The GDPR in a school: what it requires

The principles that bite in a school

• Lawfulness — a school mostly relies on legal obligation and public task rather than consent. This matters: consent you cannot genuinely refuse is not consent, which is why "the parents signed the form" is a weaker basis than it sounds.
• Minimisation — collect what the purpose needs. Enrolment forms are where schools most often over-collect.
• Accuracy — records kept up to date, including when a family’s circumstances change.
• Storage limitation — a retention schedule, which is the obligation most schools have never written down.
• Integrity and confidentiality — security, technical and physical both.
• Accountability — being able to demonstrate the above. This is the one that turns the others into paperwork, and it is the point of the paperwork.

Who the controller is

For most schools the Board of Management is the data controller. For an ETB school it is generally the ETB. That determines who answers to the Data Protection Commission, who signs a data processing agreement, and who carries the responsibility when something goes wrong.

It is worth being certain which applies before writing "the school will…" into a policy, because a policy that misidentifies the controller misdescribes who is accountable.

The four things that make it demonstrable

Accountability means the difference between doing the right thing and being able to show it. Four documents do most of that work:

• A Data Protection Policy the Board has adopted, with a date.
• A record of processing — what data, why, on what basis, kept how long, shared with whom.
• A retention schedule, and evidence it is followed.
• A breach response procedure, written before it is needed.

A school with those four, kept current and acknowledged by staff, is in a substantially better position than one that does everything right informally and cannot evidence any of it.