ACCS Data Protection Policy for Schools

Last updated: Mon, Nov 25th, 2019 10:26:21 am

The General Data Protection Regulation (GDPR), which came into force on 25th May 2018, significantly changed data protection law in Europe, strengthening the rights of individuals and increasing the obligations on organisations. GDPR introduced changes for the way organisations collect and handle personal data. Many aspects of data protection will, however, remain familiar, but there are significant enhancements to certain areas.

Since 25th May 2018, GDPR applies together with whatever national implementing legislation has been enacted. While building on familiar principles within the existing legislation, GDPR brings new challenges for our schools. It is important for every school to understand that the law of data protection is ever-evolving, and that the school needs to keep its policies, procedures, workplace practices, training modules, contracts, and culture, under continual review to take account of the changes.

ACCS has, in collaboration with JMB and CPSMA, developed the ACCS Data Protection Policy for Schools to support the school in meeting its responsibilities with regard to the processing of personal data.

The school is the “data controller of personal data”. The statutory responsibility of Controller is assigned to the Board of Management. The Principal is assigned the role of -coordinating the implementation of this policy and for ensuring that all staff who handle or have access to personal data are familiar with their responsibilities

Please note the following:

1. The Data Protection Policy has been devised in such a way that it will be largely generic for all schools. Sections 1-7 set out the key principles and other requirements under Data Protection Legislation which will apply to all schools.

2. The Appendices are more fluid in nature and may change depending on each individual school’s purposes for gathering and processing personal data.

3. In particular, Appendices 3 and 5 which deal with Recipients of Data, and its Processing respectively, may differ from one school to another, and should be reviewed and updated accordingly.

The school is the data controller of personal data. The statutory responsibility of Controller is assigned to the Board of Management. The Principal is assigned the role of co-ordinating the implementation of this policy and for ensuring that all staff who handle or have access to personal data are familiar with their responsibilities.

Please note the following:

1. The Data Protection Policy has been devised in such a way that it will be largely generic for all schools. Sections 1-7 set out the key principles and other requirements under Data Protection Legislation which will apply to all schools.

2. The Appendices are more fluid in nature and may change depending on each individual school’s purposes for gathering and processing personal data.

3. In particular, Appendices 3 and 5 which deal with Recipients of Data, and Processing respectively, may differ from one school to another, and should be reviewed and updated accordingly.

A further update Data Retention Schedule has been published for adoption in your school. ACCS has employed a Data Protection Advisor who may be contacted through the ACCS Office.

Downloads:

• ACCS Data Protection Policy for Schools 2019

• Data Retention Schedule 2019