GDPR Policy

The Information Commissioner’s Office (ICO), tell us that General Data Protection Regulation (GDPR) policies must be written in plain and simple language without any jargon or ‘legal speak’.

Aim

The aim of this policy is to ensure we at Behaviour Change Counsel comply with the General Data Protection Regulations (GDPRs) which apply to everyone who holds personal data, from 25th May 2018.

Overview

General Data Protection Regulations (GDPRs) have been made to give individuals more control about what happens to the personal data they provide to organisations.  From 25th May 2018 onwards, your personal data cannot be gathered, stored or processed unless one of the six legal bases apply.  Also, it must be destroyed if its purpose has ended.  If you request details of any personal data held about you, the company must send it to you without charging you a fee or any other cost.  This way, you should know that we have your personal data because you have allowed us to have it, or that we are storing and processing it because of one of the six legal bases.

However, personal data that we have in our records from before the 25th May 2018, will still be valid, but will now become subject to our storage, processing and destruction policy.  All non-relevant data will be destroyed. This means that we will look at all the information we hold, and either give a valid reason to keep it, or destroy it.

Policy

To comply with GDPR and protect personal data, we will:

  1. Make an initial review of the data we already have to sort out which is ‘personal data’ and which is ‘non-personal data’, whether it is held on paper or computer systems. GDPR only applies to personal data.
  2. If a person cannot be identified from the data, then it will be called non-personal data, and GDPR rules will not apply to it.
  3. All personal data will be assessed to establish if it is also ‘sensitive’ data. Sensitive data is information which may reveal something about you that you may not want everyone to know, such as your sexuality, beliefs, any medical issues or disabilities, political views and issues from your past. Any sensitive personal data will be treated with greater security.
  4. Hand written sensitive personal data will be stored in a locked drawer or cabinet within a locked office with only two people able to access it.
  5. All handwritten personal data will be disposed of in a shredder as soon as possible.
  6. All staff will obey a ‘clear desk’ order and not leave any personal data unattended on their desk.
  7. Both people with access to our computer systems manually lock the computers as soon as they are left unattended.
  8. Electronic personal data will be stored on computers which are password protected. A two-step verification process is required to access information.  The computers automatically lock after a short period (10 mins) of not being used.
  9. Electronic personal data which is sensitive will be stored in an encrypted format using AES 256 on computers which are password protected. The computers automatically lock after a short period (10 mins) of not being used.
  10. If our computers or devices are lost or stolen they are password protected and any sensitive information is encrypted.
  11. All electronic personal data will be deleted from files once it is no longer needed. Behaviour Change Counsel will conduct an annual ‘data cleanse’ in July.
  12. From 25th May 2018, all new employees, suppliers, customers and other agencies will be asked for their consent for us to gather, store, process and destroy personal information. Consent will not be legal if it is gained via a pre-ticked box, or with only an ‘OPT OUT’ option. Under GDPR you must do something physical which means you have given your consent.  This will include you putting a tick in a box, signing to say that you consent, or even telling someone that you consent.
  13. This will not apply to personal information prior to 25th May 2018 so long as we can justify our reasons for gathering, storing and processing it. If not, we will destroy it and record that we have done so.
  14. Whether your personal data is held on paper or computer, you will be able to see it free of charge and request that we destroy it if required, or say that we can keep using it as we are.
  15. You will still be able to ‘unsubscribe’ from our sites. If we then contact you after you have unsubscribed, we will be breaching the GDPR.
  16. Any information required by Human Resources (HR) will be kept for a period of seven years. This is a legal requirement so that if you have any claims against us in that time we will still have your records.  After this period your records will be destroyed, and this will be recorded.
  17. We must tell everyone involved with us that we are complying with GDPR. This means that all employees will be told what GDPR is and how they must gather, store, process and destroy any data they hold.
  18. Our website will tell all visitors that we are GDPR compliant and invite them to read more about our policy.
  19. If you have any questions, please speak to the person named on this policy as they are responsible for complying with GDPR.
  20. Data will not be sold to any third parties, nor shared unless it can be justified by one of the six bases. If one of the six legal bases are not met, then we will destroy your data and make a record that we have.
  21. If we discover a data breach, we will report it to the ICO within 72 hours.
  22. We will remain cognisant of any changes to GDPR regulations and respond to any direct or indirect feedback.
  23. Every July we will review the personal data that we hold. We will record that this has taken place.

If you have any questions about this information, please speak to Claire Denby-Knight who will be happy to help you.

For any further information, please look at the Information Commissioners Office (ICO) on www.ico.org.uk