iSAMS Brexit Policy
After BREXIT (the UK’s exit from the European Union) on 31 January 2020, a transition period was triggered, during which time the relationship between the UK and the EU did not change. This transition period came to an end on 31 December 2020, and rules governing the new relationship between the EU and UK took effect on 1 January 2021.
During this period the UK continued to follow EU rules and regulations, and its trading relationship remained the same.
Following the completion of the Brexit negotiations, the transition period has now ended (31 December 2020) and the United Kingdom has left the EU single market and customs union. The UK and the EU now interact in accordance with the rules set out in the EU-UK Trade and Cooperation Agreement.
iSAMS is a UK-owned and headquartered company, with client schools based in regions all over the world. Their UK Head Office is based in Slough, with all data for hosted schools held by a secure third-party provider (Rackspace) who have established and highly secure data centres held in the UK and internationally, meaning iSAMS is well prepared for any BREXIT eventuality.
iSAMS schools with a cloud-hosted system benefit from cost savings on server hardware and maintenance, cutting edge security and minimal downtime, as well as the inclusion of all necessary licenses and powerful antivirus software. The iSAMS hosted solution is protected by CloudFlare, a sophisticated performance and security service that offers protection against Distributed Denial of Service (DDoS) attacks and hacking attempts. Schools’ data is also protected by eSentire – a managed ‘Detection and Response’ service that operates 24/7 every day of the year. Additional benefits include all server maintenance and management being performed by iSAMS and round the clock monitoring.
In the EU-UK Trade and Cooperation Agreement, there is a bridging mechanism that allows for the continued free flow of personal data from the EU/EEA to the UK after the transition period until adequacy decisions come into effect, for up to 6 months (until 30 June 2021).
The UK is currently seeking an adequacy decision on General Data Protection Regulation (GDPR). The effect of an adequacy decision is that personal data can be sent from an EEA state to a third country (UK) without any further safeguards being necessary.
On 19 February 202, the European Commission published its draft decision, finding the UK to be adequate. This means that should the European Commission confirm this finding later this year it is unlikely anything will change.
In the event that the UK is found not to be adequate, an appropriate safeguard for a restricted transfer of data from the EEA to the UK is to enter into standard contractual clauses with the sender of the personal data. We have already put these standard contractual clauses in place.
As a further contingency, iSAMS have sought to proactively protect their schools in the EU by establishing a data centre in the EU. Should the regulation changes mean that iSAMS are no longer able to hold schools’ data in the UK, it will be moved to their EU location.
For more information on Brexit and what it could mean for your school, please see the UK Government’s guidance here: https://www.gov.uk/guidance/eu-exit-guide-data-protection-for-education-providers.
iSAMS treat the security of our data and all data protection measures with the utmost importance. iSAMS continue to comply with GDPR and the DPA 2018, and monitor the situation closely as it evolves. This means that all the measures iSAMS put in place since the Brexit negotiations began are still valid.
Schools collect vast amounts of sensitive data on a regular basis and storing this online, or even in a paper-based system, presents many issues when it comes to data security and compliance.
The iSAMS Data Protection module supports the right for individuals to see their educational records. There is an area to record all the details of each Data Subject Access Request (DSAR) request made by an applicant, including its status, the date, and other key information needed to action a DSAR.
This information, and much more, is also accessible via a suite of dedicated reports available within iSAMS. These detail significant student, contact and staff information, in an easily obtainable format, whenever it may be needed.