Assessing Risk in Data Processing – SchoolPro TLC Monthly Newsletter – Issue 27 – November ’22

Data Protection and DfE Updates (including New Cyber Security Standards)

Over the past few months, the DfE has sent out a number of updates to their guidance which impact on data protection work. These are as follows:

• DfE appropriate policy document | GOV.UK
  • Information about the legal basis and safeguards in place for the sensitive processing of special category data and criminal offence data.
  • Update – first published by the DfE. For information – no requirement to update school/trust data protection documentation.
• Data protection: privacy notice model documents | GOV.UK
  • Privacy notice templates provided by the DfE.
  • Update – the DfE has provided an update to some of the templates in the section ‘Requesting Access to Your Personal Data’. The wording of the bullet points on data subject rights as well as the introduction to the list of rights have been updated and made more robust. This has been reflected in our relevant privacy notice templates in Global Documents on the portal. Details can be found further down the newsletter in the New and Updated Resources section.
• Apply for Department for Education (DfE) personal data | GOV.UK
  • How to apply for access to personal data from DfE and its executive agencies.
  • Update – uploaded new versions of the National Pupil Database data tables, Higher Education Statistics Agency data tables, and the application form and guidance. For information – no requirement to update school/trust data protection documentation.
• How DfE shares personal data | GOV.UK
  • Information on how the Department for Education (DfE) and its executive agencies share personal data.
  • Update – updated the section ‘Vision for sharing data’, to show which data can now be accessed through the ONS Research Accreditation Service. For information – no requirement to update school/trust data protection documentation.
• Choosing a school management information system (MIS) | GOV.UK
  • Table helping schools compare systems and choose the right one for their setting.
  • Update – updated the comparison table with additional information for each supplier. For information – no requirement to update school/trust data protection documentation although will be of use when preparing DPIAs for new MIS implementation as required.
• Meeting digital and technology standards in schools and colleges | GOV.UK
  • How schools and colleges can meet IT service and digital equipment standards.
  • Update – cyber security standards for schools and colleges – new section added (Cyber security standards for schools and colleges | GOV.UK). This contains useful information/guidance for schools regarding cyber security. See below for some of the key points we’ve identified from this*.

*From Meeting digital and technology standards in schools and colleges | GOV.UK, here is a selection of the guidance that we feel is important:

You must conduct a Data Protection Impact Assessment by statute for personal data you hold as required by General Data Protection Regulation

The importance of meeting the standard
The protection of sensitive and personal data is vital to:

• the safety of staff and students
• the reputation of schools and colleges
• the confidence placed in schools and colleges
• avoid the legal liabilities which security breaches expose schools and colleges to 

How to meet the standard
You should control access to data in consultation with your IT service provider and the Data Protection Officer. This is to safeguard staff and students as required by the General Data Protection Regulation (GDPR).

To meet the standard, you must:

• understand the definition of personal data
• assess the risk of compromise, and the degree of damage caused by a security compromise, to work out the resources required to protect the data
• pseudonymise or encrypt any personal data while stored and in transit to a third party
• ensure the confidentiality, integrity and availability of the data and systems processing them
• restore complete and accurate data after an incident in a timely fashion
• design and apply processes for testing and assessing the effectiveness of all measures used to safeguard data and its use

There is DfE guidance on:

• academy trust risk management
• data protection for schools

You should have at least 3 backup copies of important data, on at least 2 separate devices, at least 1 must be off-site

The importance of meeting the standard
A backup is an additional copy of data, held in a different location, in case the original data is lost or damaged. If all copies were held in the same location, they would all be at risk from natural disasters and criminal damage.

Backups of important data are crucial for quick recovery in the event of disaster. The safest way to achieve this is to have a pattern of backing up on a rolling schedule. You should keep these backups off the network when not in use and check them regularly.

How to meet the standard
Ask your IT service provider to install and configure your devices to meet the standards described in the technical requirements. If your IT service provider is an external contractor, the scope of this should be included in your service agreement…

Train all staff with access to school IT networks in the basics of cyber security

The importance of meeting the standard
The most common forms of cyber attack rely on mistakes by staff members to be successful. Avoiding these mistakes prevents the attacks.

Basic cyber security knowledge amongst staff and governors is vital in promoting a more risk aware school culture.

How to meet the standard
Staff with access to your IT network must take basic cyber security training every year.

At least one member of the governing body should complete the training.

Remember that the training may change over time with changing cyber threats.

Technical requirements to meet the standard
Staff who require access to your IT network must take basic cyber security training every year. The training should be part of the induction training for new staff.

This training should focus on:

• phishing
• password security
• social engineering
• the dangers of removable storage media

The National Cyber Security Centre has published suitable training materials:

• cyber security training for school staff **
• infographics at the NCSC

At least one current governor must complete the same basic cyber security training. These governors should read the NCSC publication school cyber security questions for governors.

When to meet the standard
You should be looking to implement this standard as soon as you can but within 12 months as a minimum.

** Don’t forget, as your DPO, we have given you access to the NCSC’s Cyber Security for School Staff course through our training site as well. Please come and speak to us if you still have questions about how to access this and get your staff onboard.