploading a document to a secure shared area and notifying the recipient that it is there is a better solution than sending it by email.

   

• Use shared drives or servers instead of email – if you are sharing data within your organisation, it is better practice to save documents to shared drives (whether on internal servers or in the cloud) and notify colleagues that the document is there, rather than emailing documents between you. That way, everyone is working from the most up-to-date version of the document and it is unlikely to be accidentally sent outside of your organisation by an email address being input incorrectly.
• Password protect email attachments – if you have no other alternatives to sending a document by email, ensure that it is password protected before it is sent. Then, send the password by a different medium – for example, by phone. If the email ends up with an incorrect recipient by mistake, they won’t be able to open the attachment. You will also identify quickly if your intended recipient hasn’t received the email when you contact them with the password.
• Use Word Templates – if you have a blank form that you send out to people, save it as a Word Template. This means that the recipient MUST save it as a separate file before the send it back. This reduces the risk of you sending out a ‘blank’ form later on which accidentally has a previous person’s information still completed.
• Remove Metadata – this is referred to in our FOI Request guidance as well. Metadata on a file can reveal personal information such as the original author of the document. This can be done by following the steps found here.