The years have taught us that it’s always better to be prepared. The ostrich approach not only gets sand in your nose, but also leads to seriously sleepless nights when something goes wrong! In 2016 we had a data breech significant enough for us to need to involve Ofsted. Managing this stood us in good stead as we were able to write our breech procedures with direct experience in mind.
At Soundswell, our preparation for the deadline began as early as possible and included extensive internet research (ICO website was – as usual – particularly helpful), seeking advice from a variety of knowledgeable sources, webinars and, when we deemed ourselves to be compliant and could evidence that, a training event for all our associate therapists.
A significant step in the whole process of compliance was, as required by the new regulations, ’publishing’ our GDPR arrangement – which we did so on the Soundswell website. This was the moment of truth. The decisions we made were ‘out there’ for all to see (and challenge if necessary).
As May 28th came and went were very glad to ‘park’ GDPR until our agreed review date in August 2018 – which became a cursory revisit as it was too soon to see the impact of either our processes or any others. However, as our usual round of contract reviews and renewals came round it was a huge relief to be able to reassure (and evidence to) our schools and settings that we were GDPR compliant.
In the intervening 12 months we have learned a lot. Our risk register has a ‘privacy risks’ page and we are sufficiently confident to be able to not implement some processes (where guidance has been unclear or still a subject of debate) and rate (and live with) the risk as to why.
We have now just completed our 12 months review and are also going through the GDPR 12 step assessment process. Website chatter, professional conversations and anxious customer enquiries have died down to virtually nothing (we are the ones raising the subject now as we meet with new schools & settings).
In answer to the question ‘was it worth the effort?’ – indeed it was. We have reviewed and updated our website information (click here) and the minimal amount of work involved confirms to us that it was well-worth making a proper job of it the first time round!