Where applicable, the name and contact details of the joint controller and data protection officer The purpose of the processing To whom the data has been/will be disclosed Description of data subject and personal data Where relevant the countries it has been transferred to Under which condition for processing the data has been collected Under what lawful basis processing is being carried out Where necessary, how it is retained and destroyed A general description of the technical and organisational security measures. Clearly, in order to maintain these records good auditing processes must be followed, both at the start of the exercise and on-going throughout the lifetime of the requirement. Therefore audit logs will need to be kept to: provide evidence of the processing activity and the DPIA record where, how and to whom data has been shared log the disposal and destruction of the data enable the School / Academy to target training at the most at-risk data record any breaches that impact on the data It then follows that in the event of a data breach, the school/ college should have a policy for reporting, managing and recovering from information risk incidents, which establishes: a “responsible person” for each incident a communications plan, including escalation procedure and results in a plan of action for rapid resolution a plan of action of non-recurrence and further awareness raising All significant through the DPO to the Information Commissioner’s Office based upon the local incident handling policy and communication plan. The new laws require that this notification should take place within 72 hours of the breach being detected, where feasible. Data Mapping The process of data mapping is designed to help schools / academies identify with whom their data is being shared in order that the appropriate contractual arrangements can be
Where applicable, the name and contact details of the joint controller and data protection officer The purpose of the processing To whom the data has been/will be disclosed Description of data subject and personal data Where relevant the countries it has been transferred to Under which condition for processing the data has been collected Under what lawful basis processing is being carried out Where necessary, how it is retained and destroyed A general description of the technical and organisational security measures. Clearly, in order to maintain these records good auditing processes must be followed, both at the start of the exercise and on-going throughout the lifetime of the requirement. Therefore audit logs will need to be kept to: provide evidence of the processing activity and the DPIA record where, how and to whom data has been shared log the disposal and destruction of the data enable the School / Academy to target training at the most at-risk data record any breaches that impact on the data It then follows that in the event of a data breach, the school/ college should have a policy for reporting, managing and recovering from information risk incidents, which establishes: a “responsible person” for each incident a communications plan, including escalation procedure and results in a plan of action for rapid resolution a plan of action of non-recurrence and further awareness raising All significant through the DPO to the Information Commissioner’s Office based upon the local incident handling policy and communication plan. The new laws require that this notification should take place within 72 hours of the breach being detected, where feasible. Data Mapping The process of data mapping is designed to help schools / academies identify with whom their data is being shared in order that the appropriate contractual arrangements can be