a plan of action of non-recurrence and further awareness raising. All significant data protection incidents must be reported through the SIRO to the Information Commissioner’s Office based upon the local incident handling policy and communication plan. Use of technologies and protective marking The following provides a useful guide: Notes on Protect The information The technology Markings (Impact Level) School/college terms, Common practice is to Most of this information life and holidays, training days, use publically accessible will fall into the NOT events the curriculum, technology such as PROTECTIVELY MARKED activities, school/college websites (Impact Level 0) events, displays of pupils or portal, emailed category. work, lunchtime menus, newsletters, subscription extended services, text services parent consultation events Learning Individual pupil/student Typically schools/colleges Most of this information and academic, social and will make information will fall into the PROTECT behavioural available by parents (Impact Level 2) achievements, progress logging on to a system category. with learning, learning that provides them with There may be learners behaviour, how parents appropriately secure whose personal data can support their child’s access, such as a requires a RESTRICTED learning, assessments, Learning Platform or marking (Impact Level 3) attainment, attendance, portal, or by or higher. For example, individual and communication to a the home address of a personalised curriculum personal device or email child at risk. In this case, and educational needs. account belonging to the the school/college may parent. decide not to make this pupil/student record available in this way. Messages Attendance, behavioural, Email and text Most of this information and alerts achievement, sickness, messaging are commonly will fall into the PROTECT school/college closure, used by schools/colleges (Impact Level 1) transport arrangements, to contact and keep category. However, since and other information parents informed. it is not practical to that it may be important Where parents are encrypt email or text to inform or contact a frequently accessing messages to parents, parent about as soon as information online then schools/colleges should possible. This may be systems e.g. Learning not send detailed particularly important Platforms or portals, personally identifiable when it is necessary to might be used to alert information. contact a parent parents to issues via General, anonymous concerning information “dashboards” of alerts about that may be considered information, or be used schools/colleges closures too sensitive to make to provide further detail or transport available using other and context. arrangements would fall
a plan of action of non-recurrence and further awareness raising. All significant data protection incidents must be reported through the SIRO to the Information Commissioner’s Office based upon the local incident handling policy and communication plan. Use of technologies and protective marking The following provides a useful guide: The information The technology Notes on Protect Markings (Impact Level) life and events School/college terms, holidays, training days, the curriculum, activities, events, displays of pupils work, lunchtime menus, extended services, parent consultation events Common practice is to use publically accessible technology such as school/college websites or portal, emailed newsletters, subscription text services Most of this information will fall into the NOT PROTECTIVELY MARKED (Impact Level 0) category. Learning and Individual pupil/student academic, social and behavioural achievements, progress with learning, learning behaviour, how parents can support their child’s learning, assessments, attainment, attendance, individual and personalised curriculum and educational needs. Typically schools/colleges will make information available by parents logging on to a system that provides them with appropriately secure access, such as a Learning Platform or portal, or by communication to a personal device or email account belonging to the parent. Most of this information will fall into the PROTECT (Impact Level 2) category. There may be learners whose personal data requires a RESTRICTED marking (Impact Level 3) or higher. For example, the home address of a child at risk. In this case, the school/college may decide not to make this pupil/student record available in this way. Messages and alerts Attendance, behavioural, achievement, sickness, school/college closure, transport arrangements, and other information that it may be important to inform or contact a parent about as soon as possible. This may be particularly important when it is necessary to contact a parent concerning information that may be considered too sensitive to make available using other Email and text messaging are commonly used by schools/colleges to contact and keep parents informed. Where parents are frequently accessing information online then systems e.g. Learning Platforms or portals, might be used to alert parents to issues via “dashboards” of information, or be used to provide further detail and context. Most of this information will fall into the PROTECT (Impact Level 1) category. However, since it is not practical to encrypt email or text messages to parents, schools/colleges should not send detailed personally identifiable information. General, anonymous alerts about schools/colleges closures or transport arrangements would fall
360cymru_full_policy_template_en_inc_appendices.docx