Data Protection Policy

Information about yourself 

 

All staff are responsible for:

​

• Checking that any information they provide to the Centre in connection with their employment is accurate and up-to-date

• Informing the Centre of any changes to the information, which they have provided i.e. change of address 

• Informing the Centre of any errors or changes. The Centre cannot be held responsible for any errors unless the staff member has informed us of them.

​

Information about other people 

 

All staff must comply with the following guidelines: 

 

All staff will process data about individuals on a regular basis, when marking registers, writing reports or references, or as part of a pastoral or academic supervisory role. The Centre will ensure through registration procedures, that all individuals give their consent to this type of processing, and are notified of the categories of processing, as required by the 1998 Act. The information that staff deal with on day-to-day basis will be ‘standard’ and will cover categories such as:

 

• General personal details such as name and address

• Details about class attendance, course work marks and grades and associated comments 

 

Information about an individual’s physical or mental health; sexual orientation; political or religious views, trade union membership or ethnicity or race is sensitive and can only be collected and processed with consent. 

 

All staff have a duty to make sure that they comply with the data protection principles, which as re set out in the Centre’s Data Protection Policy. In particular, staff must ensure that records are: 

 

• Accurate 

• Up-to-date 

• Fair 

• Kept and disposed of safely, and in accordance with the Centre policy

 

The Centre will designate staff in the relevant area as ‘authorised staff’. These staff are the only staff authorised to access data that is: 

 

• Not standard data; or 

• Sensitive data 

 

The only exception to his will be if a non-authorised member is satisfied and can demonstrate that the processing of the data is necessary: 

​

• In the best interest of the individual or staff member, or a third person, or the Centre AND 

• He or she has either informed the authorised person of this, or has been unable to do so and processing is urgent and necessary in all the circumstances 

• This should only happen in very limited circumstances. For example, an individual is injured and unconscious and in need of medical attention, or a member of staff tells the hospital that the individual is pregnant or a Jehovah’s Witness.

 

Authorised staff will be responsible for ensuring that all personal data is kept securely. In particular staff must ensure that personal data is:

 

• Put away in lockable storage 

• Not left on unattended desks or tables 

• Unattended ICT equipment should not be accessible to other users 

• ICT equipment used off-site must be password-protected 

• Data files on CD or memory stick or email attachments used off-site containing personal data must be password-protected 

• Paper records containing personal data must be shredded where appropriate 

 

Staff must not disclose personal data to any other staff member except with the authorisation or agreement of the designated data controller, or in line with the Centre policy.

 

Before processing any personal data, all staff should consider the following: 

 

• Do you really need to record the information?

• Is the information ‘sensitive’?

• If it is sensitive, do you have the data subject’s express consent?

• Has the individual been told that this type of data will be processed?

• Are you authorised to collect/ store/ process the data?

• If yes, have you checked with the data subject that the data is accurate?

• Are you sure that the data is secure?

• If you do not have the data subject’s consent to process, are you satisfied that it is in the best interests of the individual or the safety of others to collect and retain the data?