The General Data Protection Regulation (GDPR) was adopted by the EU in April 2016 and will replace the current EU Data Protection Directive 95/46/EC. 

The purpose of the GDPR is to protect the fundamental rights and freedoms of EU citizens and the use of their personal data.  It provides regulations for each EU member state to implement uniform data security law for all its citizens.  In addition to EU members, it is important to note that companies such as Finalsite, who markets goods or services to EU residents, regardless of its location, will also be required to comply with the regulation.

The GDPR introduces new obligations to Finalsite as “data processors” and our clients as “data controllers”, including those based outside the EU for data relating to EU citizens across all industries.   

The core concept behind the GDPR is that Data Privacy and Integrity is a right available to all EU citizens and residents and is based upon six core principles:

1. Lawfulness, Fairness and Transparency
2. Purpose Limitation
3. Data Minimisation
4. Accuracy
5. Storage Limitation
6. Integrity and Confidentiality

Data controllers and processors which do not comply with the regulation can incur fines of up to 4% of annual worldwide turnover or €20 million (whichever the higher). 

The GDPR brings new demands and challenges that will impact school resources and ultimately finances.

Primarily, the GDPR elevates the school’s obligation to inform parents and students about how their data is being used and by whom. There seems to be a lot of panic related to the introduction of GDPR, however, the good news is that compared to many private organisations, schools are much better placed to address the new regulations. Whilst there are many extra demands required to map and audit how personal data is stored and shared, schools with or without data protection policies should see the GDPR as an opportunity to improve the way they work.

The main topics schools should be considering in their approach to GDPR compliance includes:

• Consent – under the GDPR, consent must be explicitly given by a parent or student (depending on their age) to anything that is not within the normal business of the school, especially if it involves a third party managing the data.
• Data Protection Officer – most schools will need to appoint a Data Protection Officer in order to be GDPR compliant.
• Data Protection Agreements (DPA) – it is incumbent upon schools to not only themselves be compliant with the regulation but to also ensure that their third party suppliers who process any of their data are GDPR compliant.  A sure way of doing so is to have a legally enforceable DPA that outlines what personal data is being processed, who it is being processed by, who has access to it and how it is protected by the third party supplier.
• Data monitoring – schools will be required to have the ability to monitor the use of its personal data and of any breaches that may arise.  For example, it will be compulsory that all data breaches, which are likely to have a detrimental effect on the data subject, are reported to the ICO within 72 hours.

First, by being compliant ourselves!

Finalsite has a team in place dedicated to compliance with the GDPR and all related security and data protection issues. But do not take just our word for this. 

Mark Orchison is the Managing Director of 9ine - an industry leader in the field of GDPR compliance for schools and a strong partner with Finalsite in this space. On our GDPR compliance he states:

“Finalsite has always been a pioneer in the school website industry and their on-going application to GDPR compliance is no different.  They have taken and continue to prioritize product security and data protection as a level 1 initiative. They have also put in place and continue to review and add best practice policies that are needed to help them and their school customers enforce regulatory compliance and remain innovative in this space.”

Secondly, by partnering with industry leaders such as 9ine, we provide our customers with access to all they need to know about GDPR compliance.  9ine’s consultancy services provide expertise in audit and compliance strategies for your school that include technology, data protection, cyber security, safeguarding and the cloud.