Data Protection Education

Can a governor be the data protection officer?

If the governor has no other responsibilities, then possibly. For many schools, a governor with the right skills and authority, as well as time, would be suitable. However, they need to be available, have the expertise and importantly, may need to recuse themselves from other oversight responsibilities and decision-making due to a conflict of interest.

Can we allocate the role of DPO to a member of staff?

Yes, but only if their professional duties are compatible with those of the DPO and do not lead to a conflict of interest. This means that they must be in an impartial role, report directly to the governing body and have no conflict of interest in their other duties. It is difficult to think of a role in the school where there wouldn’t be a conflict of interest.

Do schools need a data protection officer?

The GDPR outlines three circumstances when an organisation must appoint a DPO. If you: are a public authority (except for courts acting in their judicial capacity); carry out large scale systematic monitoring of individuals (for example, online behaviour tracking); or, carry out large scale processing of special categories of data or data relating to criminal convictions and offences.

Does a MAT need a DPO for each school, or just one for the MAT?

The MAT is considered the data controller, and therefore only one DPO is required for the MAT. We recommend for consistency that only one MAT is appointed per MAT.

Does the data protection officer need specific qualifications?

Whilst the GDPR does not specify precise credentials, it does require that they should have professional experience and knowledge of data protection law. This should be proportionate to the type of processing your school carries out, taking into consideration the level of protection the personal data requires.