1. Introduction
The purpose of this policy is to enable East Wickham and Welling War Memorial Trust to comply with the General Data Protection Regulations 2018 (GDPR) in respect of the data it holds about individuals.
The Charity will:
- follow good practice;
- protect residents, Trustees, staff, volunteers and other individuals by respecting their rights;
- demonstrate an open and honest approach to personal data; and
- protect the Charity from the consequences of a breach of its responsibilities.
The Data Protection Act 2018 requires that:
- information is collected only for one or more specified and lawful purposes and not processed for any other purpose;
- it is kept secure;
- it is adequate, relevant and up to date;
- it is not excessive and kept only for as long as it is needed;
- the person about which the information is held may have access to it on request.
Personal data Personal data is any data from which an individual can be uniquely identified. The Charity does not keep any sensitive personal data about individuals.
This policy applies to all the information that we control and process relating to identifiable, living individuals including contact details, bank details, photographs, audio and digital recording.
2. Data Storage and processing
East Wickham and Welling War Memorial Trust recognises that data is held about:
- applicants
- Trustees
- Governors
- volunteers
- members of the community
- other individuals with an interest in the Charity
This information is always stored securely and access is restricted to those who have a legitimate need to know. We are committed to ensuring that those about whom we store data understand how and why we keep that data and who may have access to it. We do not transfer data to third parties without the express consent of the individual concerned, save where there is a legitimate reason to do so under the Common Reporting Standard.
3. Rights of individuals
All individuals who come into contact with East Wickham and Welling War Memorial Trust have the following rights under the DPA:
- a right of access to a copy of their personal data
- a right to object to processing that is likely to cause or is causing damage or distress
- a right to object to decisions being taken by automated means
- a right, in certain circumstances, to have inaccurate personal data rectified, blocked, erased or destroyed and
- a right to claim compensation for damages caused by a breach of the DPA.
Archived records are stored securely and the Charity has clear guidelines for the retention of information.
4. Data Protection
The Trustees recognise their overall responsibility for ensuring that the Charity complies with its legal obligations.
All Trustees, personnel and volunteers are required to read, understand and accept any policies and procedures that relate to the personal data they may handle in the course of their roles.
Significant breaches of these policies will be handled under disciplinary procedures.
5. Key risks to the safety of data control and process
The Trustees have identified the following potential key risks:
- breach of confidentiality (information being given out inappropriately)
- individuals being insufficiently informed about the use of their data
- misuse of personal information by staff or volunteers
- failure to up-date records promptly
- poor IT security and
- direct or indirect, inadvertent or deliberate unauthorised access.
The Trustees will review the Charity’s procedures regularly, ensuring that the Charity’s records remain accurate and consistent and in particular:
- IT systems will be designed, where possible, to encourage and facilitate the entry of accurate data;
- data on any individual will be held in as few places as necessary and Trustees and staff will be discouraged from establishing unnecessary additional data sets;
- effective procedures will be in place so that relevant systems are updated when information about an individual changes.
If a breach of data security is suspected or occurs the Chair of the Trustees should be notified immediately.
6. Subject Access Requests
Any individual who wants to exercise their right to receive a copy of their personal data can do so by making a Subject Access Request, (‘SAR’) to the Secretary. The request must be made in writing and the individual must satisfy the Secretary of their identity before receiving access to any information.
A SAR must be answered within 40 calendar days of receipt by the Charity.
7. Collecting and using personal data
East Wickham and Welling War Memorial Trust typically collects and uses personal data in connection with the processing of grant applications and the running of educational and other events, including an annual Festival of Remembrance. The Charity collects personal data mainly in the following ways:
- by asking for information from applicants when completing applications for grants;
- by noting contact details for invitations to events.
East Wickham and Welling War Memorial Trust will:
- not use any of the personal data it collects in ways that have unjustified adverse effects on the individuals concerned;
- be transparent about how it intends to use the data and give individuals appropriate privacy notices when collecting their personal data;
- handle people’s personal data only in ways they would reasonably expect;
- not do anything unlawful with the data.
8. Keeping Data Secure
The Charity will take all appropriate measures to prevent unauthorised or unlawful processing of personal data and to protect personal data against loss, damage or destruction. This means that:
- the details of Trustees, Governors and the Secretary will be kept securely by those Trustees, Governors and the Secretary;
- electronic files containing personal data will be password protected and passwords will be changed on a regular basis;
- backed up electronic data will be held securely on an alternative site or when off site it will be encrypted, password protected and only accessed by the Secretary or Trustees;
- any data in transit will be kept secure;
- all personal data will be kept in a locked filing cabinet, whether at home or in the Church office.
9. Retention of personal data
The Charity will not keep personal data for longer than is necessary. This means that, for example:
- grant application forms will be destroyed after six years from the date they were paid, save for capital grant application forms, which will be retained for so long as the Charity requires them;
- self-certification forms for reportable grant holders under the Common Reporting Standard will be destroyed after six years from the last date of self-certification, or, if longer, after such period as the relevant authorities require;
- Contact details on the Charity’s invitation mailing list will remain until such time that they ask to be removed;
- Trustees’ and Governors’ personal files will be destroyed three years after ceasing to hold office.
10. More information
Full information about the Data Protection Act, its principles and definitions can be found at www.ico.gov.uk.
East Wickham and Welling War Memorial Trust reserves the right to amend this policy at any time to take into account of developments in this area of the law.