Comply with data protection legislation
Here's how I complied with the Data Protection Act 1998
When former teacher Susan Moore set up her own supply-teaching
agency, STC Consortium Limited, she was alerted to the need to comply
with the Data Protection Act 1998 by a potential customer. Two years
on, Susan's business now provides cover for absent teachers over
6,000 square miles from the Tweed to the Tees and the business stores
personal data about more than 800 teachers. Susan explains how she
complied with the Act - and the efficiency gains that compliance
has provided.
What I did
Gather information
"I didn't really know much about the Data Protection Act 1998
before I started trading. However, when I was discussing the service
my business could provide to the Local Education Authorities (LEAs),
they told me I should be registered with the Information Commissioner
(IC). This is because my IT database was going to store the names,
addresses, work experience and Criminal Records Bureau (CRB) details
of the teachers that would work through the agency. I would also
need to store hard-copy application forms in my archive. A lot of
information about people, in other words.
"I found more information on the ICs website. You can also
register as a data controller through the Information Commissioner
website."
Appoint a dedicated data controller
"I made a member of staff responsible for finding out about
what we needed to do to comply with the Act. She went on the ICs
website and sent off for information packs and videos available
on the site. She also attended an information day to learn about
the Data Protection Act 1998."
Train all staff
"The data controller then trained the rest of the staff to
process data confidentially and accurately, and to ensure it was
seen by nobody outside the business. We used a video from the Information
Commissioner as the foundation of these training sessions. You can
order
the video on data protection through the Information Commissioner
website. We compiled a handbook so every member of staff could
have a copy to which they could refer at any time. This meant they
knew how to handle and protect data at all times."
What I'd do differently
Set up data-protection policies before starting the business
"The LEAs suggested that I should be registered with the IC.
I should have done this from the start to comply with the Act."
Get permission to use data to apply for references as
part of the initial paperwork
"We now have a data-protection policy on the back of our application
form. This means people can fill the permission details out as part
of their initial application, making the application process more
streamlined. We only have to process one set of forms, rather than
sending out a separate form, which would cost us more money in postage
and administration time."
Subjects covered in this guide
 Print
This Page
Source - Business Link; Crown Copyright.
|
