GDPR - top tips to get compliant

It’s that time of year again, the summer break is over and it is back into the routine for another academic year. Any bursar will tell you that September is an extremely busy time of the year with a seemingly endless list of things requiring attention. In the hubbub of the new academic year, it is easy for tasks to be put on hold, which is why I am taking an opportunity in this edition of ‘educateIT’ to gently remind headteachers and bursars of a deadline that is now two months closer – the GDPR regulation.

I’ve spoken so much with bursars about GDPR recently that I am starting to feel like a broken record, but the reality is that it is so important that it will be on the agenda right through until the 25^th May 2018 deadline and beyond.

After a well-deserved 2-month break, you may be racking your brains to remember exactly what GDPR entails. The General Data Protection Regulation (GDPR) is a piece of EU legislation designed to provide a common data protection policy amongst EU member states. When it comes into effect next May, it will supersede all existing data protection regulations (in the case of the UK, that is the Data Protection Act 1998). Because current data protection legislation differs across member states and was introduced before the cloud and social media, it was clear that modern legislation was required.

No doubt that if you have heard about GDPR, you will have heard the scare stories about fines of up to €20 million for non-compliance. As an independent school, it is unlikely that you could ever face such an astronomical fine for non-compliance, these fines are reserved for the worst offenders. However, it is a safe assumption that under GDPR fines for non-compliance will move up the value chain. For more on GDPR, read my blog from March 2017 entitled “GDPR – What’s it all about and how does it affect Independent Schools?”

During my visits to Independent Schools at the tail end of last term, I was frequently asked when would be a good time to start tackling the issue of GDPR compliance. At that time, I urged schools to begin work as soon as possible – since compliance is not something that can be attained overnight. In the new academic year, with the deadline less than 9 months away, my message is that if your Independent School hasn’t begun the process of GDPR compliance, it should be as near to the top of your agenda as possible.

With that in mind, what are some key considerations an Independent School should make as it progresses towards GDPR compliance?

Firstly, it is a good idea to get acquainted with the Information Commissioners Office. This is the Data Protection Regulator in the UK. Under GDPR, an organisation that experiences a data breach of any kind is obligated to inform the ICO of the breach, exactly what was exposed and what measures are being taken to mitigate damage, within 72 hours of discovery. Failure to do so is an offence and will result in a fine. Furthermore, GDPR requires certain businesses to appoint a dedicated ‘Data Protection Officer’ who is an expert on GDPR. The details are a little cloudy on this at present, but it is quite possible that schools will fall into this category.

The next consideration involves processing of personal data and consent. GDPR gives individuals more control over the use of their personal data. At a recent visit to an Independent School, this topic came up when the bursar mentioned that they perform wealth screening on prospective parents. Whilst this is a savvy business practice, under GDPR withholding personal information for the purposes of wealth screening can only be legally performed with the explicit consent of the individuals in question. Furthermore, the school must keep a record of exactly when consent was given and must make it clear to the individual the basis for which the school requires this information. The individual may also withdraw consent at any time, at which point withholding personal information becomes illegal.

In certain instances, passive consent is allowed. For example, when a pupil enrols at a school, it is implied that the individual gives consent for personal information to be stored by the school for the purpose of providing them with an education and pastoral care.

Once you have collected that data, the question of where that data is stored arises. Whilst many Independent Schools still store all their important data in servers on-site, cloud adoption is accelerating. Popular cloud services such as OneDrive or Dropbox are provided by U.S. based companies and are powered, for the most part, by U.S. based datacentres. U.S. data protection law is not as stringent as EU legislation and reliance on U.S. based storage could lead to compliance issues.

That doesn’t mean that storing data on-site is a preferred option. In almost all cases I have dealt with in my long career in the IT industry, on-site storage options are less secure than their cloud counterparts. The only exception is for organisations that make their cyber-security a top priority, throwing vast amounts of cash at servers, monitoring software and antivirus. A cloud storage option such as ShareFile is a strong offering if security is mission critical.

A final important consideration is that of Social Media and pupil internet usage. This links back to my earlier paragraph on consent. Because most school pupils are under 16, they can never legally give consent online. An Independent School, particularly one that has boarding pupils, acts as a legal guardian for those pupils while they are on school grounds. The school is therefore legally responsible for the information they share online, and the websites and social media accounts they sign up for while on school grounds. Having a stringent acceptable use policy in place for pupils’ internet use is a good first step, but educating the pupils on the dangers of posting personal information online would go a positive step further.

As the GDPR deadline looms, I cannot stress enough the importance of taking action now. In the business sector, GDPR is getting increasing air time and most parents will be aware of the regulation by now. To show that your Independent School is on top of the changes, I recommend a letter to inform parents that your staff are aware of the changes, and that your school is making the necessary steps to reach GDPR compliance by the May 2018 deadline. Proactively reassuring parents that the personal information of themselves and their children is safe will put minds at ease.

Towards the end of the last academic year, I received a number of requests for assistance with GDPR. To Independent Schools with a genuine need and interest, I met with bursars to discuss further. I am continuing to offer this service at the beginning of this academic year. If you would like advice on GDPR compliance, please do not hesitate to get in contact with me on 0330 002 0045 or email schools@entrustit.co.uk

Why Independent Schools must Prepare Pupils for Jobs that Haven't been Invented

Whether we like or loathe technology, there is no doubt that every facet of our lives is being changed by digital transformation.

Technology is changing businesses - we only have to see the impact of Uber on traditional taxis, Purple Bricks on traditional estate agents or Airbnb on traditional holiday accommodation, to understand that the world around us is changing because of the use of technology.

The way our young people socialise and interact with each other has also totally changed in recent years with the use of Snapchat, Instagram, Facebook and a plethora of other social media sites, not to mention the streaming of music and films/TV and the advent of e-readers and the subsequent digitisation of books - so different from my day where we went to a shop to buy a CD or borrowed a book from the library!

Technology has also made the world a much smaller place, with the cloud, virtual learning environments, and virtual meeting environments enabling remote working and real-time communication wherever we are. And - for better or worse - this "permanently connected" status of our smartphones and tablets has also meant for many of us that much of our work lives and our personal lives have become 24x7.

And the pace of change continues to increase. Already Artificial Intelligence (AI) is starting to change the world around us, dispensing with the need for some jobs, while creating the need for different, digitally savvy skills to create and manage the technology. This is a trend that can only be set to continue and extend in coming years. Meanwhile the Internet of Things (IoT) is continuing to evolve, with everything from our building management systems, to our CCTV systems being connected to the Internet. Perhaps soon the fridges in our school kitchens will be monitoring their own stock levels and automatically re-ordering items that are running short.

Embracing technology, and equipping pupils with the skills to thrive in the new digital economy, forms a vital part of preparing pupils for life beyond school. Already there are so many jobs that just didn't exist 10 years ago, and there is no doubt that some of our pupils today will be undertaking jobs in the future that haven't even yet been invented.

This is why it is so vital for schools to embrace technology and build it into every element of school life. Of course, embedding technology into school life does rightly raise concerns amongst the Senior Leadership Team as to how to safeguard pupils in this environment, as well as preventing all the distractions that come with things like social media. However with the right controls, processes and technologies in place, this is very much achievable, as has been shown by many independent schools, such as Stroud School, whom I featured in a recent piece on my blog

If you would like to know more about EntrustIT's ICT strategy and project services, which enable schools to embrace digital technology and embed it into school life, please do not hesitate to contact me on 0330-002-0045 or email schools@entrustIT.co.uk

Why Every Independent School needs a list of Specific Unknown Problems!

It's that time of year again, when schools are starting to plan their network upgrade projects for the summer holidays. And if only we could list every unknown problem that might occur, it would make all our lives so much easier!

Of course with technology being technology, it never seems to work quite like that. We only have to think about any high-profile public sector ICT project to know that these things are rarely brought in successfully on time and within budget, with a fanfare from the delighted user base!

And to expect our schools’ Network Managers to deliver what are now often highly complex ICT projects on their own over the school holidays can be an unrealistic expectation. We have to bear in mind that delivering ICT infrastructure projects requires a whole raft of specialist skills ranging from systems design (a specialist skill in its own right), to systems installation, people management, project management, risk management and organisational skills.

Then put this against the backdrop of a schools' operational environment: often hundreds of software applications, not always inventoried, and indeed sometimes not on the Network Manager's radar at all. Downtime windows confined to school holidays. The need to structure the project plan around certain days or rooms where the system needs to be operational, such as on exam result days or periods where certain facilities are let for summer schools. A plethora of rooms, buildings and keys. Laptops, some of which will invariably have been taken off site. The need to liaise with third parties such as software suppliers over a period when many people are away. Key users who aren't available for testing or training as they are on holiday. And the vagaries of technology, where something doesn't quite do what it says on the tin!

Then there’s the increasingly critical need to build in cyber security and data protection from the ground floor up in any new or upgraded systems, again a specialist skillset in its own right.

Added to this, we need to remember that these types of projects are not something our Network Managers do every day, and just like anything any of us are doing for the first time, it is unlikely to go as smoothly as if we had done it many times before. So perhaps it is little wonder that schools sometimes experience disruption at the start of term in September, when ICT projects have over run!

The key to success in these projects lies in the planning. Whilst none of us have a crystal ball to be able to anticipate every problem that may occur, having a breadth of experience in carrying out these type of projects means that many of the "unknown problems" that might present a challenge to in-house ICT staff, will actually be "known issues" to someone with wider experience, and can be planned for accordingly.

And let’s not lose sight of the fact that, with a helping hand to support them to succeed, these exciting projects not only enhance the schools’ learning environment, but also offer a fantastic development opportunity for schools’ Network Managers.

If your school needs an experienced organisation to work with your in-house ICT team to plan and deliver your forthcoming network development projects, please do not hesitate to contact me on 0330-002-0046 or email schools@entrustit.co.uk to discuss your requirements.

Getting Best Value from ICT Budgets in Independent Schools

With ever increasing demands for new and improved technology in independent schools, it is easy for ICT to become a bottomless money pit. Naturally, every school wants to use technology to enhance the learning environment, equip pupils for the digital world that they will be living and working in, as well as ensure that the school is keeping up with its competitors and using technology in a way that will serve to attract further pupils to the school.

The bursar however, has the unenviable job of trying to balance all these laudable ambitions against a limited budget!

This is where I often get called in to help bursars review current ICT budgets and look at strategic ways next academic year's ICT budget can be most effectively utilised. Because we work with numerous schools, and have a good handle on the technology marketplace, we are able to give bursars a steer on whether they are paying about the right amount for ICT services and staffing both commercially and in relation to other schools. We also look at whether there may be ways they can "flip" their budget to achieve their technological aspirations in a different way.

Every school is different, but with ICT forming a significant part of the school’s overall budget, it is well worth taking a little time to review how best to deliver maximum possible value from a limited pot of resources. Whilst time and space don't allow me to cover every scenario here, I thought it would be useful to jot down a few of the common areas that I find are worth reviewing:-

1. ICT Invoice review. This is often a very revealing exercise, as many schools receive a plethora of invoices from different providers each term or year, relating to services, maintenance contracts, software subscriptions and the like. The descriptions on such invoices are often vague or use technical jargon, which make it hard to know what they relate to, whether they are still actually relevant and whether they are offering good value for money. We have spent time with many schools unravelling their invoices to understand just these factors and frequently this exercise alone has yielded many thousands of pounds in ongoing cost savings.

2. Software review. Most independent schools have an array of software applications that have grown over time. Reviewing (or indeed making!) a list of all applications and asking questions such as "Who uses it?", "What for?", "Do we still need it?" and "Is there a cheaper way to licence it?" normally reveals another nice chunk of money that can be used for more exciting ICT projects.

3. Internet connectivity. With technological advances, prices for Internet connectivity are constantly falling, but many schools are not aware of this and so are oblivious of the opportunities to re-negotiate their contract, or perhaps add a back-up Internet line for the same cost they are currently paying for their main line alone.

4. ICT staffing costs. In some cases, independent schools find a better skills mix and a cost saving can be achieved by part or fully outsourcing their ICT function, or by changing provider.

5. The Cloud. Strategic use of the right public and private cloud solutions can potentially save schools a fortune in hardware and support costs, whilst also offering remote working capability and the ability to securely access the school system from pupil and staff owned devices.

6. "Closed" cloud. For those schools not yet comfortable with the idea of their data residing off-site, closed cloud solutions can offer similar benefits to private cloud solutions, as well as significant cost savings over a traditional network, whilst still keeping all data in school.

7. Leveraging your ICT systems commercially. From utilising digital technology to market your school more effectively, through to renting out your shiny new music technology suite over the holidays, remember you can use your technology to boost your bank balance too, not just deplete it!

If you would like more information on any of the topics raised or if you'd like to book a budget review, please do not hesitate to contact me on 0330 002 0045 or email schools@entrustit.co.uk.

Why every Independent School needs a Super-Hero!

This cartoon recently caught my eye, and made me chuckle. I do think that nowadays we expect so much from our ICT staff that they do indeed need to have superpowers to fulfil all our expectations!

Let's consider how things have changed over recent years: a decade ago, there was a small, simple network serving the administrative side of the school, and perhaps a couple of ICT classrooms equipped with specially configured computers for delivering ICT lessons.

Nowadays, the network extends to every area of the school. Pupils and staff alike are connecting all kinds of different devices to the network through Wi-Fi, and ICT services have become the bedrock of delivering most, if not every, lesson.

Whilst network managers and IT technicians are sometimes much maligned (especially, in my experience, when the network goes down!), their role has in fact changed beyond recognition in recent years.

No longer is it sufficient to have a network that runs OK most of the time. Nowadays it needs to be an "industrial strength" network that is at the top of its game every minute of the school day.  We expect our network managers to have the network design skills to put together such a system (despite typically never having done this before!), not to mention the strategic vision to "back the right horse" by investing in the right technologies that will future-proof the school network and provide the best learning environment for children. 

Naturally, we also expect them to be technical geniuses, able to fix any problem from the most mundane password reset through to a complete reconfiguration of the network.  Then during school holidays, we also expect them to don their superhero capes and become “project managers extraordinaire”, in order to smoothly, without disruption and within budget, implement technically complex upgrade projects!

Come the start of term, it's back into the phone box for our ICT folks, to metamorphose themselves into the role of hand holder, support giver, mentor and trainer.

Of course, in today's digital world, we also expect our ICT team to be cyber security experts, abreast of a constant stream of new threats and coming up with ways to mitigate the risk and safeguard our pupils, staff and data.

So next time you write a job advertisement for a Network Manager, don't forget to include "Super Powers" in the essential skills section!

Failing that, you could perhaps consider engaging an experienced Independent Schools ICT provider to work in partnership with your Network Manager, so that he or she doesn’t need to have quite so many superpowers!

When it comes to your Network, Expect the Unexpected!

With Independent Schools becoming increasingly reliant on technology for delivering lessons and running the administrative side of the school, network reliability and resilience is one of the hot topics that I often get asked about by the schools we work with.

While many Independent Schools enjoy stunning countryside locations, there can be some pitfalls in terms of technology! Over the years, most schools have bitten the bullet with the "excess construction charges" that BT and similar organisations levy to connect these locations to the Internet. But many schools still suffer from Internet reliability issues. I noticed in the press just this week that Myddelton School which has just opened in North Wales enjoyed a challenging first few days when their Internet circuit was severed, and I know many other schools have been in the same boat over the years, when something as simple as a bad storm took down overhead cables, resulting in a lengthy Internet outage.

And when it's not the great British weather causing havoc, it can be the local wildlife creating chaos, as one school I spoke to recently had found to their detriment. They first became aware of a problem when one building could no longer connect to the network. After much troubleshooting, it was discovered that a local rodent had nibbled through the fibre-optic cable that ran between two buildings!

And of course power problems have been a common cause of downtime for many schools over the years.

Coming from a business background, where there has been a reliance on 'always on' ICT for some years now, I am well versed in ways to overcome these challenges, so I thought it would be useful to share a few pointers:-

1. Uninterruptible Power Supply (UPS) equipment is important, not only to protect your servers but also other connectivity equipment such as Internet routers, firewall, network switches and Wi-Fi access points. Just having a UPS isn't enough though, it is important that they are sized correctly to provide an adequate run-time in the event of a power outage and that they are tested periodically and batteries replaced when indicated.
2. Some resilience can be built into Internet connectivity by having a backup line – where practicable routed differently from the main line – which will provide a failover in the event of the main line experiencing an outage. Again, just having a backup line is not enough though, as there are some technical intricacies involved in swapping from one line to another, therefore the firewall or router needs to appropriately pre-configured to enable a seamless switchover to take place. We are currently implementing solutions for many of our customers around this technology, and the good thing is that with ever-falling Internet connectivity prices, in some cases we've been able to provide them with a new main line and a backup line for a similar cost to their current main line only.
3. Inter-building connectivity can be made more robust by undergrounding cables where possible and providing diversely routed connections between buildings so that there is more than one route by which network traffic can travel between building A and building B.
4. In terms of server hardware, it tends to be the components that contain moving parts - things like power supplies and disk drives - that are most prone to a failure, so it's important that equipment has redundant power supplies and redundant arrays of disk drives. Or of course you could consider migrating to the cloud to negate the need for in-house servers at all – but that’s a big topic for another day!
5. Server monitoring software can also provide a valuable insight into the health of the network, allowing problems to be addressed proactively before they cause disruptive downtime. I would caution though, that it is vital this type of software is configured correctly, as there is a tendency for it either to over-alert and cry wolf too often, in which case real problems can be overlooked, or to under-alert resulting in vital problems being missed.

In future articles I will be discussing more ways of ensuring your ICT is “always on”, but if in the meantime you need any help or advice around making your network more resilient, then please do not hesitate to contact me on 0330-002-0045 or email schools@entrustit.co.uk

Knowledge is Power for Bursars in Independent Schools

With technology now intrinsically embedded in pretty much every element of school life, both inside and outside the classroom, the ability to make empowered decisions about the strategic use of ICT within the school has never been more important.

The Bursar frequently has the unenviable job of ensuring that the school ICT system simultaneously delivers:

• The best possible learning experience to pupils
• Provides for the smooth running of the administrative side of the school
• Safeguards the pupils
• Complies with all relevant legislation
• Serves to attract new pupils to the school

And he or she also needs to achieve all of this within the confines of a limited budget!

This is where Sir Francis Bacon's famous adage "Knowledge is Power" really comes into its own.

Because without good information the Bursar and the rest of the school's Senior Leadership Team can be left in a precarious position, as they don't have the knowledge needed to make informed decisions over the strategic use or direction of technology within the school. Whether you love or loathe technology, the reality is that ICT is now interwoven into the framework of the school and its successful strategic use is critical to the ongoing success of the school.

With technology, and associated security threats, ever-changing, this is an area where no school can afford to stand still.

So it may be worth considering the questions below, to make sure you have the information you need to make empowered decisions over the strategic use of technology in your school:-

• Do you know what technology you have got and what value it adds to your school?

• Do you understand how your ICT systems, in conjunction with your procedures, policies and pupil/staff education plan, safeguard children?

• Has the resilience and disaster recovery provision of your systems kept pace with the changing use of ICT in Independent schools?

• How cost-effective is your ICT system? Are you overspending or under spending compared with other independent schools? Could your ICT budget be deployed more effectively?

• Is the SLT kept abreast of the ever-changing cyber security threat landscape, and have you implemented the necessary technologies, policies and staff training to mitigate the risks? Is this reviewed and updated on a regular basis in light of technological advances and new threats?

• Do you know which technologies other local independent schools have deployed or are considering implementing and how that will impact on your competitiveness in attracting new pupils?

• Do you have a clear understanding of how future proof your ICT systems are? If they have a limited lifespan (and let's face it, most things in ICT do!), have you considered when you will replace them, and what with?

  • Are you clear about the benefits and risks of Cloud Computing in independent schools?

• Do you understand what technology and procedures you have in place to prevent data leakage and/or loss?

• Are you aware of the ways you can leverage your ICT systems to generate further income for the school or fulfil its charitable status obligations?

In the digital world in which we now live, making the right ICT choices is integral to success.

And that all starts with having the right information.