[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-200716-105":3,"detail-sidebar-cat-1-en-105":81,"doc-detail-200716-en":127},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","ico-audit-response-data-protection-audit-closure-summary","ICO audit response - Data Protection audit closure summary","","Data Protection Office provides an audit closure summary describing an ICO audit undertaken in February and March 2020, later extended to cover data sharing within the Learning Records Service (LRS) database after a reported data breach. The scope spans governance & accountability, individual rights, training & awareness, information risk, data sharing, records management, and information security. For each control area, it presents the ICO findings and outlines actions taken, further development priorities, and impacts on service users, concluding with next steps.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/template/","Template",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/template/letters/","Letters",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/template/ico-audit-response-data-protection-audit-closure-summary/200716/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/ico-audit-response-data-protection-audit-closure-summary/200716.png","ImageObject",442,249,{"name":42,"@type":43},"WPS_1786070896","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/vnd.openxmlformats-officedocument.wordprocessingml.document","2026-10-18","2026-09-04",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",10,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"What triggered the ICO audit extension to the Learning Records Service (LRS)?","Question",{"text":63,"@type":64},"The Department for Education (DfE) extended the audit scope to include data sharing within the LRS database to assist an ICO investigation following a reported data breach.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"Which key control areas are covered in the audit closure summary?",{"text":68,"@type":64},"The summary covers Governance & Accountability, Individual Rights, Training & Awareness, Information Risk, Data Sharing, Records Management, and Information Security.",{"name":70,"@type":61,"acceptedAnswer":71},"How does DfE respond to the ICO’s findings in the governance and accountability area?",{"text":72,"@type":64},"DfE developed a strategic approach to decision making about data, including creating the Office of the Data Protection Officer (ODPO), enhancing internal reporting, strengthening collaboration with data/information teams, establishing Governance Forums, and creating new data frameworks, policies, and standards.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},200716,1788510235,{"code":4,"msg":82,"data":83},"success",[84,89,94,99,104,109,114,118,123],{"id":85,"doc_module":22,"doc_module_name":25,"category_name":86,"show_sort_weight":87,"slug":88},11,"Presentations",90,"presentations",{"id":90,"doc_module":22,"doc_module_name":25,"category_name":91,"show_sort_weight":92,"slug":93},12,"Resumes",80,"resumes",{"id":95,"doc_module":22,"doc_module_name":25,"category_name":96,"show_sort_weight":97,"slug":98},14,"Invoices",70,"invoices",{"id":100,"doc_module":22,"doc_module_name":25,"category_name":101,"show_sort_weight":102,"slug":103},15,"Posters",60,"posters",{"id":105,"doc_module":22,"doc_module_name":25,"category_name":106,"show_sort_weight":107,"slug":108},16,"Social Media",50,"social-media",{"id":110,"doc_module":22,"doc_module_name":25,"category_name":111,"show_sort_weight":112,"slug":113},17,"Forms",40,"forms",{"id":115,"doc_module":22,"doc_module_name":25,"category_name":29,"show_sort_weight":116,"slug":117},18,30,"letters",{"id":119,"doc_module":22,"doc_module_name":25,"category_name":120,"show_sort_weight":121,"slug":122},21,"Paper Templates",5,"papers-templates",{"id":124,"doc_module":22,"doc_module_name":25,"category_name":125,"show_sort_weight":4,"slug":126},158,"General","general-158",{"code":4,"msg":82,"data":128},{"doc_id":79,"user_id":129,"nickname":42,"user_avatar":130,"doc_module":22,"category_id":115,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":100,"language":136,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":12,"update_tm":80,"read_time":121},549768072016,"https://ap-avatar.wpscdn.com/davatar_155a257f0dc6eb9ab79c44ca47cae57d","Data Protection ICO Audit Closure Summary\nVersion 1\nData Protection Office, Data Directorate\nOctober 2023\nContents\n\u0013 TOC \\o \"1-3\" \\h \\z \\u \u0014\u0013 HYPERLINK \\l \"_Toc146612203\" \u0014ICO audit response\t\u0013 PAGEREF _Toc146612203 \\h \u00143\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612204\" \u00141.\tGovernance and accountability\t\u0013 PAGEREF _Toc146612204 \\h \u00144\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612205\" \u0014The ICO said:\t\u0013 PAGEREF _Toc146612205 \\h \u00144\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612206\" \u0014What DfE did:\t\u0013 PAGEREF _Toc146612206 \\h \u00144\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612207\" \u0014To develop this further DfE:\t\u0013 PAGEREF _Toc146612207 \\h \u00144\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612208\" \u0014The impact on service users:\t\u0013 PAGEREF _Toc146612208 \\h \u00144\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612209\" \u0014Next Steps:\t\u0013 PAGEREF _Toc146612209 \\h \u00145\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612210\" \u00142.\tInformation rights\t\u0013 PAGEREF _Toc146612210 \\h \u00145\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612211\" \u0014The ICO told us:\t\u0013 PAGEREF _Toc146612211 \\h \u00145\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612212\" \u0014What DfE did in response:\t\u0013 PAGEREF _Toc146612212 \\h \u00145\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612213\" \u0014To develop this further DfE:\t\u0013 PAGEREF _Toc146612213 \\h \u00145\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612214\" \u0014The impact on service users:\t\u0013 PAGEREF _Toc146612214 \\h \u00145\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612215\" \u0014Next Steps\t\u0013 PAGEREF _Toc146612215 \\h \u00146\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612216\" \u00143.\tTraining & Awareness\t\u0013 PAGEREF _Toc146612216 \\h \u00146\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612217\" \u0014The ICO told us:\t\u0013 PAGEREF _Toc146612217 \\h \u00146\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612218\" \u0014What DfE did in response:\t\u0013 PAGEREF _Toc146612218 \\h \u00146\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612219\" \u0014To develop this further DfE:\t\u0013 PAGEREF _Toc146612219 \\h \u00147\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612220\" \u0014The impact on service users:\t\u0013 PAGEREF _Toc146612220 \\h \u00147\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612221\" \u0014Next Steps\t\u0013 PAGEREF _Toc146612221 \\h \u00147\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612222\" \u00144.\tInformation Risk\t\u0013 PAGEREF _Toc146612222 \\h \u00148\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612223\" \u0014The ICO told us:\t\u0013 PAGEREF _Toc146612223 \\h \u00148\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612224\" \u0014What DfE did in response:\t\u0013 PAGEREF _Toc146612224 \\h \u00148\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612225\" \u0014To develop this further DfE:\t\u0013 PAGEREF _Toc146612225 \\h \u00149\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612226\" \u0014The impact on service users:\t\u0013 PAGEREF _Toc146612226 \\h \u00149\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612227\" \u0014Next Steps\t\u0013 PAGEREF _Toc146612227 \\h \u00149\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612228\" \u00145.\tData Sharing\t\u0013 PAGEREF _Toc146612228 \\h \u00149\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612229\" \u0014The ICO told us:\t\u0013 PAGEREF _Toc146612229 \\h \u00149\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612230\" \u0014What DfE did in response:\t\u0013 PAGEREF _Toc146612230 \\h \u00149\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612231\" \u0014To develop this further DfE:\t\u0013 PAGEREF _Toc146612231 \\h \u001410\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612232\" \u0014The impact on service users:\t\u0013 PAGEREF _Toc146612232 \\h \u001410\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612233\" \u0014Next Steps\t\u0013 PAGEREF _Toc146612233 \\h \u001410\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612234\" \u00146.\tRecords Management\t\u0013 PAGEREF _Toc146612234 \\h \u001410\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612235\" \u0014The ICO told us:\t\u0013 PAGEREF _Toc146612235 \\h \u001410\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612236\" \u0014What DfE did in response:\t\u0013 PAGEREF _Toc146612236 \\h \u001411\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612237\" \u0014To develop this further DfE:\t\u0013 PAGEREF _Toc146612237 \\h \u001411\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612238\" \u0014The impact on service users:\t\u0013 PAGEREF _Toc146612238 \\h \u001411\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612239\" \u0014Next Steps\t\u0013 PAGEREF _Toc146612239 \\h \u001411\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612240\" \u00147.\tInformation Security\t\u0013 PAGEREF _Toc146612240 \\h \u001411\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612241\" \u0014The ICO told us:\t\u0013 PAGEREF _Toc146612241 \\h \u001411\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612242\" \u0014What DfE did in response:\t\u0013 PAGEREF _Toc146612242 \\h \u001412\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612243\" \u0014To develop this further DfE:\t\u0013 PAGEREF _Toc146612243 \\h \u001412\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612244\" \u0014The impact on service users:\t\u0013 PAGEREF _Toc146612244 \\h \u001413\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612245\" \u0014Next Steps\t\u0013 PAGEREF _Toc146612245 \\h \u001413\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc146612246\" \u0014ICO reprimand – in response to the investigation into a data breach for the Learner Records Service\t\u0013 PAGEREF _","cbCainqSjuJc9phx","https://ap.wps.com/l/cbCainqSjuJc9phx","docx",83857,"English","# 1. Governance and accountability\n## The ICO said:\n## What DfE did:\n## To develop this further DfE:\n## The impact on service users:\n## Next Steps:\n# 2. Information rights\n## The ICO told us:\n## What DfE did in response:\n## To develop this further DfE:\n## The impact on service users:\n## Next Steps\n# 3. Training & Awareness\n## The ICO told us:\n## What DfE did in response:\n## To develop this further DfE:\n## The impact on service users:\n## Next Steps\n# 4. Information Risk\n## The ICO told us:\n## What DfE did in response:\n## To develop this further DfE:\n## The impact on service users:\n## Next Steps\n# 5. Data Sharing\n## The ICO told us:\n## What DfE did in response:\n## To develop this further DfE:\n## The impact on service users:\n## Next Steps\n# 6. Records Management\n## The ICO told us:\n## What DfE did in response:\n## To develop this further DfE:\n## The impact on service users:\n## Next Steps\n# 7. Information Security\n## The ICO told us:\n## What DfE did in response:\n## To develop this further DfE:\n## The impact on service users:\n## Next Steps\n## ICO reprimand – in response to the investigation into a data breach for the Learner Records Service\n## The ICO told us:\n## What DfE did in response:\n## To develop this further DfE:\n## The impact on service users:\n## Next Steps","[{\"question\":\"What triggered the ICO audit extension to the Learning Records Service (LRS)?\",\"answer\":\"The Department for Education (DfE) extended the audit scope to include data sharing within the LRS database to assist an ICO investigation following a reported data breach.\"},{\"question\":\"Which key control areas are covered in the audit closure summary?\",\"answer\":\"The summary covers Governance \\u0026 Accountability, Individual Rights, Training \\u0026 Awareness, Information Risk, Data Sharing, Records Management, and Information Security.\"},{\"question\":\"How does DfE respond to the ICO’s findings in the governance and accountability area?\",\"answer\":\"DfE developed a strategic approach to decision making about data, including creating the Office of the Data Protection Officer (ODPO), enhancing internal reporting, strengthening collaboration with data/information teams, establishing Governance Forums, and creating new data frameworks, policies, and standards.\"}]","ICO audit response - Data Protection audit closure summary | DOCX"]