Is your school or academy moving to the Cloud?
17th November, 2014
With an increasing number of schools and academies recognising the benefits of internet based IT systems, the Department for Education (DfE) has issued guidance to reduce the complexity associated with understanding whether a Cloud service meets UK data protection requirements.
It is the responsibility of the school or academy to ensure compliance with the Data Protection Act (DPA), which includes compliance by its Cloud suppliers.
This means that deciding which Cloud supplier to choose has an impact on your ability to comply with the DPA.
Self-certification
The DfE has introduced a process to support decision making in the form of a standard checklist for completion by Cloud service providers.
The checklist includes questions regarding security techniques, disaster recovery, data transfers, advertising, support and the supplier’s standard contracts.
A supplier which self-certifies by completion of the checklist is required to confirm certain statements in order that schools and academies may rely upon the accuracy of its responses. For example, it is required to confirm that answers have been fully and accurately provided by a person competent in the relevant field.
If the DfE considers that any element of a supplier’s checklist requires independent verification, the supplier must cooperate with (and fund) such verification or withdraw its self-certification submission.
Checklists which have been accepted by the DfE are available to view via the DfE website. Google and Microsoft have already joined the scheme.
Further guidance and advice
In addition to introducing the self-certification checklist, the publication reminds schools and academies about some of their obligations as data controllers.
However, it should be noted that the document does not explain the data protection risks commonly associated with Cloud computing or how those risks relate to the obligations of a school or academy under the DPA.
Schools and academies should refer to the guidance of the Information Commissioner’s Office in this regard and, prior to entering into an arrangement for receipt of a Cloud based service, seek specific legal advice.
How can Ward Hadaway help?
The team at Ward Hadaway are experts in data protection, advising both users and suppliers of educational Cloud services.
Please get in touch if you require assistance on Cloud computing systems for your school or academy.
Please note that this briefing is designed to be informative, not advisory and represents our understanding of English law and practice as at the date indicated. We would always recommend that you should seek specific guidance on any particular legal issue.
This page may contain links that direct you to third party websites. We have no control over and are not responsible for the content, use by you or availability of those third party websites, for any products or services you buy through those sites or for the treatment of any personal information you provide to the third party.
