{"text_format":"1","workbook":"xlsx","n_sheets":1,"sheets":["Master sheet"],"not_rendered":{"charts":0,"images":0,"macros":1,"external_links":0,"defined_names":1,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Master sheet","index":0,"n_rows":340,"n_cols":16,"rows_kept":340,"cut":false,"hidden":false,"merged":[[76,1,80,1],[270,1,283,1],[284,1,289,1],[290,1,297,1],[298,1,301,1],[302,0,339,0],[208,1,209,1],[210,1,215,1],[216,1,218,1],[219,1,225,1],[226,1,232,1],[233,1,238,1],[239,1,242,1],[243,1,246,1],[247,1,249,1],[250,1,253,1],[254,1,258,1],[259,1,261,1],[262,1,264,1],[265,1,269,1],[73,0,114,0],[112,1,114,1],[115,1,122,1],[309,1,312,1],[313,1,316,1],[93,1,96,1],[97,1,101,1],[102,1,104,1],[239,0,301,0],[210,0,238,0],[179,0,209,0],[179,1,182,1],[183,1,188,1],[189,1,190,1],[191,1,197,1],[198,1,201,1],[202,1,204,1],[205,1,206,1],[105,1,106,1],[107,1,111,1],[123,1,124,1],[125,1,128,1],[129,1,132,1],[133,1,135,1],[136,1,140,1],[317,1,320,1],[321,1,325,1],[326,1,332,1],[333,1,336,1],[337,1,339,1],[302,1,308,1],[2,1,8,1],[9,1,13,1],[14,1,19,1],[20,1,23,1],[24,1,30,1],[31,1,34,1],[35,1,38,1],[39,1,43,1],[44,1,47,1],[48,1,51,1],[52,1,58,1],[59,1,62,1],[63,1,66,1],[67,1,70,1],[71,1,72,1],[81,1,84,1],[85,1,88,1],[89,1,92,1],[326,2,332,2],[333,2,336,2],[337,2,339,2],[191,2,197,2],[202,2,204,2],[205,2,206,2],[85,2,88,2],[89,2,92,2],[233,2,238,2],[226,2,232,2],[170,2,173,2],[155,2,160,2],[290,2,297,2],[270,2,283,2],[259,2,261,2],[262,2,264,2],[198,2,201,2],[179,2,182,2],[183,2,188,2],[189,2,190,2],[265,2,269,2],[284,2,289,2],[250,2,253,2],[210,2,215,2],[219,2,225,2],[216,2,218,2],[298,2,301,2],[254,2,258,2],[247,2,249,2],[243,2,246,2],[321,2,325,2],[93,2,96,2],[102,2,104,2],[208,2,209,2],[302,2,308,2],[309,2,312,2],[313,2,316,2],[317,2,320,2],[136,2,140,2],[141,2,145,2],[107,2,111,2],[125,2,128,2],[239,2,242,2],[146,2,148,2],[35,2,38,2],[129,2,132,2],[123,2,124,2],[48,2,51,2],[167,2,169,2],[115,0,145,0],[146,0,178,0],[174,2,178,2],[155,1,160,1],[161,1,163,1],[164,1,166,1],[167,1,169,1],[170,1,173,1],[174,1,178,1],[164,2,166,2],[161,2,163,2],[149,2,151,2],[97,2,101,2],[105,2,106,2],[112,2,114,2],[133,2,135,2],[115,2,122,2],[76,2,80,2],[73,1,75,1],[0,0,0,3],[2,2,8,2],[2,0,34,0],[81,2,84,2],[73,2,75,2],[152,2,153,2],[9,2,13,2],[52,2,58,2],[63,2,66,2],[67,2,70,2],[71,2,72,2],[52,0,72,0],[59,2,62,2],[141,1,145,1],[146,1,148,1],[149,1,151,1],[152,1,153,1],[14,2,19,2],[24,2,30,2],[20,2,23,2],[31,2,34,2],[44,2,47,2],[39,2,43,2],[35,0,51,0]]}
["Accountability Tracker\nMaster Sheet"]
["Category","Number","Our expectations","Reference","Ways to meet our expectations ","Current Status","Reasons for Status","Action(s)","Action owner","Action Status","Completion date\n(DD/MM/YYYY)","","","","",""]
["Leadership and Oversight",1.1000000000000001,"Organisational structure: There is an organisational structure for managing data protection and information governance, which provides strong leadership and oversight, clear reporting lines and responsibilities, and effective information flows.","1.1.1","The board, or highest senior management level, has overall responsibility for data protection and information governance.","Fully meeting our expectation","Documented in the Data Protection Policy","","","Completed","","","","","",""]
[null,null,null,"1.1.2","Decision-makers lead by example and promote a proactive, positive culture of data protection compliance.","Fully meeting our expectation","SLT promote positive culture","","","Completed","","","","","",""]
[null,null,null,"1.1.3","You have clear reporting lines and information flows between relevant groups; such as from a management board to an audit committee, or from an executive team to an information governance steering group.","Fully meeting our expectation","Reporting is in place to SLT","","","Completed","","","","","",""]
[null,null,null,"1.1.4","Policies clearly set out the organisational structure for managing data protection and information governance.","Fully meeting our expectation","Documented in the Data Protection Policy","","","Completed","","","","","",""]
[null,null,null,"1.1.5","Job descriptions clearly set out responsibilities and reporting lines to management.","Fully meeting our expectation","Roles and reporting lines are clearly defined","","","Completed","","","","","",""]
[null,null,null,"1.1.6","Job descriptions are up to date, fit for purpose and are reviewed regularly.","Fully meeting our expectation","Relevant job descriptions have been kept up-to-date","","","Completed","","","","","",""]
[null,null,null,"1.1.7","Data protection and information governance staff understand the organisational structure and their responsibilities.","Fully meeting our expectation","Roles and reporting lines are clearly defined","","","Completed","","","","","",""]
[null,1.2,"Whether to appoint a data protection officer (DPO): If it is necessary to appoint a DPO under Article 37 of the UK GDPR, your organisation makes sure that the DPO's role is adequately supported and covers all the requirements and responsibilities.","1.2.1","The DPO has specific responsibilities in line with Article 39 of the UK GDPR for data protection compliance, data protection policies, awareness raising, training, and audits.","Fully meeting our expectation","DPO responsibilities as in Art 39 UK GDPR","","","Completed","","","","","",""]
[null,null,null,"1.2.2","The DPO has expert knowledge of data protection law and practices. ","Fully meeting our expectation","DPO has appropriate qualifications and experience","","","Completed","","","","","",""]
[null,null,null,"1.2.3","The DPO has the authority, support and resources to do their job effectively.","Fully meeting our expectation","DPO reports to the Head of MIS and is supported in their role","","","Completed","","","","","",""]
[null,null,null,"1.2.4","If your organisation is not required to appoint a DPO, you record the decision.","Not Applicable","","","","Completed","","","","","",""]
[null,null,null,"1.2.5","If your organisation is not required to appoint a DPO, you appropriately assign responsibility for data protection compliance and you have enough staff and resources to manage your obligations under data protection law. ","Not Applicable","","","","Completed","","","","","",""]
[null,1.3,"Appropriate reporting: The DPO is independent and unbiased. They must report to the highest management level and staff must be clear about how to contact them.","1.3.1","Staff know who the DPO is, what their role is and how to contact them.","Fully meeting our expectation","DPO contact details are publicised internally","","","Completed","","","","","",""]
[null,null,null,"1.3.2","All data protection issues involve the DPO in a timely manner.","Fully meeting our expectation","Weekly operational meetings are held and issues are escalated to the DPO as required","","","Completed","","","","","",""]
[null,null,null,"1.3.3","Your organisation follows the DPO’s advice and takes account of their knowledge about data protection obligations. ","Fully meeting our expectation","DPO gives advice based on their knowledge of compliance requirements. Operational decisions are taken by the organisation","","","Completed","","","","","",""]
[null,null,null,"1.3.4","The DPO performs their tasks independently, without any conflicts of interest, and does not take any direct operational decisions about the manner and purposes of processing personal data within your organisation. ","Fully meeting our expectation","DPO gives advice. Operational decisions are taken by the organisation","","","Completed","","","","","",""]
[null,null,null,"1.3.5","The DPO directly advises senior decision-makers and raises concerns with the highest management level.","Fully meeting our expectation","1. DPO advises the Head of MIS and the Principal as required","","","Completed","","","","","",""]
[null,null,null,"1.3.6","The DPO provides regular updates to senior management about data protection compliance.","Fully meeting our expectation","1. SLT updates have mainly concerned policies and procedures to date","To request that the principal has a standard agenda item for DP issues on the SLT. SAR's and Breaches are notified to SLT\n\nUPDATE APRIL: Updates go to the SLT by exception but the oversight group and updates from SAR's and Breaches are reported to the exec team as they are addressed","Chris Sumner","Completed","","","","","",""]
[null,1.4,"Operational roles: Your organisation's operational roles support the practical implementation of data protection and information governance.","1.4.1","Data protection and information governance staff have clear responsibilities for making sure that your organisation is data protection compliant. ","Fully meeting our expectation","Job descriptions decribe the roles and responsibilities for the staff for DP and Info Governance","Check job descriptions for governance professional and principalship.\n\nUPDATE APRIL: The members of the DPT teams have clear roles as data protection members and the principalship team also have clear direction on their roles.","HR","Completed","","","","","",""]
[null,null,null,"1.4.2","Your staff manage all records effectively and they keep information secure.","Partially meeting our expectation","Information Asset register shows the controls used to protect data.","Update the info asset register and continue with ROPA assessments","Chris Sumner/Steve McIntosh","On track","2025-06-23","","","","",""]
[null,null,null,"1.4.3","A network of support or nominated data protection leads help implement and maintain data protection policies at a local level.","Fully meeting our expectation","Data Protection working group has been set up and is attended by nominated leads at a local level","","Chris Sumner/Managers","Completed","","","","","",""]
[null,null,null,"1.4.4","Data protection and information governance staff have the authority, support and resources to carry out their responsibilities effectively. ","Fully meeting our expectation","DPO and Head of MIS understand the role required and the authroity they have. Supported by the SLT","This would turn if 1.4.1 is completed","HR","Completed","","","","","",""]
[null,1.5,"Oversight groups: An oversight group provides direction and guidance across your organisation for data protection and information governance activities.","1.5.1","Key staff, eg the DPO, regularly attend the oversight group meetings.","Fully meeting our expectation","Oversight group meets quarterly","","Chris Sumner","Completed","","","","","",""]
[null,null,null,"1.5.2","An appropriately senior staff member chairs the group, eg the DPO or senior information risk owner (SIRO).","Fully meeting our expectation","Oversight group is chaired by the Head of MIS and attended by the Data Protection Officer","","Chris Sumner","Completed","","","","","",""]
[null,null,null,"1.5.3","Clear terms of reference set out the group's aims.","Fully meeting our expectation","TOR in place","","Chris Sumner","Completed","","","","","",""]
[null,null,null,"1.5.4","The group's meeting minutes record what takes place.","Fully meeting our expectation","Yes","","Chris Sumner","Completed","","","","","",""]
[null,null,null,"1.5.5","The group covers a full range of data protection related topics including Key Performance Indicators (KPIs), issues and risks.","Fully meeting our expectation","Yes, as in standing agenda","","Chris Sumner","Completed","","","","","",""]
[null,null,null,"1.5.6","The group has a work or action plan that is monitored regularly.","Fully meeting our expectation","The monitors the ICO Accountability Framework","","Chris Sumner","Completed","","","","","",""]
[null,null,null,"1.5.7","The board, or highest management level, considers data protection and information governance issues and risks reported by the oversight group.","Fully meeting our expectation","Head of MIS may escalate issues from the oversight group to SLT","","Chris Sumner","Completed","","","","","",""]
[null,1.6,"Operational group meetings: In your organisation, operational level groups meet to discuss and coordinate data protection and information governance activities.","1.6.1","The groups meet and are attended by relevant staff regularly.","Fully meeting our expectation","Weekly operational meetings are held and attended by relevant staff","","","Completed","","","","","",""]
[null,null,null,"1.6.2","The groups produce minutes of the meetings and action plans.","Fully meeting our expectation","Weekly operational meetings are minuted","","","Completed","","","","","",""]
[null,null,null,"1.6.3","The agenda shows the groups discuss appropriate data protection and information governance issues regularly.","Fully meeting our expectation","The running agenda/minute shows that appropriate data protection and information governance issues are discussed","","","Completed","","","","","",""]
[null,null,null,"1.6.4","Any data protection and information governance issues and risks that arise are reported to the oversight group.","Fully meeting our expectation","Oversight group is not currently in place","Oversight group to be set up\n\nMeeting regularly, see minute notes in the DPT folder for evidences","Chris Sumner","Completed","","","","","",""]
["Policies and procedures ",2.1,"Direction and support: Your organisation's policies and procedures provide your staff with enough direction to understand their roles and responsibilities regarding data protection and information governance.","2.1.1","The policy framework stems from strategic business planning for data protection and information governance, which the highest management level endorses.","Fully meeting our expectation","Policy framework approved by SLT","","","Completed","","","","","",""]
[null,null,null,"2.1.2","Policies cover data protection, records management and information security.","Fully meeting our expectation","Policies cover each of these 3 areas","","","Completed","","","","","",""]
[null,null,null,"2.1.3","You make operational procedures, guidance and manuals readily available to support data protection policies and provide direction to operational staff.","Fully meeting our expectation","All policies and procedures are available via a central hub","","","Completed","","","","","",""]
[null,null,null,"2.1.4","Policies and procedures clearly outline roles and responsibilities.","Fully meeting our expectation","Roles and responsibilities are set out in all policies and procedures","","","Completed","","","","","",""]
[null,2.2000000000000002,"Review and approval: You have a review and approval process to make sure that policies and procedures are consistent and effective.","2.2.1","All policies and procedures follow an agreed format and style.","Fully meeting our expectation","All policies follow the SLC formatting","","","Completed","","","","","",""]
[null,null,null,"2.2.2","An appropriately senior staff member reviews and approves all new and existing policies and procedures.","Fully meeting our expectation","All policies approved by SLT","","","Completed","","","","","",""]
[null,null,null,"2.2.3","Existing policies and procedures are reviewed in line with documented review dates, are up to date and fit for purpose.","Fully meeting our expectation","Recent programme of review and update has taken place","","","Completed","","","","","",""]
[null,null,null,"2.2.4","You update policies and procedures without undue delay when they require changes, eg because of operational change, court or regulatory decisions, or changes in regulatory guidance.","Fully meeting our expectation","Recent programme of review and update has taken place","","","Completed","","","","","",""]
[null,null,null,"2.2.5","All policies, procedures and guidelines show document control information, including version number, owner, review date and change history.","Fully meeting our expectation","Yes, following the standard SLC format","","","Completed","","","","","",""]
[null,2.2999999999999998,"Staff awareness: Staff are fully aware of the data protection and information governance policies and procedures that are relevant to their role.","2.3.1","Your staff read and understand the policies and procedures, including why they are important to implement and comply with.","Fully meeting our expectation","Data protection section within the document library and displays the latest copy of the policy. We also have the data protection hub on the staff portal at all times ","Improve awareness of the data protection policies","Chris Sumner","Completed","","","","","",""]
[null,null,null,"2.3.2","You tell staff about updated policies and procedures.","Partially meeting our expectation","As Above","Will be compelte based on 2.3.1","Chris Sumner","On track","2025-06-22","","","","",""]
[null,null,null,"2.3.3","You make policies and procedures readily available for all staff on your organisation's intranet site (or equivalent shared area) or provide them in other ways that are easy to access.","Fully meeting our expectation","Online hub for policies and procedures in available on the Intranet for staff","","","Completed","","","","","",""]
[null,null,null,"2.3.4","Guidelines, posters or publications help to emphasise key messages and raise staff awareness of policies and procedures.","Fully meeting our expectation","Key messages are reiterated using the staff newsletter and training sessions","","","Completed","","","","","",""]
[null,2.4,"Data Protection by design and by default: Your policies and procedures foster a 'data protection by design and by default' approach across your organisation.","2.4.1","Where relevant, you consider policies and procedures across your organisation with data protection in mind.","Not meeting our expectation","Currently little or no consideration for data protection when creating P&P","DP section on the version control of the documents that ask \"Have you considered data protection implications?\"","SLT/Chris Sumner","On track","2025-06-22","","","","",""]
[null,null,null,"2.4.2","You have policies and procedures to make sure that data protection issues are considered when systems, services, products and business practices involving personal data are designed and implemented, and that personal data is protected by default.","Fully meeting our expectation","DPIA procedure is in place","","","Completed","","","","","",""]
[null,null,null,"2.4.3","Your organisation's approach to implementing the data protection principles and safeguarding individuals' rights, including data minimisation, pseudonymisation and purpose limitation, is set out in policies and procedures.","Fully meeting our expectation","Covered by policies and procedures","","","Completed","","","","","",""]
[null,null,null,"2.4.4","The personal data of vulnerable groups, eg children, is given extra protection in policies and procedures.","Partially meeting our expectation","It is considered as part of the EIA but not formalised","Complete 2.4.1 to clear this action","SLT/Chris Sumner","On track","2025-06-22","","","","",""]
["Training and awareness",3.1,"All staff training programme: You have an all-staff data protection and information governance training programme.","3.1.1","Your programme incorporates national and sector-specific requirements.","Fully meeting our expectation","","","","Completed","","","","","",""]
[null,null,null,"3.1.2","Your programme is comprehensive and includes training for all staff on key areas of data protection such as handling requests, data sharing, information security, personal data breaches and records management.","Fully meeting our expectation","Comprehensive programme incorporating these elements is in place","","","Completed","","","","","",""]
[null,null,null,"3.1.3","You consider the training needs of all staff and use this information to compile the training programme.","Fully meeting our expectation","","","","Completed","","","","","",""]
[null,null,null,"3.1.4","You assign responsibilities for managing data protection and information governance training across your organisation and you have training plans or strategies in place to meet training needs within agreed time-scales.","Fully meeting our expectation","Training is in place however improvements to the timescales need to made before this becomes green\n\nUPDATE APRIL: Mandatory training is now being chased by HR for all staff with the TES Develop Data protection module.","Further awareness and notices can be sent out from us as the year goes on (Staff newsletter). Just to evidence when we do this.","Chris Sumner","Completed","","","","","",""]
[null,null,null,"3.1.5","You have dedicated and trained resources available to deliver training to all staff.","Fully meeting our expectation","DPO and MIS manager available to deliver training","","","Completed","","","","","",""]
[null,null,null,"3.1.6","You regularly review your programme to make sure that it remains accurate and up-to-date.","Fully meeting our expectation","","","","Completed","","","","","",""]
[null,null,null,"3.1.7","Senior management sign off your programme.","Fully meeting our expectation","Programme approved by MIS manager/Data Protection Lead","","","Completed","","","","","",""]
[null,3.2,"Induction and refresher training: Your training programme includes induction and refresher training for all staff on data protection and information governance.","3.2.1","Appropriate staff, such as the DPO or an information governance manager, oversee or approve induction training.","Fully meeting our expectation","Induction training is reviewed by the DPO","","","Completed","","","","","",""]
[null,null,null,"3.2.2","All staff receive induction and refresher training, regardless of how long they will be working for your organisation, their contractual status, or grade.","Fully meeting our expectation","Controlled by HR from the CPD package that they pruchase. The 3.1.4 also will support this when implement","","","Completed","","","","","",""]
[null,null,null,"3.2.3","Your staff receive induction training prior to accessing personal data and within one month of their start date.","Fully meeting our expectation","As Above, CPD training package from HR covers this","","","Completed","","","","","",""]
[null,null,null,"3.2.4","Your staff complete refresher training at appropriate intervals.","Fully meeting our expectation","As above.","","","Completed","","","","","",""]
[null,3.3,"Specialised roles: Specialised roles or functions with key data protection responsibilities (such as DPOs, subject access and records management teams) receive additional training and professional development beyond the basic level provided to all staff.","3.3.1","You complete a training needs analysis for data protection and information governance staff to inform the training plan and to make sure it is specific to the individual's responsibilities.","Partially meeting our expectation","DPO is trained in HEFESTIS. The Governance/principalship group have demonstrated that they understand the risks.","HEFESTIS Covers the training needs of the DPO, Governance Staff (Board and Exec team) could have additional training however, they have data protection risks highlight to them in a 6 month basis.","Susan Patterson","On track","2025-06-22","","","","",""]
[null,null,null,"3.3.2","You set out training and skills requirements in job descriptions.","Fully meeting our expectation","The job descriptions now have a section on UK GDPR. Could still do more with the training however, that is covered with the above point.","","Susan Patterson","Completed","","","","","",""]
[null,null,null,"3.3.3","You have evidence to confirm that key roles complete up to date and appropriate specialised training and professional development, and they receive proportionate refresher training.","Fully meeting our expectation","","","","Completed","","","","","",""]
[null,null,null,"3.3.4","You keep on record copies of the training material provided as well as details of who receives the training.","Fully meeting our expectation","","","","Completed","","","","","",""]
[null,3.4,"Monitoring: Your organisation can demonstrate that staff understand the training. You verify their understanding and monitor it appropriately eg through assessments or surveys.","3.4.1","You conduct an assessment at the end of the training to test staff understanding and make sure that it is effective, which could include a minimum pass mark.","Fully meeting our expectation","","","","Completed","","","","","",""]
[null,null,null,"3.4.2","You keep copies of the training material provided on record as well as details of who receives the training.","Fully meeting our expectation","","","","Completed","","","","","",""]
[null,null,null,"3.4.3","You monitor training completion in line with organisational requirements at all levels of the organisation, and you follow up with staff who do not complete the training.","Fully meeting our expectation","New training modules have been followed up by HR, Over 90% of the staff have completed the online training in the last 12months.","","Chris Sumner","Completed","","","","","",""]
[null,null,null,"3.4.4","Staff are able to provide feedback on the training they receive.","Fully meeting our expectation","","","","Completed","","","","","",""]
[null,3.5,"Awareness-raising: You regularly raise awareness across your organisation of data protection, information governance, and associated policies and procedures in meetings or staff forums. You make it easy for staff to access relevant material.","3.5.1","You have evidence that your organisation regularly uses a variety of appropriate methods to raise staff awareness and the profile of data protection and information governance, for example by emails, team briefings and meetings, posters, handouts and blogs.","Partially meeting our expectation","Newsletters and intranet, only improvement is the training calendar","Training calendar to be completed in action 3.1.4","Chris Sumner","On track","2025-06-22","","","","",""]
[null,null,null,"3.5.2","You make it easy for staff to access relevant material, and find out who to contact if they have any queries relating to data protection and information governance.","Fully meeting our expectation","Newsletters, moodle, data protection hub, p&p site","","","Completed","","","","","",""]
["Individuals' rights ",4.0999999999999996,"Informing individuals and identifying requests: You inform individuals about their rights and all staff are aware of how to identify and deal with both verbal and written requests.","4.1.1","You give individuals clear and relevant information about their rights and how to exercise them.","Fully meeting our expectation","Information is available on the website","","","Completed","","","","","",""]
[null,null,null,"4.1.2","Your policies and procedures set out processes for dealing with requests from individuals about their rights.","Fully meeting our expectation","Data Subjects Rights procedure is in place","","","Completed","","","","","",""]
[null,null,null,"4.1.3","All staff receive training and guidance about how to recognise requests and where to send them.","Fully meeting our expectation","Updated April: HR chasing and supporting the mandatory training for all staff","","Chris Sumner","Completed","","","","","",""]
[null,4.2,"Resources: You have appropriate resources in place to handle requests from individuals about their personal data.","4.2.1","A specific person/s or team are responsible for managing and responding to requests.","Fully meeting our expectation","DPO Team is responsible for managing Data Subjects Rights Requests","","","Completed","","","","","",""]
[null,null,null,"4.2.2","Staff receive specialised training to handle requests, including regular refresher training. ","Fully meeting our expectation","","","","Completed","","","","","",""]
[null,null,null,"4.2.3","You have sufficient resources to deal with requests.","Fully meeting our expectation","DPO staff are generally able to meet the demand and additional support from other services may be accessed as appropriate","","","Completed","","","","","",""]
[null,null,null,"4.2.4","If a staff member is absent, other staff are trained to carry out key tasks.","Fully meeting our expectation","The current level of resource can deal with some staff absence. New arrangements would be required in the case of prolonged absence\n\nUPDATE APRIL: Now 3 in the team which seems proportionate for the amount of SARs/Breaches etc. The MIS team can help with support if required.","","","Completed","","","","","",""]
[null,null,null,"4.2.5","Your organisation can deal with any increase in requests or reduction in staffing levels.","Fully meeting our expectation","To date the service has been able to deal with an increase in requests and a reduction in staffing levels","","","Completed","","","","","",""]
[null,4.3,"Logging and tracking requests: Your organisation logs receipt of all verbal and written requests from individuals and updates the log to track the handling of each request.","4.3.1","You have processes in place to make sure that the log is accurate and updated as appropriate.","Fully meeting our expectation","DPO Team keep Data Subject Rights Requests log up-to-date","","","Completed","","","","","",""]
[null,null,null,"4.3.2","The log shows the due date for requests, the actual date of the final response and the action taken. ","Fully meeting our expectation","This is part of the DSR log","","","Completed","","","","","",""]
[null,null,null,"4.3.3","A checklist records the key stages in the request handling process, eg which systems or departments have been searched. This is either part of the log or a separate document.","Partially meeting our expectation","Which systems or departments have been searched is not currently included in the log or formally in the documentation\n\nNotes on the helpdesk, to improve what the actions have been. Maybe try to demonstrate this in the next few SAR's and Data breaches","Add this information into the DSR log\n\nUpdate the helpdesk for who we're asking information from e.g. MIS for student record data, HR for staff data, complaints etc.","Chris Sumner","On track","2025-06-22","","","","",""]
[null,null,null,"4.3.4","You have records of your organisation's request responses, and any disclosed or withheld information from subject access requests.","Fully meeting our expectation","","","","Completed","","","","","",""]
[null,4.4000000000000004,"Timely responses: You deal with requests in a timely manner that meets individual expectations and statutory timescales.","4.4.1","You action all requests within statutory timescales.","Fully meeting our expectation","","","","Completed","","","","","",""]
[null,null,null,"4.4.2","The staff responsible for managing requests meet regularly to discuss any issues and investigate, prioritise or escalate any delayed cases.","Fully meeting our expectation","Discussion of cases as required during operational meetings","","","Completed","","","","","",""]
[null,null,null,"4.4.3","If you need an extension, you update individuals on the progress of their request and keep them informed.","Fully meeting our expectation","Yes, this is recorded in the correspondence and case records","","","Completed","","","","","",""]
[null,null,null,"4.4.4","If a request is refused, you have records about the reasons why and you inform individuals about the reasons for any refusals or exemptions.","Fully meeting our expectation","Yes, this is recorded in the correspondence and case records","","","Completed","","","","","",""]
[null,4.5,"Monitoring and evaluating performance: Your organisation monitors how your staff handle requests and you use that information to make improvements.","4.5.1","The staff responsible for managing requests meet regularly to discuss any issues.","Fully meeting our expectation","Operational meetings are held weekly and more often as required due to particular circumstances","","","Completed","","","","","",""]
[null,null,null,"4.5.2","You produce regular reports on performance and case quality assessments to make sure that requests are handled appropriately.","Not meeting our expectation","Reports are not currently produced","We can use the agenda template for the DPG, this should have the standard reports in it. Probably needs reviewed with Susan","Chris Sumner","On track","2025-06-22","","","","",""]
[null,null,null,"4.5.3","You share reports with senior management, that they review and action as appropriate at meetings.","Not meeting our expectation","Reports are not currently produced","We can use the agenda template for the DPG, this should have the standard reports in it. Probably needs reviewed with Susan","Chris Sumner","On track","2025-06-22","","","","",""]
[null,null,null,"4.5.4","Your organisation analyses any trends in the nature or cause of requests to improve performance or reduce volumes.","Not meeting our expectation","Formal trend analysis is not currently conducted. The volume of requests received is low.","We can use the agenda template for the DPG, this should have the standard reports in it. Probably needs reviewed with Susan","Chris Sumner","On track","2025-06-22","","","","",""]
[null,4.5999999999999996,"Inaccurate or incomplete information: Your organisation has appropriate systems and procedures to change inaccurate information, add additional information to incomplete records or add a supplementary statement where necessary. ","4.6.1","Your organisation takes proportionate and reasonable steps to check the accuracy of the personal data held and, if necessary, is able to rectify it.","Fully meeting our expectation","Requests are dealt with as per the Data Subjects Rights Procedure","","","Completed","","","","","",""]
[null,null,null,"4.6.2","If your organisation is satisfied that the data is accurate, you have a procedure to explain this to the individual. You need to inform the individual of their right to complain, and as a matter of good practice, record on the system the fact that the individual disputes the accuracy of the information.","Fully meeting our expectation","Requests are dealt with as per the Data Subjects Rights Procedure","","","Completed","","","","","",""]
[null,null,null,"4.6.3","If personal data has been disclosed to others, your organisation contacts each recipient to inform them about the rectification, unless this is impossible or involves disproportionate effort.","Fully meeting our expectation","","","","Completed","","","","","",""]
[null,null,null,"4.6.4","If asked, your organisation tells the data subject which third parties have received the personal data.","Fully meeting our expectation","","","","Completed","","","","","",""]
[null,4.7,"Erasure: You have appropriate methods and procedures in place within your organisation to delete, suppress or otherwise stop processing personal data if required.","4.7.1","You erase personal data from back-up systems as well as live systems where necessary, and you clearly tell the individual what will happen to their data.","Fully meeting our expectation","Requests are dealt with as per the Data Subjects Rights Procedure","","","Completed","","","","","",""]
[null,null,null,"4.7.2","If the personal data is disclosed to others, your organisation contacts each recipient to inform them about the erasure, unless this is impossible or involves disproportionate effort.","Fully meeting our expectation","Requests are dealt with as per the Data Subjects Rights Procedure","","","Completed","","","","","",""]
[null,null,null,"4.7.3","If asked to, your organisation tells the data subject which third parties have received the personal data.","Fully meeting our expectation","Requests are dealt with as per the Data Subjects Rights Procedure","","","Completed","","","","","",""]
[null,null,null,"4.7.4","If personal data has been made public in an online environment, you take reasonable steps to tell other controllers, if they are processing it, to erase links to, copies or replication of that data.","Fully meeting our expectation","Requests are dealt with as per the Data Subjects Rights Procedure","","","Completed","","","","","",""]
[null,null,null,"4.7.5","Your organisation gives particular weight to a request for erasure where the processing is or was based on a child's consent, especially when processing any personal data on the internet.","Not Applicable","Data is not processed on this basis","","","","","","","","",""]
[null,4.8,"Restriction: Your organisation has appropriate methods and procedures in place to restrict the processing of personal data if required.","4.8.1","Your organisation restricts personal data in a way that is appropriate for the type of processing and the system, eg temporarily moving the data to another system or removing it from a website.","Fully meeting our expectation","Requests are dealt with as per the Data Subjects Rights Procedure","","","Completed","","","","","",""]
[null,null,null,"4.8.2","If the personal data has been disclosed to others, your organisation contacts each recipient to tell them about the restriction, unless this is impossible or involves disproportionate effort.","Fully meeting our expectation","","","","Completed","","","","","",""]
[null,null,null,"4.8.3","If asked to, your organisation tells the data subject which third parties have received the personal data.","Fully meeting our expectation","","","","Completed","","","","","",""]
[null,4.9000000000000004,"Data portability: Individuals are able to move, copy or transfer their personal data from your organisation to another securely, without affecting the data.","4.9.1","When requested, you provide personal data in a structured, commonly used and machine readable format.","Fully meeting our expectation","Requests are dealt with as per the Data Subjects Rights Procedure","","","Completed","","","","","",""]
[null,null,null,"4.9.2","Where possible and if an individual requests it, your organisation can directly transmit the information to another organisation.","Fully meeting our expectation","Requests are dealt with as per the Data Subjects Rights Procedure","","","Completed","","","","","",""]
[null,"4.10.","Rights relating to automated decision-making and profiling: Your organisation can protect individual rights related to automated decision-making and profiling, particularly where the processing is solely automated with legal or similar significant effects.","4.10.1","You complete additional checks for vulnerable groups, such as children, for all automated decision-making and profiling.","Not Applicable","","","","","","","","","",""]
[null,null,null,"4.10.2","Your organisation only collects the minimum data needed and has a clear retention policy for the profiles created.","Not Applicable","","","","","","","","","",""]
[null,null,null,"4.10.3","If your organisation uses solely automated decisions that have legal or similarly significant effects on individuals, you have a recorded process to make sure that these decisions only occur in accordance with Article 22 of the UK GDPR.  If this applies, your organisation must carry out a data protection impact assessment (DPIA).","Not Applicable","","","","","","","","","",""]
[null,null,null,"4.10.4","Where the decision is solely automated and has legal or similarly significant effects on individuals, a recorded process allows simple ways for individuals to request human intervention, express their opinion, and challenge a decision.","Not Applicable","","","","","","","","","",""]
[null,null,null,"4.10.5","You conduct regular checks for accuracy and bias to make sure that systems are working as intended, and you feed this back into the design process.","Not Applicable","","","","","","","","","",""]
[null,4.1100000000000003,"Individual complaints: Your organisation has procedures to recognise and respond to individuals' complaints about data protection, and individuals are made aware of their right to complain.","4.11.1","You have procedures to handle data protection complaints raised by individuals and you report their resolution to senior management.","Fully meeting our expectation","Part of the complaints process with outcomes communicated to SLT","","","Completed","","","","","",""]
[null,null,null,"4.11.2","The DPO's contact details or alternative contact points are publicly available if individuals wish to make a complaint about the use of their data.","Fully meeting our expectation","Information is available on the website","","","Completed","","","","","",""]
[null,null,null,"4.11.3","You tell individuals about their right to make a complaint to the ICO in your privacy information.","Fully meeting our expectation","Information is available on the website","","","Completed","","","","","",""]
["Transparency",5.0999999999999996,"Privacy notice content: Your organisation's privacy information or notice includes all the information required under Articles 13 and 14 of the UK GDPR.","5.1.1","Privacy information includes all relevant contact information, eg the name and contact details of your organisation (and your representative if applicable) and the DPO's contact details.","Fully meeting our expectation","See publicly available privacy notices on SLC website and internal privacy notices ","","","Completed","","","","","",""]
[null,null,null,"5.1.2","Privacy information includes the purposes of the processing and the lawful bases (and, if applicable, the legitimate interests for the processing).","Fully meeting our expectation","See publicly available privacy notices on SLC website and internal privacy notices ","","","Completed","","","","","",""]
[null,null,null,"5.1.3","Privacy information includes the types of personal data you obtain and the data source, if the personal data is not obtained from the individual it relates to.","Fully meeting our expectation","See publicly available privacy notices on SLC website and internal privacy notices ","","","Completed","","","","","",""]
[null,null,null,"5.1.4","Privacy information includes details of all personal data that you share with other organisations and, if applicable, details of transfers to any third countries or international organisations.","Fully meeting our expectation","See publicly available privacy notices on SLC website and internal privacy notices ","","","Completed","","","","","",""]
[null,null,null,"5.1.5","Privacy information includes retention periods for the personal data, or if that is not possible, the criteria used to determine the period.","Fully meeting our expectation","See publicly available privacy notices on SLC website and internal privacy notices ","","","Completed","","","","","",""]
[null,null,null,"5.1.6","Privacy information includes details about individuals' rights including, if applicable, the right to withdraw consent and the right to make a complaint. ","Fully meeting our expectation","See publicly available privacy notices on SLC website and internal privacy notices ","","","Completed","","","","","",""]
[null,null,null,"5.1.7","Privacy information includes details of whether individuals are under a statutory or contractual obligation to provide the personal data (if applicable, and if you collect the personal data from the individual it relates to).","Fully meeting our expectation","See publicly available privacy notices on SLC website and internal privacy notices ","","","Completed","","","","","",""]
[null,null,null,"5.1.8","You provide individuals with privacy information about the source of the processed personal data if you don't obtain it from the individual concerned, eg if the data is from publicly accessible sources such as social media, the open electoral register or Companies House.","Fully meeting our expectation","See publicly available privacy notices on SLC website and internal privacy notices ","","","Completed","","","","","",""]
[null,5.2,"Timely privacy information: You have a recorded procedure to make sure that privacy information is provided to individuals at the right time, unless an exemption applies.","5.2.1","Individuals receive privacy information when their personal data is collected (eg when they fill in a form) or by observation (eg when using CCTV or people are tracked online).","Fully meeting our expectation","Notices are linked to data collection forms ","","","Completed","","","","","",""]
[null,null,null,"5.2.2","If you obtain personal data from a source other than the individual it relates to, privacy information is provided to individuals within a reasonable period no later than one month of obtaining the data.","Fully meeting our expectation","See privacy notices and procedure","","","Completed","","","","","",""]
[null,5.3,"Effective privacy information: Your organisation provides privacy information that is: \n• concise;\n• transparent; \n• intelligible; \n• clear; \n• uses plain language; and \n• communicated in a way that is effective for the target audience.","5.3.1","You proactively make individuals aware of privacy information and have a free, easy way to access it.","Fully meeting our expectation","Notices are available on SLC website and Intranet ","","","Completed","","","","","",""]
[null,null,null,"5.3.2","You provide privacy information to individuals in electronic and hard-copy form, using a combination of appropriate techniques, such as a layered approach, icons and mobile and smart device functionalities.","Fully meeting our expectation","Notices are generally available in elctronic format. This is the preferred option. They have been assessed for accessibility.","","","Completed","","","","","",""]
[null,null,null,"5.3.3","You write privacy information in clear and plain language that the intended audience can understand, and offer it in accessible formats if required.","Fully meeting our expectation","Plain language used in notices","","","Completed","","","","","",""]
[null,null,null,"5.3.4","You take particular care to write privacy information for children in clear, plain language, that is age-appropriate, and explains the risks involved in the processing and what safeguards are in place.","Fully meeting our expectation","Plain language used in notices; clear fonts; clear where to find information at various points of the processes","","","Completed","","","","","",""]
[null,5.4,"Automated decision-making and profiling: Your organisation is transparent about any processing relating to automated decision-making and profiling. ","5.4.1","You have procedures for individuals to access the personal data you use to create profiles, so they can review for accuracy and edit if needed.","Not Applicable","This type of processing is not undertaken at the College","","","Completed","","","","","",""]
[null,null,null,"5.4.2","If the decision is solely automated and has legal or similarly significant effects, you tell individuals about the processing - including what information you are using, why and what the impact is likely to be.","Not Applicable","This type of processing is not undertaken at the College","","","Completed","","","","","",""]
[null,null,null,"5.4.3","If the purpose is initially unclear, you give individuals an indication of what your organisation is going to do with their data, and you proactively update your privacy information as this becomes clearer.","Not Applicable","This type of processing is not undertaken at the College","","","Completed","","","","","",""]
[null,null,null,"5.4.4","If the decision is solely automated and has legal or similarly significant effects, your organisation explains the processing in a meaningful way that enables individuals to exercise their rights including obtaining human intervention, expressing their point of view and contesting the decision. ","Not Applicable","This type of processing is not undertaken at the College","","","Completed","","","","","",""]
[null,5.5,"Staff awareness: Your organisation can demonstrate that any member of front line staff is able to explain the necessary privacy information to individuals and provide guidance to them.","5.5.1","You arrange organisation-wide staff training about privacy information.","Fully meeting our expectation","This is part of the training plan","","","Completed","","","","","",""]
[null,null,null,"5.5.2","Front-line staff receive more specialised or specific training.","Partially meeting our expectation","Training opportunities are available for front line staff and can be improved","Progress through the data protection working group","","On track","","","","","",""]
[null,null,null,"5.5.3","Staff are aware of the various ways in which the organisation provides privacy information.","Fully meeting our expectation","Covered in training available via the Data Protection Hub","","","Completed","","","","","",""]
[null,5.6,"Privacy information review: Your organisation has procedures to review the privacy information provided to individuals regularly to make sure that it is accurate, up-to-date and effective.","5.6.1","You review privacy information against the records of processing activities, to make sure it remains up to date and that it actually explains what happens with individuals’ personal data.","Not meeting our expectation","","Update ROPA","","On track","","","","","",""]
[null,null,null,"5.6.2","You maintain a log of historical privacy notices, including the dates you made any changes, in order to allow a review of what privacy information was provided to individuals and when. ","Fully meeting our expectation","Privacy Notice Register is used to track changes","","","Completed","","","","","",""]
[null,null,null,"5.6.3","Your organisation carries out user-testing to evaluate how effective their privacy information is.","Not meeting our expectation","","Progress through the data protection working group","","On track","","","","","",""]
[null,null,null,"5.6.4","You analyse complaints from the public about how you use personal data, and in particular, any complaints about how you explain that use.","Fully meeting our expectation","Complaints procedure and complaints handling process","","","Completed","","","","","",""]
[null,null,null,"5.6.5","If you plan to use personal data for a new purpose, you have a procedure to update the privacy information and communicate the changes to individuals before starting any new processing.","Fully meeting our expectation","This is part of the brief DPIA and privacy notices procedure","","","Completed","","","","","",""]
[null,5.7,"Tools supporting transparency and control: Tools supporting transparency and control: You are open about how you use personal data, and offer tools to support transparency and control, especially when processing children's personal data. ","5.7.1","Privacy policies are clear and easy for members of the public to access.","Fully meeting our expectation","Plain language used in notices, available via the website","","","Completed","","","","","",""]
[null,null,null,"5.7.2","You provide individuals with tools, such as secure self-service systems, dashboards and just-in-time notices, so they can access, determine and manage how you use their personal data.","Fully meeting our expectation","Data Protection Hub and just in time notices available","","","Completed","","","","","",""]
[null,null,null,"5.7.3","Your organisation offers strong privacy defaults and user-friendly options and controls.","Partially meeting our expectation","Privacy defaults in systems","Investigate further controls in O365","","On track","","","","","",""]
[null,null,null,"5.7.4","Where relevant, you have processes in place to help children exercise their data protection rights in an easily accessible way that they understand.","Fully meeting our expectation","Transparency information is available","","","Completed","","","","","",""]
[null,null,null,"5.7.5","You implement appropriate measures to protect children using digital services.","Partially meeting our expectation","Safeguarding rules inside Smoothwall","Review security settings","","On track","","","","","",""]
["Records of processing and lawful basis ",6.1,"Data-mapping: Your organisation frequently carries out comprehensive data mapping exercises, providing a clear understanding of what information is held and where.","6.1.1","Your organisation carries out Information audits (or data mapping exercises) to find out what personal data is held and to understand how the information flows through your organisation.","Fully meeting our expectation","Record of Processing Activities (ROPA) records personal data processing activities","","","Completed","","","","","",""]
[null,null,null,"6.1.2","You keep the data map up-to-date and you clearly assign the responsibilities for maintaining and amending it.","Partially meeting our expectation","Roles and responsibilities to be assigned for future updates of the ROPA",{"$error":"#REF!"},"","On track","","","","","",""]
[null,null,null,"6.1.3","You consult staff across your organisation to make sure that there is an accurate picture of processing activities, for example by using questionnaires and staff surveys. ","Partially meeting our expectation","","Consultation process to be completed for 23/24","","On track","","","","","",""]
[null,6.2,"Records of processing activities (ROPA): Your organisation has a formal, documented, comprehensive and accurate ROPA based on a data mapping exercise that is regularly reviewed.","6.2.1","You record processing activities in electronic form so you can add, remove or amend information easily.","Fully meeting our expectation","","","","Completed","","","","","",""]
[null,null,null,"6.2.2","Your organisation regularly reviews the record against processing activities, policies and procedures to make sure that it remains accurate and up-to-date, and you clearly assign responsibilities for doing this.","Partially meeting our expectation","","See 6.1.2-3","","On track","","","","","",""]
[null,null,null,"6.2.3","You regularly review the processing activities and types of data you process for data minimisation purposes.","Partially meeting our expectation","","See 6.1.2-3","","On track","","","","","",""]
[null,6.3,"ROPA requirements: The ROPA contains all the relevant requirements set out in Article 30 of the  UK GDPR.","6.3.1","The ROPA includes (as a minimum):\n• Your organisation's name and contact details, whether it is a controller or a processor (and where applicable, the joint controller, their representative and the DPO);\n• the purposes of the processing;\n• a description of the categories of individuals and personal data;\n• the categories of recipients of personal data;\n• details of transfers to third countries, including a record of the transfer mechanism safeguards in place;\n• retention schedules; and\n• a description of the technical and organisational security measures in place.","Fully meeting our expectation","ROPA contains all of the required elements","","","Completed","","","","","",""]
[null,null,null,"6.3.2","You have an internal record of all processing activities carried out by any processors on behalf of your organisation. ","Partially meeting our expectation","DPA Register is in place","Check DPA Register for comprehensiveness","","On track","","","","","",""]
[null,6.4,"Good practice for ROPAs: Your organisation's ROPA includes links to other relevant documentation as a matter of good practice.","6.4.1","The ROPA also includes, or links to documentation covering:\n• information required for privacy notices, such as the lawful basis for the processing and the source of the personal data;\n• records of consent;\n• controller-processor contracts;\n• the location of personal data;\n•  DPIA reports;\n• records of personal data breaches;\n• information required for processing special category data or criminal conviction and offence data under the Data Protection Act 2018 (DPA 2018); and\n• retention and erasure policy documents.","Partially meeting our expectation","Currently includes some but not all of these elements e.g. includes legal bases for processing, does not include links to records of consent","","","","","","","","",""]
[null,6.5,"Documenting your lawful basis: You document and appropriately justify your organisation's lawful basis for processing personal data in line with Article 6 of the UK GDPR (and Articles 9 and 10, if the processing involves special category or criminal offence data).","6.5.1","Your organisation selects the most appropriate lawful basis (or bases) for each activity following a review of the processing purposes.","Fully meeting our expectation","Evidenced in privacy notices and ROPA","","","Completed","","","","","",""]
[null,null,null,"6.5.2","You document the lawful basis (or bases) relied upon and the reasons why.","Fully meeting our expectation","Evidenced in privacy notices and ROPA","","","Completed","","","","","",""]
[null,null,null,"6.5.3","If your organisation processes special category data or criminal offence data, you identify and document a lawful basis for general processing and an additional condition for processing this type of data (or in the case of criminal offence data only, you identify the official authority to process).","Fully meeting our expectation","Evidenced in privacy notices and ROPA","","","Completed","","","","","",""]
[null,null,null,"6.5.4","In the case of special category or criminal offence data, you document consideration of the requirements of Article 9 or 10 of the UK GDPR and Schedule 1 of the DPA 2018 where relevant.","Fully meeting our expectation","Evidenced in privacy notices and ROPA","","","Completed","","","","","",""]
[null,null,null,"6.5.5","Where Schedule 1 requires it, there is an appropriate policy document including: \n• which Schedule 1 conditions you are relying on; \n• what procedures you have in place to ensure compliance with the data protection principle; \n• how special category or criminal offence data will be treated for retention and erasure purposes; \n• a review date; and \n• details of an individual assigned responsibility for the processing.","Fully meeting our expectation","Special category and criminal convictions policy is in place as required","","","Completed","","","","","",""]
[null,null,null,"6.5.6","You identify the lawful basis before starting any new processing.","Fully meeting our expectation","Covered by the DPIA process","","","Completed","","","","","",""]
[null,6.6,"Lawful basis transparency: You make information about the purpose of the processing and the lawful basis publicly available. This is easy to locate, access and read.","6.6.1","You make information about the purposes of the processing, your lawful basis and relevant conditions for processing any special category data or criminal offence data publicly available in your organisation's privacy notice(s).","Fully meeting our expectation","See privacy notices","","","Completed","","","","","",""]
[null,null,null,"6.6.2","You provide information in an easily understandable format.","Fully meeting our expectation","See privacy notices","","","Completed","","","","","",""]
[null,null,null,"6.6.3","If there is a genuine change in circumstances, or if your lawful basis must change due to a new and unanticipated purpose, you inform individuals in timely manner and record the changes.","Fully meeting our expectation","See privacy notices and Privacy Notice Register","","","Completed","","","","","",""]
[null,6.7,"Consent requirements: If your organisation relies on consent for the processing of personal data, you comply with the consent requirements of the UK GDPR on being: \n• specific; \n• granular; \n• prominent; \n• opt-in; \n• documented; and \n• easily withdrawn. ","6.7.1","Consent requests: \n• are kept separate from other terms and conditions; \n• require a positive opt-in and do not use pre-ticked boxes; \n• are clear and specific (not a pre-condition of signing up to a service); \n• inform individuals how to withdraw consent in an easy way; and \n• give your organisation's name as well as the names of any third parties relying on consent.","Fully meeting our expectation","Compliant consent process operated by Marketing","","","Completed","","","","","",""]
[null,null,null,"6.7.2","You have records of what an individual has consented to, including what they were told and when and how they consented. The records are thorough and easy for relevant staff to access, review and withdraw if required.","Fully meeting our expectation","Compliant consent process operated by Marketing","","","Completed","","","","","",""]
[null,null,null,"6.7.3","You have evidence and examples of how consent is sought from individuals, for example online forms or notices, opt in-tick boxes, and paper-based forms.","Fully meeting our expectation","Compliant consent process operated by Marketing","","","Completed","","","","","",""]
[null,6.8,"Reviewing consent: You proactively review records of previously gathered consent, which demonstrates a commitment to confirming and refreshing consents. ","6.8.1","You have a procedure to review consents to check that the relationship, the processing and the purposes have not changed and to record any changes.","Fully meeting our expectation","Compliant consent process operated by Marketing","","","Completed","","","","","",""]
[null,null,null,"6.8.2","Your organisation has a procedure to refresh consent at appropriate intervals.","Fully meeting our expectation","Compliant consent process operated by Marketing","","","Completed","","","","","",""]
[null,null,null,"6.8.3","Your organisation uses privacy dashboards or other preference-management tools to help people manage their consent.","Not Applicable","The College tracks consent as necessary. Further use of preference- management tools is not a priority","","","Completed","","","","","",""]
[null,6.9,"Risk-based age checks and parental/guardian consent: Your organisation has effective systems to conduct risk-based age checks of individuals and, where required, to obtain and record parental or guardian consent.","6.9.1","Your organisation makes reasonable efforts to check the age of those giving consent, particularly where the individual is a child.","Fully meeting our expectation","SFC compliance requires these checks","","","Completed","","","","","",""]
[null,null,null,"6.9.2","You have a reasonable and effective procedure to determine whether the individual in question can provide their own consent, and if not, an effective way to gain and record parental or guardian consent. ","Partially meeting our expectation","Check declaration",{"$error":"#REF!"},"","On track","","","","","",""]
[null,null,null,"6.9.3","When providing online services to children, your organisation has risk-based age checking systems in place to establish age with a level of certainty that is appropriate based on the risks to children's rights and freedoms.","Not Applicable","No online services are offered to children","","","Completed","","","","","",""]
[null,null,null,"6.9.4","When providing online services to children, if the child is under 13, you have records of parental or guardian consent which are reviewed regularly, and you make reasonable efforts to verify that the person giving consent has parental or guardian responsibility. You give particular consideration when a child reaches the age of 13 and is able to provide their own consent.","Not Applicable","No students are under 13","","","Completed","","","","","",""]
[null,6.1,"Legitimate Interest Assessment (LIA): If your organisation's lawful basis is legitimate interests, you have completed an appropriate LIA prior to starting the processing.","6.10.1","The LIA identifies the legitimate interest, the benefits of the processing and whether it is necessary.","Fully meeting our expectation","See LIA template","","","Completed","","","","","",""]
[null,null,null,"6.10.2","The LIA includes a 'balancing test' to show how your organisation determines that its legitimate interests override the individuals' and considers the following issues:\n• not using people's data in intrusive ways or in ways which could cause harm, unless there is a very good reason;\n• protecting the interests of vulnerable groups such as people with learning disabilities or children;\n• whether you could introduce safeguards to reduce any potentially negative impact;\n• whether you could offer an opt-out; and\n• whether you require a DPIA.","Fully meeting our expectation","See LIA template","","","Completed","","","","","",""]
[null,null,null,"6.10.3","You clearly document the decision and the assessment.","Fully meeting our expectation","See LIA template","","","Completed","","","","","",""]
[null,null,null,"6.10.4","You complete the LIA prior to the start of the processing.","Partially meeting our expectation","This is generally the case","Check LIA assessments exist for all processing based on legitimate interests in the ROPA","","On track","","","","","",""]
[null,null,null,"6.10.5","You keep the LIA under review and refresh it if changes affect the outcome.","Fully meeting our expectation","LIAs are revisited should circumstances change","","","Completed","","","","","",""]
["Contracts and data sharing",7.1,"Data sharing policies and procedures: Your organisation's policies and procedures make sure that you appropriately manage data sharing decisions.","7.1.1","You have a review process, through a DPIA or similar exercise, to assess the legality, benefits and risks of the data sharing.","Fully meeting our expectation","DPIA Procedure in place","","","Completed","","","","","",""]
[null,null,null,"7.1.2","You document all sharing decisions for audit, monitoring and investigation purposes and you regularly review them.","Partially meeting our expectation","","Add information to the Data Protection Hub","","On track","","","","","",""]
[null,null,null,"7.1.3","Your organisation has clear policies, procedures and guidance about data sharing, including who has the authority to make decisions about systematic data sharing or one-off disclosures, and when it is appropriate to do so.","Fully meeting our expectation","Data Sharing Procedure in place","","","Completed","","","","","",""]
[null,null,null,"7.1.4","Your organisation adequately trains all staff likely to make decisions about data sharing, and makes them aware of their responsibilities. You refresh this training appropriately. ","Partially meeting our expectation","","Progress through the data protection working group and TES develop","","On track","","","","","",""]
[null,7.2,"Data sharing agreements: You arrange and regularly review data sharing agreements with parties with whom you regularly share personal data. \n","7.2.1","You agree data sharing agreements with all the relevant parties and senior management signs them off.","Fully meeting our expectation","This happens in line with the expectation","","","Completed","","","","","",""]
[null,null,null,"7.2.2","The data sharing agreement includes details about: \n• the parties' roles;\n• the purpose of the data sharing; \n• what is going to happen to the data at each stage; and \n• sets standards (with a high privacy default for children).","Fully meeting our expectation","These elements are covered in DSAs","","","Completed","","","","","",""]
[null,null,null,"7.2.3","Where necessary, procedures and guidance covering each organisation's day-to-day operations support the agreements.","Fully meeting our expectation","Part of the DPIA process and DPO advice","","","Completed","","","","","",""]
[null,null,null,"7.2.4","If your organisation is acting as a joint controller (within the meaning of Article 26 of the  UK GDPR), you set out responsibilities under an arrangement or a data sharing agreement, and you provide appropriate privacy information to individuals.","Fully meeting our expectation","Part of the DPIA process and DPO advice","","","Completed","","","","","",""]
[null,null,null,"7.2.5","You have a regular review process to make sure that the information remains accurate and up to date, and to examine how the agreement is working.","Not meeting our expectation","","Progress through the data protection working group","","Not started","","","","","",""]
[null,null,null,"7.2.6","You keep a central log of the current data sharing agreements.","Fully meeting our expectation","Log is kept by the Data Protection Team","","","Completed","","","","","",""]
[null,7.3,"Restricted transfers: Your organisation has procedures in place to make sure that restricted transfers are made appropriately.  ","7.3.1","You consider whether the restricted transfer is covered by an adequacy decision or by 'appropriate safeguards' listed in data protection law, such as contracts incorporating standard contractual data protection clauses adopted by the Commission or Binding Corporate Rules.","Fully meeting our expectation","Part of the DPIA process and DPO advice","","","Completed","","","","","",""]
[null,null,null,"7.3.2","If a restricted transfer is not covered by an adequacy decision nor an appropriate safeguard, you consider whether it is covered by an exemption set out in Article 49 of the UK GDPR","Fully meeting our expectation","Part of the DPIA process and DPO advice","","","Completed","","","","","",""]
[null,7.4,"Processors: You have appropriate procedures in place regarding the work that processors do on you behalf.","7.4.1","You have written contracts with all processors.","Partially meeting our expectation","This is managed via APUC frameworks","Assess if all contracts with processors are covered","","On track","","","","","",""]
[null,null,null,"7.4.2","If using a processor, you assess the risk to individuals and make sure that these risks are mitigated effectively.","Partially meeting our expectation","This is done through the DPIA process","Assess whether DPIAs cover all instances using ROPA review","","On track","","","","","",""]
[null,null,null,"7.4.3","An appropriate level of management approves the contracts and both parties sign. The level of management required for approval is proportionate to the value and risk of the contract. ","Fully meeting our expectation","This is part of the SLC Procurement process","","","Completed","","","","","",""]
[null,null,null,"7.4.4","Each contract (or other legal act) sets out details of the processing including the:\n• subject matter of the processing;\n• duration of the processing;\n• nature and purpose of the processing;\n• type of personal data involved;\n• categories of data subject; and\n• controller’s obligations and rights, in accordance with the list set out in Article 28(3) of the UK GDPR.","Fully meeting our expectation","These are standard elements of the controller to Processor contract used by SLC","","","Completed","","","","","",""]
[null,null,null,"7.4.5","You keep a record or log of all current processor contracts, which you update when processors change.","Partially meeting our expectation","DPA Register is in place","Assess if all contracts with processors are covered","","On track","","","","","",""]
[null,null,null,"7.4.6","You review contracts periodically to make sure they remain up to date.","Fully meeting our expectation","Covered by Procurement Officers","","","Completed","","","","","",""]
[null,null,null,"7.4.7","If a processor uses a sub-processor to help with the processing it is doing on your behalf, they have written authorisation from your organisation and a written contract with that sub-processor.","Fully meeting our expectation","Art 28 contract requirement","","","Completed","","","","","",""]
[null,7.5,"Controller-processor contract requirements: All of your controller-processor contracts cover the terms and clauses necessary to comply with data protection law.","7.5.1","The contract or other legal act includes terms or clauses stating that the processor must:\n• only act on the controller’s documented instructions, unless required by law to act without such instructions;\n• ensure that people processing the data are subject to a duty of confidence;\n• help the controller respond to requests from individuals to exercise their rights; and\n• submit to audits and inspections.","Fully meeting our expectation","Art 28 contract requirement","","","Completed","","","","","",""]
[null,null,null,"7.5.2","Contracts include the technical and organisational security measures the processor will adopt (including encryption, pseudonymisation, resilience of processing systems and backing up personal data in order to be able to reinstate the system).","Fully meeting our expectation","Contracts do include the technical and organisational measures required of processors. Descriptions may not be detailed. All contracts have to meet Cyber Essentials + accreditation which includes BCP and resilience","","","Completed","","","","","",""]
[null,null,null,"7.5.3","The contract inlcudes clauses to make sure that the processor either deletes or returns all personal data to the controller at the end of the contract. The processor must also delete existing personal data unless the law requires its storage.","Fully meeting our expectation","Art 28 contract requirement","","","Completed","","","","","",""]
[null,null,null,"7.5.4","Clauses are included to make sure that the processor assists the controller in meeting its UK GDPR obligations regarding the security of processing, the notification of personal data breaches and DPIAs. ","Fully meeting our expectation","Art 28 contract requirement","","","Completed","","","","","",""]
[null,7.6,"Processor due diligence checks: You carry out due diligence checks to guarantee that processors will implement appropriate technical and organisational measures to meet UK GDPR requirements. ","7.6.1","The procurement process builds in due diligence checks proportionate to the risk of the processing before you agree a contract with a processor.","Fully meeting our expectation","APUC processor checklist and DPIA Procedure in place","","","Completed","","","","","",""]
[null,null,null,"7.6.2","The due diligence process includes data security checks, eg site visits, system testing and audit requests.","Fully meeting our expectation","The due diligence processes does include data security checks","","","Completed","","","","","",""]
[null,null,null,"7.6.3","The due diligence process includes checks to confirm a potential processor will protect data subjects' rights.","Fully meeting our expectation","APUC processor checklist and DPIA Procedure in place","","","Completed","","","","","",""]
[null,7.7,"Processor compliance reviews: Your organisation reviews data processors' compliance with their contracts. ","7.7.1","Contracts include clauses to allow your organisation to conduct audits or checks, to confirm the processor is complying with all contractual terms and conditions.","Fully meeting our expectation","Art 28 contract requirement","","","Completed","","","","","",""]
[null,null,null,"7.7.2","You carry out routine compliance checks, proportionate to the processing risks, to test that processors are complying with contractual agreements.","Fully meeting our expectation","Short term contracts are in place, compliance checks are conducted at contract review","","","Completed","","","","","",""]
[null,7.8,"Third party products and services: Your organisation considers 'data protection by design' when selecting services and products to use in data processing activities.","7.8.1","When third parties supply products or services to process personal data, you choose suppliers that design their products or services with data protection in mind. ","Fully meeting our expectation","Data Protection is a consideration in addition to other factors","","","Completed","","","","","",""]
[null,7.9,"Purpose limitation: Your organisation proactively takes steps to only share necessary personal data with processors or other third parties.\n","7.9.1","Your organisation only shares the personal data necessary to achieve its specific purpose.","Fully meeting our expectation","See DPIA process","","","Completed","","","","","",""]
[null,null,null,"7.9.2","When information is shared, it is pseudonymised or minimised wherever possible. You also consider anonymisation so that the information is no longer personal data.","Fully meeting our expectation","See DPIA process","","","Completed","","","","","",""]
["Risks and Data Protection Impact Assessments.",8.1,"Identifying, recording and managing risks: Your organisation has appropriate policies, procedures and measures to identify, record and manage information risks.","8.1.1","An information risk policy (either a separate document or part of a wider corporate risk policy) sets out how your organisation and its data processors manage information risk, and how you monitor compliance with the information risk policy.","Fully meeting our expectation","Information risk is included in the standard strategic risk register","","","Completed","","","","","",""]
[null,null,null,"8.1.2","You have a process to help staff report and escalate data protection and information governance concerns and risks to a central point, for example, staff forums.","Fully meeting our expectation","Data Protection Hub and Helpdesk are ways to report risk","","","Completed","","","","","",""]
[null,null,null,"8.1.3","You identify and manage information risks in an appropriate risk register, which includes clear links between corporate and departmental risk registers and the risk assessment of information assets.","Partially meeting our expectation","Information risks are not captured at departmental level","Implement departmental risk registers","","On track","","","","","",""]
[null,null,null,"8.1.4","You have formal procedures to identify, record and manage risks associated with information assets in an information asset register. ","Partially meeting our expectation","","Review Information Asset Register","","On track","","","","","",""]
[null,null,null,"8.1.5","If you identify information risks, you have appropriate action plans, progress reports and a consideration of the lessons learnt to avoid future risk.","Partially meeting our expectation","Routes currently available to escalate risks to risk committee","Implement departmental risk registers, with escalation routes","","On track","","","","","",""]
[null,null,null,"8.1.6","You put measures in place to mitigate the risks identified within risk categories, and you test these regularly to make sure that they remain effective.","Partially meeting our expectation","Roues currently available to escalate risks to risk committee. Information risks are not captured at departmental level","Implement departmental risk registers, with escalation routes","","On track","","","","","",""]
[null,8.1999999999999993,"Data protection by design and by default: You take a data protection by design and default approach to managing risks, and, as appropriate, you build DPIA requirements into policies and procedures.","8.2.1","You reference DPIA requirements in all risk, project and change management policies and procedures, with links to DPIA policies and procedures.","Partially meeting our expectation","","Need to improve the DPIA process to incorporate data protection by design","","On track","","","","","",""]
[null,null,null,"8.2.2","Your procedures state that, if required, a DPIA should begin at the project's outset, before processing starts, and that the DPIA must run alongside the planning and development process.","Fully meeting our expectation","DPIA procedure","","","Completed","","","","","",""]
[null,null,null,"8.2.3","You anticipate risks and privacy-invasive events before they occur, making sure that at the initial design phase of any system, product or process and throughout, you consider the: \n• intended processing activities;\n• risks that these may pose to the rights and freedoms of individuals; and\n• possible measures available to mitigate the risks.","Fully meeting our expectation","DPIA procedure","","","Completed","","","","","",""]
[null,8.3000000000000007,"DPIA policy and procedures: You understand whether a DPIA is required , or where it would be good practice to do one. There is a clear DPIA policy and procedure.","8.3.1","You have a DPIA policy which includes:\n• clear procedures to decide whether you conduct a DPIA; \n• what the DPIA should cover;\n•  who will authorise it; and\n• how you will incorporate it into the overall planning.","Fully meeting our expectation","DPIA procedure","","","Completed","","","","","",""]
[null,null,null,"8.3.2","You have a screening checklist to consider if you need a DPIA, including all the relevant considerations on the scope, type and manner of the proposed processing. ","Fully meeting our expectation","DPIA procedure","","","Completed","","","","","",""]
[null,null,null,"8.3.3","If the screening checklist indicates that you do not need a DPIA, you document this.","Fully meeting our expectation","DPIA procedure","","","Completed","","","","","",""]
[null,null,null,"8.3.4","Your procedure includes the requirement to seek advice from the DPO and other internal staff as appropriate.","Fully meeting our expectation","DPIA procedure","","","Completed","","","","","",""]
[null,null,null,"8.3.5","Your procedure includes consultation with controllers, data processors, individuals, their representatives and any other relevant stakeholders as appropriate.","Fully meeting our expectation","DPIA procedure","","","Completed","","","","","",""]
[null,null,null,"8.3.6","Staff training includes the need to consider a DPIA at the early stages of any plan involving personal data, and where relevant, you train staff in how to carry out a DPIA. ","Fully meeting our expectation","See staff training materials","","","Completed","","","","","",""]
[null,null,null,"8.3.7","You assign responsibility for completing DPIAs to a member of staff who has enough authority over a project to effect change, eg a project lead or manager.","Fully meeting our expectation","DPIA procedure; manager sign-off","","","Completed","","","","","",""]
[null,8.4,"DPIA content: DPIAs always include the appropriate information and are comprehensively documented.","8.4.1","Your organisation has a standard, well-structured DPIA template which is written in plain English. ","Fully meeting our expectation","DPIA procedure","","","Completed","","","","","",""]
[null,null,null,"8.4.2","DPIAs:\n• include the nature, scope, context and purposes of the processing;\n• assess necessity, proportionality and compliance measures;\n• identify and assess risks to individuals; and \n• identify any additional measures to mitigate those risks.","Fully meeting our expectation","DPIA procedure","","","Completed","","","","","",""]
[null,null,null,"8.4.3","DPIAs clearly set out the relationships and data flows between controllers, processors, data subjects and systems.","Fully meeting our expectation","DPIA procedure","","","Completed","","","","","",""]
[null,null,null,"8.4.4","DPIAs identify measures that can be put in place to eliminate, mitigate or reduce high risks.","Fully meeting our expectation","DPIA procedure","","","Completed","","","","","",""]
[null,null,null,"8.4.5","You have a documented process, with appropriate document controls, that you review periodically to make sure that it remains up-to-date.","Fully meeting our expectation","DPIA procedure","","","Completed","","","","","",""]
[null,null,null,"8.4.6","You record your DPO's advice and recommendations, and the details of other consultations.","Fully meeting our expectation","DPIA procedure","","","Completed","","","","","",""]
[null,null,null,"8.4.7","Appropriate people sign off DPIAs, such as a project lead or senior manager.","Fully meeting our expectation","DPIA procedure","","","Completed","","","","","",""]
[null,8.5,"DPIA risk mitigation and review: You take appropriate and effective action to mitigate or manage any risks a DPIA identifies, and you have a DPIA review process.","8.5.1","You have a procedure to consult the ICO if you cannot mitigate residual high risks.","Fully meeting our expectation","DPIA procedure","","","Completed","","","","","",""]
[null,null,null,"8.5.2","You integrate outcomes from DPIAs into relevant work plans, project action plans and risk registers.","Fully meeting our expectation","DPIA procedure","","","Completed","","","","","",""]
[null,null,null,"8.5.3","You do not start high risk processing until mitigating measures are in place following the DPIA.","Fully meeting our expectation","DPIA procedure","","","Completed","","","","","",""]
[null,null,null,"8.5.4","You have a procedure to communicate the outcomes of DPIAs to appropriate stakeholders, eg through a formal summarised report.","Fully meeting our expectation","DPIA procedure; actions built into ongoing planning with appropriate stakeholders","","","Completed","","","","","",""]
[null,null,null,"8.5.5","You consider actively publishing DPIAs where possible, removing sensitive details if necessary.","Fully meeting our expectation","We actively involve project stakeholders so that they are aware of risks and actions which need to take place","","","Completed","","","","","",""]
[null,null,null,"8.5.6","You agree and document a schedule for reviewing the DPIA regularly or when the nature, scope, context or purposes of the processing changes.","Fully meeting our expectation","Built into process that the DPIA will be revisited if processing changes","","","Completed","","","","","",""]
["Records management and security",9.1,"Creating, locating and retrieving records: You have minimum standards for the creation of records and effective mechanisms to locate and retrieve them.","9.1.1","You have policies and procedures to make sure that you appropriately classify, title and index new records in a way that facilitates management, retrieval and disposal. ","Partially meeting our expectation","ROPA has begun but needs completed","Completed ROPA's for all Depts","Head of MIS","On track","","","","","",""]
[null,null,null,"9.1.2","You identify where you use manual and electronic record-keeping systems and maintain a central log or information asset register.","Partially meeting our expectation","ROPA has begun but needs completed","Completed ROPA's for all Depts","Head of MIS","On track","","","","","",""]
[null,null,null,"9.1.3","You know the whereabouts of records at all times, you track their movements, and you attempt to trace records that are missing or not returned.","Partially meeting our expectation","ROPA has begun but needs completed","Completed ROPA's for all Depts","Head of MIS","On track","","","","","",""]
[null,null,null,"9.1.4","You index records stored off-site with unique references to enable accurate retrieval and subsequent tracking.","Partially meeting our expectation","ROPA has begun but needs completed","Completed ROPA's for all Depts","Head of MIS","On track","","","","","",""]
[null,9.1999999999999993,"Security for transfers: You have appropriate security measures in place to protect data that is in transit, data you receive or transfer to another organisation.","9.2.1","You document rules to protect the internal and external transfer of records by post, fax and electronically, for example in a transfer policy or guidance.","Fully meeting our expectation","Use of the Office 365 data loss prevention site and staff training/alerts maintain a level of understanding when sending sensitive data policies also support this","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.2.2","You minimise data transferred off-site and keep it secure in transit.","Fully meeting our expectation","as above (9.2.2)","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.2.3","When you transfer data off site, you use an appropriate form of transport, (for example, secure courier, encryption, secure file transfer protocol (SFTP) or Virtual Private Network (VPN)), and you check to make sure that the information has been received.","Fully meeting our expectation","as above (9.2.2)","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.2.4","You have agreements in place with any third parties used to transfer business information between your organisation and third parties.","Fully meeting our expectation","Where possible data sharing agreements are discussed for all major contacts. Staff know to contact DPO when working with new companies from training and policies","n/a","n/a","Completed","","","","","",""]
[null,9.3000000000000007,"Data quality: You have procedures in place to make sure that records containing personal data are accurate, adequate and not excessive.","9.3.1","You conduct regular data quality reviews of records containing personal data to make sure they are accurate, adequate and not excessive.","Not meeting our expectation","No ROPA to check against at this stage therefore reviews cannot happen","Complete ROPA's and setup review schedule","Head of MIS","On track","","","","","",""]
[null,null,null,"9.3.2","You make staff aware of data quality issues following data quality checks or audits to prevent recurrence.","Not meeting our expectation","same as above (9.3.1)","same as above (9.3.1)","Head of MIS","On track","","","","","",""]
[null,null,null,"9.3.3","Records containing personal data (whether 'active' or archived) are 'weeded' periodically to reduce the risks of inaccuracies and excessive retention.","Partially meeting our expectation","same as above (9.3.1)","same as above (9.3.1)","Head of MIS","On track","","","","","",""]
[null,9.4,"Retention schedule: You have an appropriate retention schedule outlining storage periods for all personal data, which you review regularly.","9.4.1","You have a retention schedule based on business need with reference to statutory requirements and other principles (for example the National Archives). ","Fully meeting our expectation","SLC retention schedule","","","Completed","","","","","",""]
[null,null,null,"9.4.2","The schedule provides sufficient information to identify all records and to implement disposal decisions in line with the schedule.","Fully meeting our expectation","SLC retention schedule","","","Completed","","","","","",""]
[null,null,null,"9.4.3","You assign responsibilities to make sure that staff adhere to the schedule and you review it regularly.","Partially meeting our expectation","Not currently governing this but plan to do staff training to improve awareness","Complete staff training","Head of MIS","On track","","","","","",""]
[null,null,null,"9.4.4","You regularly review retained data to identify opportunities for minimisation, pseudonymisation, or anonymisation, and you document this in the schedule.","Partially meeting our expectation","Not currently governing this but plan to do staff training to improve awareness","Complete staff training","Head of MIS","On track","","","","","",""]
[null,9.5,"Destruction: You cover methods of destruction in a policy and they are appropriate to prevent disclosure of personal data prior to, during or after disposal","9.5.1","For paper documents, you use locked waste bins for records containing personal data, and either in-house or third party cross shredding or incineration is in place.","Fully meeting our expectation","Locked shreading bins are already used and staff know to use them to dispose of sensitve data","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.5.2","For information held on electronic devices, wiping, degaussing or secure destruction of hardware (shredding) is in place.","Fully meeting our expectation","disposal process and clean up process in IT is already used along with a data santisation process","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.5.3","You either hold, collect or send away securely confidential waste awaiting destruction.","Fully meeting our expectation","Locked shreading bins are already used and staff know to use them to dispose of sensitve data","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.5.4","You have appropriate contracts in place with third parties to dispose of personal data, and they provide you with appropriate assurance that they have disposed of the data securely, for example through audit checks and destruction certificates.","Fully meeting our expectation","Secure data disposal is used for paper and it equipment with certification of authentic cleansing in both cases.","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.5.5","You have a log of all equipment and confidential waste sent for disposal or destruction.","Fully meeting our expectation","Asset tracking of disposal and confirmation from the recycling company is collected and stored for audit","n/a","n/a","Completed","","","","","",""]
[null,9.6,"Information Asset Register: You have an asset register that records assets, systems and applications used for processing or storing personal data across your organisation.","9.6.1","Your organisation has an asset register that holds details of all information assets (software and hardware) including: \n• asset owners; \n• asset location; \n• retention periods; and \n• security measures deployed.","Partially meeting our expectation","Need to improve the information asset register as part of the ROPA program","Update the IAR we currently have following the ROPA","Head of MIS","On track","","","","","",""]
[null,null,null,"9.6.2","You review the register periodically to make sure it remains up to date and accurate.","Not meeting our expectation","require 9.6.1 to complete before a reviews can take place","as above (9.6.1)","Head of MIS","On track","","","","","",""]
[null,null,null,"9.6.3","You periodically risk-assess assets within the register and you carry out physical checks to make sure that the hardware asset inventory remains accurate.","Not meeting our expectation","as above (9.6.2)","as above (9.6.2)","Head of MIS","On track","","","","","",""]
[null,9.6999999999999993,"Rules for acceptable software use: You identify, document and implement rules for the acceptable use of software (systems or applications) processing or storing information.","9.7.1","You have Acceptable Use or terms and conditions of use procedures in place.","Fully meeting our expectation","AUP is displayed on every computer on login","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.7.2","You have system operating procedures which document the security arrangements and measures in place to protect the data held within systems or applications.","Partially meeting our expectation","There is some documentation to support this but probably not extensively across all risks","Review documentation to see if it matches this criteria","Head of MIS","On track","","","","","",""]
[null,null,null,"9.7.3","Your organisation monitors compliance with Acceptable Use rules and makes sure that staff are aware of any monitoring.","Fully meeting our expectation","Power bi report shows the acceptance of this with the staff and the IT department enforce this with staff and student by disabling the accounts if the AUP is breached","n/a","n/a","Completed","","","","","",""]
[null,9.8000000000000007,"Access control: You limit access to personal data to authorised staff only and regularly review users' access rights.","9.8.1","You have an Access Control policy which specifies that users must follow your organisation's practices in the use of secret authentication information, for example passwords or tokens.","Fully meeting our expectation","Physical and Technical access controls are in place for the college, access control for doors and conditional access rules in place for access to systems","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.8.2","You implement a formal user access provisioning procedure to assign access rights for staff (including temporary staff) and third party contractors to all relevant systems and services required to fulfil their role, for example 'new starter process'.","Fully meeting our expectation","HR notifiy IT for the new starters and give them role based permissions to various aspects of systems and doors based on their role","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.8.3","You restrict and control the allocation and use of privileged access rights.","Fully meeting our expectation","role based access as above","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.8.4","You keep a log of user access to systems holding personal data.","Fully meeting our expectation","We have multiple ways to know of access to systems, typically most is recorded at the Microsoft 365 dashboard but we use internal monitoring as well","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.8.5","You regularly review users' access rights and adjust or remove rights where appropriate, for example when an employee changes role or leaves the organisation.","Fully meeting our expectation","HR notifiy IT for the leavers and the accounts are prompted deactivated and deleted at the end of a rentention period as per the policy","n/a","n/a","Completed","","","","","",""]
[null,"9.9.","Unauthorised access: You prevent unauthorised access to systems and applications, for example by passwords, technical vulnerability management, and malware prevention tools.","9.9.1","You restrict access to systems or applications processing personal data to the absolute minimum in accordance with the principle of least privilege (for example read/write/delete/execute access rules are applied).","Fully meeting our expectation","this is role based within the IT user setup, same with access to physical locations with key management at facilities and safes/door combinations on a need-to-know basis.","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.9.2","You apply minimum password complexity rules and limited log on attempts to systems or applications processing personal data.","Fully meeting our expectation","minimum standard password plus MFA","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.9.3","You have password management controls in place, including default password changing, controlled use of any shared passwords and secure password storage (not in plain text).","Fully meeting our expectation","restricted password options are enabled to stop the word \"password\" being used etc. ","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.9.4","Emails content and attachment security solutions (encryption) appropriately protect emails containing sensitive personal data.","Fully meeting our expectation","Scanning done by mailroute and 365, the 365 dashboard tells us who is sending personal information as well .e.g national insurance numbers, student numbers etc.","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.9.5","You log and monitor user and system activity to detect anything unusual.","Fully meeting our expectation","Standar user operation is logged, network traffic analyser used for strange packages in the network. Quayls and NCSC web scanner to track irregular configurations on the system","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.9.6","You implement anti-malware and anti-virus (AV) protection across the network and on critical or sensitive information systems if appropriate.","Fully meeting our expectation","F-secure/Windows Defender","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.9.7","Anti-malware and anti-virus protection is kept up to date and you configure it to perform regular scans.","Fully meeting our expectation","Centrally controled AV and defender programs with follow up on failures","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.9.8","Your organisation has access to and acts upon any updates on technical vulnerabilities to systems or software, for example vendor’s alerts or patches.","Fully meeting our expectation","Security reviews quarterly etc.","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.9.9","You regularly run vulnerability scans.","Fully meeting our expectation","Qualys and NCSC webcheck","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.9.10","You deploy URL or web content filtering to block specific websites or entire categories.","Fully meeting our expectation","Web filter on firewall and client (f-secure)","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.9.11","You strictly control or prohibit the use of social media, or messaging apps such as WhatsApp to share personal data.","Not Applicable","Do not deny access but strongly advise and provide a communication platform. Socal media policy is in place","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.9.12","You have external and internal firewalls and intrusion detection systems in place as appropriate, to make sure that the information in networks and systems is protected from unauthorised access or attack, for example denial of service attacks.","Fully meeting our expectation","Requirement of cyber essentials","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.9.13","You do not have unsupported operating systems in use, for example Windows XP, Windows Server 2003.","Fully meeting our expectation","Requirement of cyber essentials","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.9.14","You establish special controls to safeguard the confidentiality and integrity of data passing over public networks or over wireless networks, and to protect the connected systems and applications.","Fully meeting our expectation","Requirement of cyber essentials","n/a","n/a","Completed","","","","","",""]
[null,"9.10.","Mobile devices, home or remote working and removable media: You have appropriate mechanisms in place to manage the security risks of using mobile devices, home or remote working and removable media.","9.10.1","You have a mobile device and a home/remote working policy that demonstrates how your organisation will manage the associated security risks.","Fully meeting our expectation","Intune","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.10.2","You have protections in place to avoid the unauthorised access to, or disclosure of, the information processed by mobile devices, for example encryption and remote wiping capabilities.","Fully meeting our expectation","Intune","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.10.3","You implement security measures to protect information processed when home or remote working, for example VPN and two factor authentication.","Fully meeting our expectation","VPN given to specific people for specific reason however most people are routed tor RDS services","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.10.4","Your organisation uses the most up to date version of its remote access solution. You are able to support and update devices remotely.","Fully meeting our expectation","RDS is up-to-date and maintained at the latest level","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.10.5","Where you have a business need to store personal data on removable media, you minimise personal data and your organisation implements a software solution that can set permissions or restrictions for individual devices, as well as an entire class of devices.","Fully meeting our expectation","onedrive is the default, no usbs are allowed without IT's knowledge","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.10.6","You do not allow equipment, information or software to be taken off-site without prior authorisation, and you have a log of all mobile devices and removeable media used and who they are allocated to.","Fully meeting our expectation","Asset tracking of the device lets us know where the equipment is and bitlocker used for encryption. Staff are allowed off site with devices but must return devices for review at periods of time during the year","n/a","n/a","Completed","","","","","",""]
[null,9.11,"Secure areas: You secure physical areas to prevent unauthorised access, damage and interference to personal data.","9.11.1","You protect secure areas (areas that contain either sensitive or critical information) by appropriate entry controls such as doors and locks, alarms, security lighting or CCTV.","Fully meeting our expectation","Locked server rooms with key control","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.11.2","You have visitor protocols in place such as signing-in procedures, name badges and escorted access.","Fully meeting our expectation","Visitor check at reception with badge control at major access doors","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.11.3","You implement additional protection against external and environmental threats in secure areas such as server rooms.","Fully meeting our expectation","HVAC in server rooms and fire suppression. Physical security at door and cabinets. Limited access to contractors and staff","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.11.4","Office equipment is appropriately placed and protected to reduce the risks from environmental threats and opportunities for unauthorised access.","Fully meeting our expectation","office equipment behind access controlled doors, access to equipment in public areas cannot access device in private areas","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.11.5","You securely store paper records and control access to them.","Fully meeting our expectation","Locked cabients and where possible use of digital storage rather than holding large storage of devices","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.11.6","You operate a clear desk policy across the organisation where personal data is processed.","Partially meeting our expectation","Clear desk policy is maintained but probably not documented well - to review the policy where this exists","Review documentation to see if it matches this criteria","Head of MIS","On track","","","","","",""]
[null,null,null,"9.11.7","You have regular clear desk 'sweeps' or checks and issues are fed back appropriately.","Partially meeting our expectation","can't do this until 9.11.6 is complete","as above","Head of MIS","On track","","","","","",""]
[null,null,null,"9.11.8","You operate a 'clear screen' policy across your organisation where personal data is processed.","Fully meeting our expectation","Locking screen is something that is governed in the college and is part of the AUP","n/a","n/a","Completed","","","","","",""]
[null,9.1199999999999992,"Business continuity, disaster recovery and back-ups: You have plans to deal with serious disruption, and you back up key systems, applications and data to protect against loss of personal data.","9.12.1","You have a risk-based business continuity plan to manage disruption and a disaster recovery plan to manage disasters, which identify records that are critical to the continued functioning of the organisation.","Partially meeting our expectation","BCP exisits but required update","Review and update BCP documents for all departments","Head of MIS","On track","","","","","",""]
[null,null,null,"9.12.2","You take back-up copies of electronic information, software and systems (and ideally store them off-site).","Fully meeting our expectation","Backup systems are well established and documented","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.13.3","The frequency of backups reflects the sensitivity and importance of the data.","Fully meeting our expectation","as above","n/a","n/a","Completed","","","","","",""]
[null,null,null,"9.13.4","You regularly test back-ups and recovery processes to make sure they remain fit for purpose.","Fully meeting our expectation","part of the security review","n/a","n/a","Completed","","","","","",""]
["Breach response and monitoring",10.1,"Detecting, managing and recording incidents and breaches: You have  procedures in place to make sure that you detect, manage and appropriately record personal data incidents and breaches.","10.1.1","You have appropriate training in place so that staff are able to recognise a security incident and a personal data breach.","Partially meeting our expectation","","Record breach management training session that can be accessed by all staff to support BMP posters and communications sent out last year.","","On track","","","","","",""]
[null,null,null,"10.1.2","A dedicated person or team manages security incidents and personal data breaches.","Fully meeting our expectation","Managed by the DPO Team","","","Completed","","","","","",""]
[null,null,null,"10.1.3","Staff know how to escalate a security incident promptly to the appropriate person or team to determine whether a breach has occurred.","Fully meeting our expectation","Covered in incident/breach procedure","","","Completed","","","","","",""]
[null,null,null,"10.1.4","Procedures and systems facilitate the reporting of security incidents and breaches.","Fully meeting our expectation","Covered in incident/breach procedure","","","Completed","","","","","",""]
[null,null,null,"10.1.5","Your organisation has a response plan for promptly addressing any security incidents and personal data breaches that occur.","Fully meeting our expectation","Incident and breach management plan are in place","","","Completed","","","","","",""]
[null,null,null,"10.1.6","You centrally log/record/document both actual breaches and near misses (even if they do not need to be reported to the ICO or individuals).","Fully meeting our expectation","Incident/data breach log and documentation in place","","","Completed","","","","","",""]
[null,null,null,"10.1.7","The log documents the facts relating to the near miss or breach including: \n• its causes; \n• what happened; \n• the personal data affected; \n• the effects of the breach; and \n• any remedial action taken and rationale.","Fully meeting our expectation","Incident/data breach log and documentation in place 2. Required elements are covered","","","Completed","","","","","",""]
[null,10.199999999999999,"Assessing and reporting breaches: You have procedures to assess all security incidents and then report relevant breaches to the ICO within the statutory time frame.","10.2.1","You have a procedure to assess the likelihood and severity of the risk to individuals as a result of a personal data breach.","Fully meeting our expectation","Covered in incident/breach procedure","","","Completed","","","","","",""]
[null,null,null,"10.2.2","You have a procedure to notify the ICO of a breach within 72 hours of becoming aware of it (even when all the information is not yet available) and you notify the ICO on time.","Fully meeting our expectation","Covered in incident/breach procedure","","","Completed","","","","","",""]
[null,null,null,"10.2.3","The procedure includes details of what information must be given to the ICO about the breach.","Fully meeting our expectation","Covered in incident/breach procedure","","","Completed","","","","","",""]
[null,null,null,"10.2.4","If you consider it unnecessary to report a breach, you document the reasons why your organisation considers the breach is unlikely to result in a risk to the rights and freedoms of individuals.","Fully meeting our expectation","Incident/data breach log and documentation in place. Required elements are covered","","","Completed","","","","","",""]
[null,10.3,"Notifying individuals: You have procedures to notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms.","10.3.1","You have a procedure setting out how you will tell affected individuals about a breach when it is likely to result in a high risk to their rights and freedoms.","Fully meeting our expectation","Covered in incident/breach procedure","","","Completed","","","","","",""]
[null,null,null,"10.3.2","You tell individuals about personal data breaches in clear, plain language without undue delay.","Fully meeting our expectation","Covered in incident/breach procedure","","","Completed","","","","","",""]
[null,null,null,"10.3.3","The information you provide to individuals includes the DPO's details, a description of the likely consequences of the breach and the measures taken (including mitigating actions and any possible adverse effects).","Fully meeting our expectation","Covered in incident/breach procedure. Covered in template notification letter for data subjects","","","Completed","","","","","",""]
[null,null,null,"10.3.4","You provide individuals with advice to protect themselves from any effects of the breach.","Fully meeting our expectation","Covered in incident/breach procedure. Covered in template notification letter for data subjects","","","Completed","","","","","",""]
[null,10.4,"Reviewing and monitoring: You review and monitor personal data breaches.","10.4.1","You analyse all personal data breach reports to prevent a recurrence. ","Fully meeting our expectation","Lessons learned for the future are recommended based on each incident","","","Completed","","","","","",""]
[null,null,null,"10.4.2","Your organisation monitors the type, volume and cost of incidents. ","Partially meeting our expectation","The organisation monitors the type and volume of incidents but not the cost incidents.","Take to the data protection oversight group","","On track","","","","","",""]
[null,null,null,"10.4.3","You undertake trend analysis on breach reports over time to understand themes or issues, and outputs are reviewed by groups with oversight for data protection and information governance.","Partially meeting our expectation","There is currently no oversight group in place","Set up data protection oversight group","","Not started","","","","","",""]
[null,null,null,"10.4.4","Groups with oversight for data protection and information governance review the outputs.","Partially meeting our expectation","There is currently no oversight group in place","Set up data protection oversight group","","Not started","","","","","",""]
[null,10.5,"External audit or compliance check: Your organisation arranges an external data protection and information governance audit, or other compliance checking procedure. ","10.5.1","Your organisation completes externally-provided self-assessment tools to provide assurances on compliance with data protection and information security compliance.","Partially meeting our expectation","Organisation is in the process of reviewing procedures against to ICO Accountability Framework","Complete initial baseline assessment of compliance against ICO Accountability Framework","","On track","","","","","",""]
[null,null,null,"10.5.2","Your organisation is subject to or employs the services of an external auditor to provide independent assurances (or certification) on data protection and information security compliance.","Fully meeting our expectation","DPO and Information Security advice and auditing provided by HEFESIS","","","Completed","","","","","",""]
[null,null,null,"10.5.3","Your organisation adheres to an appropriate code of conduct or practice for your sector (if one exists).","Fully meeting our expectation","The College complies with the Code of Good Governance which applies to all Scottish colleges","","","Completed","","","","","",""]
[null,null,null,"10.5.4","You produce audit reports to document the findings.","Partially meeting our expectation","Audit report will be generated from the ICO Accountability Framework assessment","","","On track","","","","","",""]
[null,null,null,"10.5.5","You have a central action plan in place to take forward the outputs from data protection and information governance audits.","Fully meeting our expectation","Central action plan is in place","Keep action plan up-to-date","","On track","","","","","",""]
[null,10.6,"Internal audit programme: If your organisation has an internal audit programme, it covers data protection and information governance (for example security and records management) in sufficient detail. ","10.6.1","You monitor your own data protection compliance and you regularly test the effectiveness of the measures you have in place.","Partially meeting our expectation","Central action plan is in place","Keep action plan up-to-date","","On track","","","","","",""]
[null,null,null,"10.6.2","Your organisation regularly tests staff adherence to data protection and information governance policies and procedures.","Partially meeting our expectation","","","","On track","","","","","",""]
[null,null,null,"10.6.3","You routinely conduct informal, ad-hoc monitoring and spot checks.","Partially meeting our expectation","","","","On track","","","","","",""]
[null,null,null,"10.6.4","You make sure that your monitoring of policy compliance is unbiased by keeping it separate from those who implement the policies.","Fully meeting our expectation","HEFESTIS data protection officer advises on policy. This officer is independent of those who implement the policy","","","Completed","","","","","",""]
[null,null,null,"10.6.5","You have a central audit plan/schedule in place to show the planning of data protection and information governance internal audits.","Partially meeting our expectation","","Check H&L internal audit schedule for next DP audit","","On track","","","","","",""]
[null,null,null,"10.6.6","You produce audit reports to document the findings.","Partially meeting our expectation","","Reports on progress on the Accountability Framework to be provided to the data protection working group","","On track","","","","","",""]
[null,null,null,"10.6.7","You have a central action plan in place to take forward the outputs from data protection and information governance audits.","Fully meeting our expectation","Action plan is formed via the Accountability Framework Audit","","","Completed","","","","","",""]
[null,10.7,"Performance and compliance information: Your organisation has business targets relating to data protection compliance and information governance, and you can access the relevant information to assess against them","10.7.1","You have Key Performance Indicators (KPIs) regarding SAR performance  (the volume of requests and the percentage completed within statutory timescales).","Fully meeting our expectation","We monitor compliance with statutory timescles for SAR compliance","","","Completed","","","","","",""]
[null,null,null,"10.7.2","You have KPIs regarding the completion of data protection and information governance training, including a report showing the percentage of staff who have complete the training. ","Partially meeting our expectation","We monitor completion of data protection training","Check how data protection training is monitored and reported","","On track","","","","","",""]
[null,null,null,"10.7.3","You have KPIs regarding information security, including the number of security breaches, incidents and near misses.","Fully meeting our expectation","We have KPIs concerning the reporting requirements for data breaches within statutory timescales","","","Completed","","","","","",""]
[null,null,null,"10.7.4","You have KPIs regarding records management, including the use of metrics such as file retrieval statistics, adherence to disposal schedules, and the performance of the system in place to index and track paper files containing personal data.","Not meeting our expectation","","","","Not started","","","","","",""]
[null,10.8,"Use of management information: All relevant management information and the outcomes of monitoring and review activity are communicated to relevant internal stakeholders, including senior management as appropriate. This information informs discussions and actions. ","10.8.1","You have a dashboard giving a high-level summary of all key data protection and information governance KPIs.","Not meeting our expectation","","Progress through data protection oversight group","","On track","","","","","",""]
[null,null,null,"10.8.2","The group(s) providing oversight of data protection and information governance regularly discuss KPIs and the outcomes of monitoring and reviews.","Not meeting our expectation","","Progress through data protection oversight group","","On track","","","","","",""]
[null,null,null,"10.8.3","Data protection and information governance KPIs and the outcomes of monitoring and reviews are discussed regularly by groups at operational level, for example in team meetings.","Not meeting our expectation","","Progress through data protection oversight group","","On track","","","","","",""]