How GDPRiS empowered London Borough of Merton to manage Data Protection across 47 Schools

The Challenge

With the introduction of the GDPR and DPA 2018, schools faced significant challenges in managing and protecting large quantities of sensitive personal data. The new regulations required stringent compliance measures, including appointing a Data Protection Officer, recording data processes, maintaining breach records, and delivering staff training; all without additional funding.

This created a substantial burden on the schools' resources and posed a risk to data protection compliance. Looking back at the lead up to 25th May 2018, Derek recalls:

“We identified early on that there was a great deal of disinformation out there. Schools were being approached by various consultants and companies eager to benefit from the uncertainty at the time. The ICO tried their best to bust the myths but schools were very uneasy about what they should do. It irritated me that companies and individuals would use scare tactics to try and gain access to public money.”

It was this irritation that sparked Derek into action; he knew that he had to find a cost effective way to support his schools with data protection.

The Solution

School across the borough needed a robust solution to manage these new data protection responsibilities. After evaluating various options, Derek decided on GDPRiS due to its comprehensive features and ease of implementation.

"We chose GDPRiS because it was the best fit for our schools. Implementation was really easy and the GDPRiS staff are very accommodating and knowledgeable."

GDPRiS provided tools for risk assessments, breach management, subject access requests, and staff training, enabling the schools to efficiently manage their data protection tasks.

The Results

After seven years of using GDPRiS, schools across the London Borough of Merton have seen significant improvements. The software's ability to monitor and manage data protection across 47 schools has ensured almost immediate response to breaches, compliance with the one-month timeframe for subject access requests, and adherence to the 72-hour breach reporting time.

"GDPRiS has really helped to foster a mindset of ongoing compliance in our schools and has given us a central tool that helps us to monitor each school's journey towards compliance."

GDPRiS has reduced the compliance burden on schools, allowing them to focus more on education while ensuring robust data protection.