The Record of Processing can often seem like a daunting process to undertake- but it’s important to view it as exactly that- a process. Documenting the processes your organisation carries out is an ongoing project that you continue to evolve and develop as those processes change. The value you can get out of spending some time and care by completing various ones shouldn’t be underestimated. We’ve spoken to some of the people who have used the RoP tool on the Knowledge Bank, and asked them what they found challenging, and what they found the most useful parts of the tool, in the hope that it will help some of you who may feel that carrying out the Record of Processing is a daunting task.
First, we spoke to a Senior Finance Manager in a Trust, who has found the RoP particularly useful, despite the early challenges that faced them when they began documenting the information. When asked what they thought the overarching key benefit is that they can get from completing RoP’s, they said this:
“The RoP allows you to have rigorous systems in place that you can be confident in knowing are accurate. With our Trust moving to fully electronic filing, considerations will have to be made regarding how we delete electronic files. The retention schedule you can get out of the RoP is key in this. Overall the RoP saves you time and resources, and avoids mistakes being made. The fact that you can share the different RoP’s with staff is also great, because they can easily understand how a process is carried out, as well as the risks involved, and what we do to mitigate those risks.”
The retention schedule can help you keep track of and understand when you need to delete/get rid of certain pieces of data, which can in turn help govern how you store the data, as well as where you store it.
As mentioned above, completing an RoP can look tough and complex, so we also asked them what they thought was the hardest part to get to grips with and learn when documenting their Trust’s different processes, to which they said:
“Perhaps the hardest part to accept and work with when using the RoP is that it’s never really complete. The Trust will always have new processes that need mapping out, and old processes that we have already worked on will need updating/amending as and when it is necessary to do so. You can’t just complete a RoP for something, and then leave it and never think about it again. This is probably the hardest part of the process, as you can sometimes feel like you’ll never finish updating the RoP, which to a certain extent is true, but the value you get out of putting time into it is definitely worth it.”
Another positive that comes out of using the RoP according to the trust employee that we spoke to is the risk report that you can produce, which can be shown to different levels of governors, and also be used to support statements in the risk register. For academies, risk registers are essential and help to inform mitigation under key areas (reputation, health and safety, financial, facilities, people). The RoP can also help you produce job cards/procedural handbooks that can be used to help employees such as apprentices learn the tasks they need to undertake and the risks associated.
We also asked them about where they thought the key areas to complete first were, as we find that making a start and choosing the most important areas can often be the hardest part for some. The Trust employee, who’s area of work was finance, had this to say:
“In terms of finance, payroll is the key area to complete first, given the levels of personal data associated with it. Audit RoP is also useful for similar reasons.”
To finish up on some of the other key areas that they get the most benefit from, they had this to say:
“Internal Business continuity, people being able to take over and assume responsibility for certain key tasks that are time sensitive, should others be unable to (such as budget) is a massive help, and the RoP allows us to do this. The more you put into it, the more you get out.”
We also spoke to another member of staff at one of our schools, and asked them to comment on their experience using the Record of Processing tool. Similar to the first member of staff we spoke to, we asked the following questions.
- What area/part of the RoP did you find the most difficulty with getting to grips with?
- What value do you get from using the RoP?
- What area(s) were the most important for you to complete an RoP for first?
- Do you have any tips for people who are just getting started using the RoP tool?
Regarding question one on what area of the RoP they found the most difficult to get to grips with, they highlighted the risks and legal summary section as initially being troublesome. If you also find this section of the RoP particularly tough, DPE staff can help walk you through how you can get the most out of this area, and help map out the best way to fill it out. When it comes to the value that can come from spending time completing an RoP for particular processes, the member of staff we spoke to said:
“As the RoP’s capture the full lifecycle of the processes and risks involved for the tasks that we complete in school I find them particularly useful to act as job cards/work procedures that enable us to ensure that we have completed all of the tasks/processes involved with the different areas of my role.”
The RoP tool is, and should be more than merely your school adhering to the GDPR- so much more value can be obtained from it than that. One example is the job cards, which allow you to ensure that each time you carry out that particular task, all steps are completed properly.
We also asked the member of staff about the area(s) that they thought were the most important to complete an RoP for first, in the hope that it can give those reading some ideas on where they should look to complete one for first. The member of staff outlined HR and Finance as their key area, as they know HR and Finance the most, and the processes involved are ones that they deal with on a daily basis. A good strategy it seems, when deciding on the types of processes to start on, are the ones that you know the most about. With the RoP tool being new to you, and it taking some time to understand and get your head around, spending time mapping out processes you are familiar with is a good way to ease yourself into the process.
The final question we asked was if they had any tips for people who are just getting started using the RoP tool. The member of staff we spoke to is particularly knowledgeable on using the RoP, so we thought their insight would be valuable to those who are new to the tool. This is what they had to say:
“I was very fortunate in that we used one of our DPE sessions with our DPE GDPR Practitioner to run through the RoP process and we used this session to start completing some of the RoP’s. It was great to be able to use their expertise particularly with the risks and legal area sections which, combined with my knowledge of the processes involved, enabled us to get started and we managed to complete several of the RoP’s together.”
As always, DPE staff are here to help you, and can go over the RoP tool with you to help you understand how to complete different process mapping, and how you can get the most value out of it. You can always contact us to set up a meeting to go through the tool, and if you were to have any questions about Record of Processing you can contact us by submitting a ticket, and we’ll be more than happy to help you out.