Removable Is removable media encrypted? media User access Does each user have a unique name and password to get into areas controls where there is personal data? Password Are the passwords used to get to personal data complex? Is there a security process to stop access when someone leaves? Malware Are all machines that access the schools personal data protected from protection malware? Backup and Do you backup ALL areas that hold personal information, including c: restoration drives on laptops? Are the major backups secured in different locations? Monitoring Do you monitor the network? In some cases this can include the monitoring of network traffic Patch Is the software on your systems kept up to date with upgrades? management Boundary Does your system have a firewall? What rules are in place on this firewalls firewall? Data Sharing & Subject Access Management & organisational data sharing measures Data sharing Is there reference to data sharing in the Data Protection policy? policy Accountability Is there a member of the SLT team with responsibility for Data Protection? Staff training Are the people who will make decisions about Data sharing aware of their duties especially when adopting a new service? Data sharing records Decision log Do you have a log of those organisations that you share data with? Use the eLIM Record Audit Spreadsheet to keep a track Information Do you have agreement or contracts in place with those organisations sharing that you share data? agreements Registration Fair Do you have Fair processing notices for both pupils and workforce? processing ICO Are you registered with the ICO? Registration Check to see your school entry Security Security What security measures do you have in place to protect personal data? measures Subject access Subject access Do you have a process for dealing with Subject Access Requests? process Accountability Do staff know the process for dealing with Subject Access Requests? and training Compliance Do you log all Subject Access Requests? Has the process for dealing monitoring with Subject Access requests always worked?
Removable media Is removable media encrypted? User access controls Does each user have a unique name and password to get into areas where there is personal data? Password security Are the passwords used to get to personal data complex? Is there a process to stop access when someone leaves? Malware protection Are all machines that access the schools personal data protected from malware? Backup and restoration Do you backup ALL areas that hold personal information, including c: drives on laptops? Are the major backups secured in different locations? Monitoring Do you monitor the network? In some cases this can include the monitoring of network traffic Patch management Is the software on your systems kept up to date with upgrades? Boundary firewalls Does your system have a firewall? What rules are in place on this firewall? Data Sharing & Subject Access Management & organisational data sharing measures Data sharing policy Is there reference to data sharing in the Data Protection policy? Accountability Is there a member of the SLT team with responsibility for Data Protection? Staff training Are the people who will make decisions about Data sharing aware of their duties especially when adopting a new service? Data sharing records Decision log Do you have a log of those organisations that you share data with? Use the eLIM Record Audit Spreadsheet to keep a track Information sharing agreements Do you have agreement or contracts in place with those organisations that you share data? Registration Fair processing Do you have Fair processing notices for both pupils and workforce? ICO Registration Are you registered with the ICO? Check to see your school entry Security Security measures What security measures do you have in place to protect personal data? Subject access Subject access process Do you have a process for dealing with Subject Access Requests? Accountability and training Do staff know the process for dealing with Subject Access Requests? Compliance monitoring Do you log all Subject Access Requests? Has the process for dealing with Subject Access requests always worked?
ICO%20checklist.docx