GDPR Policy

Introduction

This UK GDPR policy outlines how our organisation collects, uses, protects, and shares personal data in accordance with the UK General Data Protection Regulation (GDPR). The GDPR is designed to protect the privacy and rights of individuals regarding the processing of their personal data.

Scope

This policy applies to all personal data processed by our organisation, whether on computer or paper-based systems. It applies to all employees, contractors, volunteers, and third-party processors who may process personal data on behalf of our organisation.

Data Protection Principles

Our organisation will adhere to the following data protection principles when processing personal data:

Lawfulness, fairness, and transparency: Personal data will be processed lawfully, fairly, and in a transparent manner.

Purpose limitation: Personal data will be collected for specified, explicit, and legitimate purposes and not processed in a manner that is incompatible with those purposes.

 Data minimisation: Personal data will be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.

 Accuracy: Personal data will be accurate and kept up to date, where necessary.

 Storage limitation: Personal data will be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed.

Integrity and confidentiality: Personal data will be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage.

 Accountability: Our organization will be able to demonstrate compliance with the above principles.

Lawful Basis for Processing

Our organisation will only process personal data if there is a lawful basis for doing so. The lawful bases for processing personal data are:

Consent: The data subject has given consent for the processing of their personal data.

Contract: The processing is necessary for the performance of a contract with the data subject.

Legal obligation: The processing is necessary to comply with a legal obligation.

Vital interests: The processing is necessary to protect the vital interests of the data subject or another person.

Public task: The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

Legitimate interests: The processing is necessary for the legitimate interests pursued by our organisation, except where such interests are overridden by the interests, rights, or freedoms of the data subject.

Data Subject Rights

Data subjects have the following rights under the GDPR:

Right to be informed: Data subjects have the right to be informed about the processing of their personal data.

Right of access: Data subjects have the right to access their personal data

Right to rectification: Data subjects have the right to have inaccurate personal data rectified.

Right to erasure: Data subjects have the right to have their personal data erased in certain circumstances.

Right to restrict processing: Data subjects have the right to restrict the processing of their personal data in certain circumstances.

Right to data portability: Data subjects have the right to receive their personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

Right to object: Data subjects have the right to object to the processing of their personal data in certain circumstances.

Our organization will ensure that data subjects are able to exercise their rights under the GDPR.

Data Breach

In the event of a data breach, our organisation will take appropriate measures to mitigate the breach, notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, and notify affected data subjects without undue delay.

Third-Party Processors

Our organization will ensure that third-party processors who process personal data on our behalf meet the requirements