Find out more about the GDPR and how it is likely to affect your school and share this information to key people within the school. Organise training sessions as necessary.
Data Protection Officer
Decide whether you should appoint a Data Protection Officer (or whether you will appoint one voluntarily) and put the necessary steps in place to recruit the appropriate person, if required. Remember that there may be a lot of schools looking for Data Protection Officers in advance of the implementation of the GDPR.
Data audit
Look at your school and carry out a careful audit of the personal data that you hold, how you came about it, what you do with it and on what basis. If you are relying on consent as the basis for processing any data, then you need to review this carefully as the GDPR makes relying on consent much more difficult than under the previous legislation.