Our school brings in an external psychologist to assess some students. She/he gets access to information such as child's name, parents phone number, class and medical information. what should we do to be gdpr compliant?
In the situation described by you the psychologist would act as a processor and would process the personal data you've mentioned on your behalf in order to provide the assessment. There are two things to be considered in this situation: