Fostering the right culture for data protection

The education community knows that ensuring data protection compliance is crucial to protect the privacy and rights of students and staff. As the sector continues to embrace new and innovative technology, it is vital that data protection stays front of mind.  

Working in partnership with managed IT services specialists Cantium, we’ve been supporting schools and Multi Academy Trusts (MATs) to ensure they are data protection compliant while they continue along their digital transformation journeys. Some schools have staff members with a technical or even a compliance background, others are very much in unfamiliar territory, but the one thread that unites them in their success is having a culture of continual improvement. 

When a school places its focus on enhancing its processes and overall performance, and encourages ongoing reflection, learning, and adaptation, they foster a culture of continual improvement. We see this when schools view data protection as vitally important and have robust practices in place that support it.  

Factors such as workload, time and budgetary restraints often prevent schools from adopting this culture, and often keep them stuck in the ‘solve the issue at hand’ mindset.  

Often in busy environments we see people working very quickly, feeling the need to swiftly move on to the next task, but we’ve also seen how costly mistakes made in these rushed moments can be. 

Given the volume, the sensitivity of the data, and the speed in which schools are expected to work, we can completely empathise. We have found that the best way to break down these barriers to help make the cultural shift while balancing workload, is to bring data protection back to basics.  

Learning from mistakes – If your school or MAT has fallen victim to a data breach, take the time to evaluate what happened. Identify exactly where mistakes were made, ask why they were able to take place, find out what you learned from working in this way, and then list the actions you are now going to put into place to prevent it from happening again. 

Then focus on prevention – Displaying information around the school on the importance of data protection – using things like posters and screensavers that remind people to check their emails before sending, and to think before they click – over time really does help to change culture. Use newsletters, workshops, and other channels to communicate with your school community about the importance of data protection, and to keep everyone informed about the policies and practices in place. People’s mentality very subtly shifts, and you will find that data protection becomes front of mind, and common practice.  

Support new starters – The best time to get staff engaged in data protection is when they join your school. Making clear that data protection is an important point on your agenda will help greatly when promoting a culture of continual improvement. You may find that a new starter hasn’t previously had much data protection awareness, and your approach will now encourage them to focus on it.  

Offer all staff ongoing support – Refresher training must be offered to all staff at timely intervals. Keep sessions bitesize to ensure people stay engaged and can easily incorporate training into their schedules. Do not give people excuses to avoid data protection education, support them and enable them to learn. Your Data Protection Officer (DPO) will also oversee compliance with data protection laws and can serve as a point of contact for any data protection concerns. 

Cultural change is an ongoing process, not a one-time event, and requires ongoing commitment and effort from all levels of a school. But by implementing the above measures, schools can create a culture where data protection and privacy are always prioritised and foster a safe and secure environment for students and staff. 

By Adam Halsey, External DPO (Data Protection Officer), and Stacy Williams, Risk and Compliance Officer at Invicta Law.