HealthJobsUK

Detailed job description and main responsibilities

Data Security and Protection (DSP) Advisor

• Provide specialist advice and assistance to staff where required on areas of complex information governance legislation, such as UK GDPR, Data Protection Act 2018 and the NHS Code of Practice on Confidentiality 
• To work closely with department colleagues, support services, clinical services, operational and strategic Data Security and Protection leads and internal and external DSP colleagues to promote excellent Information Governance, Data Security and Data Protection practice, by advising and supporting them in their understanding and delivery of these requirements. 
• To be aware of Data Security and Protection incidents and where appropriate support in the investigation process, ensuring relevant actions are taken and lessons learnt to prevent reoccurrence 
• Provide support for a programme of Data Security and Protection related work managed by the Head of DSP and locally directed by the DSP Manager and Team Leader
• Log Serious Information Governance incidents on Data Security and Protection Toolkit incident reporting tool and the CCG STEIS tool as appropriate 
• Review and report key indicators to provide information for Data Governance Group (DGG) and Information Governance Group (IGG), including data statistics and analysis of incidents. 
• Conduct Data Security and Protection user satisfaction surveys in line with Data Security and Protection Toolkit requirements. 
• Deputise for the DSP Team Leader, attending relevant meetings when necessary. 
• Provide support to other areas of the Data Security and Protection Team as directed by the Head of Data Security and Protection.   
• Be the first line of response for data security and protection queries providing support, advice and guidance to key areas of the Trust including Research and Innovation, Complaints, Governance and IT.                
• Develop and maintain standard operating procedures for all routine tasks carried out within the role.
• Support the development, review and roll-out of appropriate DSP related policies and procedures.
• Manage DSP records, both paper and electronic, updating reports, maintaining action plans, policies and procedures etc.
• Take a proactive role in the collation of the evidence required for the annual Data Security and Protection Toolkit submission and participate in improvement plans.
• Maintain a register of Information Governance related incidents and produce regular reports from Datix, liaising with all departments and Risk Management as appropriate, leading on incident investigations where appropriate.
• Maintain the Trust’s Information Asset Register and undertake reviews in coordination with Information Asset Owners and Information Asset Administrators.
• Supporting internal colleagues with the completion of Data Protection Impact Assessments, including highlighting data protection and security risks.
• Update and maintain the Trust’s Privacy Notice to ensure compliance with UK GDPR standards and internal policies.
• Understand and monitor compliance with relevant legislation, particularly the common law duty of confidentiality, the Data Protection Act 2018, the General Data Protection Regulation, the Computer Misuse Act 1990, the Human Rights Act 1998;
• Manage Information Sharing Agreements and flows via the Information Sharing Gateway, working with internal and external stakeholders to make sure these are appropriately documented.
• Liaise with relevant internal and external stakeholders to ensure Information Sharing Agreements are completed and reviewed in line with GDPR.
• Establish good working relationships with key staff in all departments across the Trust.
• Implement policies and propose changes to Group DSP policies as appropriate, conducting monitoring compliance with those policies and protocols
• conduct data protection impact assessments (DPIA) where necessary and ensure the Group adheres to the data privacy by design and default as set out in Article 25 GDPR
• complete DPIAs to relevant team members and ensure cross partnership working with relevant project and transformation leads
• Assist the DSP Team Leader in the collation of relevant reports and information for compliance reporting, inspections and internal assurance
• Assist with the Data Governance Group and Information Governance Group meetings, ensuring relevant reports, minutes actions and decisions are recorded
• Escalate incidents to the Team Leader immediate when they may meet the criteria for a Serious Incident / reportable to the ICO
• Provide IG input, advice, guidance for R&D programmes
• Deputise for the DSP Team Leader when required
• work with the complaints team and directly with members of the public to communicate appropriately regarding any DSP grievances and queries
• to maintain their specialist knowledge in Data Protection Law and UK GDPR
• update the Internet and Intranet pages for DSP as appropriate, ensuring it is up to date with pertinent advice and guidance, including applicable FAQs and relevant legislation

Training & Audit 

• To be responsible for the Data Security and Protection training programme, including planning and liaison with the Learning and Development Team for the regular delivery of DSP training sessions 
• To monitor Data Security and Protection training compliance and to take all reasonable action to ensure that compliance levels are maintained at above 90% at all times and take all possible steps to ensure 95% compliance is achieved annually for the DSP Toolkit assertion. 
• To ensure that this specialist knowledge is kept up to date and changes in legislation or national and local policy are communicated effectively to staff at all levels within the organisation 
• To input into and to support the Data Security and Protection communication strategy. 
• To undertake Data Security and Protection spot check audits in clinical and non-clinical areas, to report findings and work with relevant teams to develop and monitor action plans for improvement. 
• To review the Information Asset Register against the Information Sharing Gateway to identify assets and data flows which have not been documented. 
• Ensure that learning from Data Security and Protection incidents is incorporated into DSP training and awareness. 
• Training colleagues on the use of the Information Sharing Gateway and Information Asset Register. 
• Training colleagues on the practice of completing Data Protection Impact Assessments. 
• Developing training and awareness materials and guidelines.