Multi academy trusts, federations and groups of schools face a particular data protection challenge. Each school handles personal data every day, but accountability sits with the trust. The Initial Trust Plan is a checklist that gives your central team a clear, high-level picture of where the trust stands and what needs attention first.
This article is part of our Governance Week series. It brings together everything you need to know about the Initial Trust Plan: what it covers, who should own it, how it fits with the ICO Accountability Framework and how to get started.
This article brings together everything you need to know about the Initial Trust Plan: what it covers, who should own it, how it fits with the ICO Accountability Framework and how to get started.
What is the Initial Trust Plan?
The Initial Trust Plan is an online checklist in the DPE Knowledge Bank, found in the Best Practice area. It gives trusts a high-level view of the ICO Accountability Framework, so you can see which areas are in good shape and which may need more work.
It is designed as a starting point. Once you have completed it, you can go into more detail with the Accountability Tracking Checklists in the Best Practice menu of your Knowledge Bank Dashboard.
The plan is also a useful basis for your data protection report to the board. It shows trustees and governors where the trust is now, what is being done and where risks remain.
What does it cover?
The checklist is split into nine sections:
- Leadership and Oversight
- Policies and Procedures
- Training and Awareness
- Transparency
- Breach Response
- Risks and DPIAs
- Contracts and Data Sharing
- Controller-Processor Contract Requirement Details
- Records Management
Each question can be answered Yes, No or Not sure. Each section also has a notes area, so you can record ongoing tasks and actions and track progress over time.
An example question
"Is there a method for communicating updated privacy notices to staff and parents?"
This matters more than it might seem. A change to a privacy notice often signals a change in the systems you use or how you process personal data. If you are not sure how updates reach staff and parents across all your schools, that is a good conversation to have with your DPO.
Who should own the plan?
In a trust, data protection works best when responsibilities are clearly split between the centre and the schools:
- The trust's Data Protection Governance Lead owns the Initial Trust Plan. They meet with their DPE schools consultant and take the lead on strategy, and on policies where these are managed centrally. Read more in The Data Protection Governance Lead Role | MATs.
- Each school's Data Protection Champion handles day-to-day administration, such as adding and removing Knowledge Bank users and assigning training. Read more in The Data Protection Lead/Champion Role.
Your schools will also meet with DPE, so the trust and its schools are working from the same picture.
Getting started
- DPE customers: your dedicated school consultant will work with you on the Initial Trust Plan. You will find the wider set of guides for trusts and their schools in the Schools and Trusts Best Practice area.
- Not a customer yet? Find out more about the Schools and Trusts Best Practice Area, or contact us for access to the full checklist.
To hear when we add new checklists and resources for trusts, sign up to Keep in the Know, our newsletter.