Having appropriate data protection policies and documentation is an essential part of compliance. Some documents and policies are explicitly required by the GDPR and the Data Protection Act. In addition, the GDPR contains an obligation to "demonstrate compliance", which includes additional requirements around documentation.
Data protection documentation can be split into four categories as follows:
- policies for all staff;
- policies and documentation for those with a data protection role e.g. an Article 30 record of processing activities and an appropriate policy document;
- privacy notices; and
- documents regarding data processors (i.e. contractors the school shares personal data with).
The data protection team at VWV has developed a data protection handbook specifically for schools and academy trusts which contains key documents and policies for data protection compliance under each of the four categories above, including the documentation explicitly required by the legislation. VWV can also provide a full range of data protection related services such as staff training and audits. For further information please contact Andrew Gallie on 0117 314 5623 or firstname.lastname@example.org . Andrew is a partner in the data protection team at VWV.