Users must protect all portable and mobile devices, including media, used to store and transmit personal information using approved encryption software; and Particular care should be taken if data is taken or transferred to another country, particularly outside Europe, and advice should be taken from the local authority (if relevant) in this event. Disposal of data The school will comply with the requirements for the safe destruction of personal data when it is no longer required. The disposal of personal data, in either paper or electronic form, must be conducted in a way that makes reconstruction highly unlikely. Electronic files must be securely overwritten, in accordance with government, and other media must be shredded, incinerated or otherwise disintegrated for data. A Destruction Log should be kept of all data that is disposed of. The log should include the document ID, classification, date of destruction, method and authorisation. Audit Logging / Reporting / Incident Handling It is good practice, as recommended in the Handling Procedures in Government” document “Data that the activities of data users, in respect of electronically held personal data, will be logged and these logs will be monitored by responsible individuals. The audit logs will be kept to provide evidence of accidental or deliberate data security breaches – including loss of protected data or breaches of an acceptable use policy, for example. The school has a policy for reporting, managing and recovering from information risk incidents, which establishes: a person” for each incident; “responsible a communications plan, including escalation procedures; and results in a plan of action for rapid resolution; and A plan of action of non-recurrence and further awareness rising. All significant data protection incidents must be reported through the SIRO to the Information Commissioner’s Office based upon the local incident handling policy and communication plan. Member of staff is not communicating on behalf of the school with an appropriate disclaimer. Such personal communications are within the scope of this policy.
Users must protect all portable and mobile devices, including media, used to store and transmit personal information using approved encryption software; and Particular care should be taken if data is taken or transferred to another country, particularly outside Europe, and advice should be taken from the local authority (if relevant) in this event. Disposal of data The school will comply with the requirements for the safe destruction of personal data when it is no longer required. The disposal of personal data, in either paper or electronic form, must be conducted in a way that makes reconstruction highly unlikely. Electronic files must be securely overwritten, in accordance with government, and other media must be shredded, incinerated or otherwise disintegrated for data. A Destruction Log should be kept of all data that is disposed of. The log should include the document ID, classification, date of destruction, method and authorisation. Audit Logging / Reporting / Incident Handling It is good practice, as recommended in the “Data Handling Procedures in Government” document that the activities of data users, in respect of electronically held personal data, will be logged and these logs will be monitored by responsible individuals. The audit logs will be kept to provide evidence of accidental or deliberate data security breaches – including loss of protected data or breaches of an acceptable use policy, for example. The school has a policy for reporting, managing and recovering from information risk incidents, which establishes: a “responsible person” for each incident; a communications plan, including escalation procedures; and results in a plan of action for rapid resolution; and A plan of action of non-recurrence and further awareness rising. All significant data protection incidents must be reported through the SIRO to the Information Commissioner’s Office based upon the local incident handling policy and communication plan. Member of staff is not communicating on behalf of the school with an appropriate disclaimer. Such personal communications are within the scope of this policy.
online-safety-policy.docx