The Organisation needs to collect and use certain types of information about staff, clientsand other individuals who come into contact with the company in order to operate. Inaddition, it may be required by law to collect and use certain types of information to comply
with statutory obligations of Local Authorities, government agencies and other bodies.
INTRODUCTION
This personal information must be dealt with properly however it is collected, recorded andused – whether on paper, in a computer, or recorded on other material.
We regard the lawful and correct treatment of personal information as very important tosuccessful operations, and to maintaining confidence between those with whom we deal andourselves. We ensure that our Organisation treats personal information lawfully andcorrectly.
Most businesses hold personal data on their customers, employees and partners. The
explosion in the use of the Internet, electronic communication and computerisation ofbusiness data has led to an increase in the importance of privacy. Breaches of computerised
data security have prompted the introduction of legislation on a national and European level.
These include:

Human Rights Act 1998
Freedom of Information Act 2000
Privacy and Electronic Communications Regulations 2003
Regulation of Investigatory Powers Act 2000
Telecommunications (Lawful Business Practice) Interception ofCommunications Regulations 2000
Data Protection Act 1998
Computer Misuse Act
The General Data Protection Regulation

POLICY STATEMENTThe Organisation will, through appropriate management, strict application of criteria andcontrols:





observe fully the conditions regarding the fair collection and use ofinformation
meet its legal obligations to specify the purposes for which information is usedcollect and process appropriate information, and only to the extent that it isneeded to fulfil operational needs or to comply with any legal requirements
ensure the quality of information used
apply strict checks to determine the length of time information is held
ensure that the rights of people about whom information is held, can be fully
exercised under the Act (these include: the right to be informed thatprocessing is being undertaken, the right of access to one’s personal
information, the right to prevent processing in certain circumstances and the




right to correct, rectify, block or erase information which is regarded as wrong
information)
take appropriate technical and organisational security measures to safeguard
personal information
provide individuals that request it, within a maximum of 1 month from request
correct or erase any information on an individual that is inaccurate or
misleading
not use information for a purpose which is incompatible with the original
purpose for which permission was given by the data subject
obtain clear, express permission for handling and using ‘sensitive’ personal
data such as race, ethnicity, political opinions, religious beliefs, trade union
membership, state of health both physical and mental, sexual life, criminal
convictions and sentences and allegations of criminal behaviour
treat people justly and fairly whatever their age, religion, disability, gender,sexual orientation or ethnicity when dealing with requests for information
set out clear procedures for responding to requests for information
allocate such resources as may be required to ensure the effective operationof theIn addition, the Organisation ensures that:











there is someone with specific responsibility for Data Protection within theOrganisation
everyone managing and handling personal information understands that theyare contractually responsible for following good data protection practice
everyone managing and handling personal information is appropriately
trained to do soeveryone managing and handling personal information is appropriately
supervised
anybody wanting to make enquiries about handling personal information
knows what to doqueries about handling personal information are promptly and courteously
dealt withmethods of handling personal information are clearly describeda regular review and audit are made of the way personal information is held,
managed and usedmethods of handling personal information are regularly assessed andevaluatedperformance with handling personal information is regularly assessed andevaluateda breach of the rules and procedures identified in this Policy may lead to
disciplinary action being taken against the members of staff concerned. Any
breaches will be reported without undue delay and not later than 72 hours
after the breach.

THE DATA PROTECTION ACTThe Data Protection Act 1998 replaces and extends the 1984 Act and places a legal
obligation on persons who record and process personal information relating to living
individuals. Although this area of the law appears to be complicated, the Act simply requiresthat adequate controls exist to protect individuals from the consequences of poor quality
information and/or the misuse of information held about them.

Whilst the 1984 Act dealt with automatically processed information including information
processed on computer, the 1998 Act places additional obligations on those processing
information contained in ‘structured manual files’. It also applies to the lawfulness andintegrity of the CCTV systems operated by the Organisation.
The term ‘processing’ includes any function that can be performed using information andincludes the actual disclosure of information. The Organisation has introduced this Data
Protection Policy for the information and guidance of all employees.
THE DATA PROTECTION ACT PRINCIPALSThe Act applies to every organisation that handles (processes) personal information such as
names (data) on living individuals (subjects). The Act has eight data protection principles,
which are intended to guide the interpretation and implementation of the Act. These
principles are:
1. Personal data shall be processed fairly and lawfully
2. Personal data shall be obtained only for one or more specified and lawful
purpose(s), and shall not be further processed in any manner incompatible
with that purpose or those purposes
3. Personal data shall be adequate, relevant and not excessive in relation to thepurpose or purposes for which they are processed
4. Personal data shall be accurate and, whenever necessary, kept up to date
5. Personal data processed for any purpose or purposes shall not be kept for
longer than is necessary for that purpose or those purposes
6. Personal data shall be processed in accordance with the rights of data
subjects under this Act
7. Appropriate technical and organisational measures shall be taken against
unauthorised or unlawful processing of personal data and against accidental
loss or destruction of, or damage to, personal data
8. Personal data shall not be transferred to a country or territory outside theEuropean Economic Area, unless that country or territory ensures anadequate level of protection for the rights and freedoms of data subjects inrelation to the processing of personal data.
GUIDING PRINCIPALSFair Obtaining and Processing
The Organisation will ensure that as far as practicable, all individuals whose details areprocessed by the Organisation are aware of the way in which that information will beobtained, held, used and disclosed. Whenever possible, individuals will be informed of thepotential recipients of the information. Processing of personal information by theOrganisation will be fair and lawful and, in addition, it is the Organisation’s Policy that
individuals will not be misled regarding the purposes to which the Organisation will process
the information.
Notification
The Organisation will not use or process personal information in any way that contravenes
its notified purposes, or in any way that would constitute a breach of the Data Protection Act.
When appropriate, the Organisation will notify the Information Commissioner of anyamendments to the existing Organisation’s notified purposes or of new purposes to beadded to the Notification Register entry.

Information Quality and Integrity
The Organisation will endeavour to process personal information, which is accurate, current
and is of good quality. Information that is obtained by the Organisation will be adequate andnot excessive for the purpose for which it is processed. In addition, information will be kept
by the Organisation for no longer than is necessary for the purpose or purposes for which itwas obtained.
Subject Access
The Organisation will respond positively to subject access requests, replying as quickly aspossible, and in any event within the 40-day time limit. Whilst individuals have a general rightof access to any of their own personal information which is held, the Organisation will be
mindful of those circumstances where an exemption may apply.
The Organisation will only disclose personal data to those recipients listed in the Notification
Register, or whenever it is otherwise permitted by law to do so. The Organisation will always
endeavour to seek the permission of the data subject, where it is required by law to do so.
Technical and Organisational Security
The Organisation has in place appropriate security measures as required by the Data
Protection Act. Information systems are installed with adequate security controls andcompany employees who use these systems will be properly authorised to use them forcompany business.
Computer misuse
The Computer Misuse Act 1990 makes it an offence to gain unauthorised access to acomputer, even if no damage is done and no files are deleted or changed. Anyone whoaccesses a computer without authorisation, say by guessing a password, faces a maximum
six-month prison sentence, or a maximum fine of £2,000, or both.
If an individual gains unauthorised access with the intent to commit a further offence, forexample access your bank account online to transfer money, they face five years’
imprisonment and/or a fine.
This Act also makes it an offence to purposefully change files on a computer with intent andwithout authorisation. This could include deleting files or even changing computer settings.
Anyone who does so, even if there is no intent to defraud or do damage, faces a maximum
prison sentence of five years and/or an unlimited fine.
Controlling access
The Organisation has tightened physical access to data by restricting access to data by
restricting this to employees needing to access specific data in order to carry out their jobs.
The Organisation takes steps to prevent accidental loss or theft of personal data by using
server backup processes and increased security at our offices.

Safeguarding data
Our business relies on computers to store data, so it was necessary to introduce thefollowing electronic safeguards:

we have up-to-date antivirus software to protect against viruses damaging ourdata and computers
we protect our computer network from hackers with a firewall
we have introduced housekeeping measures by regular backups anddisabling people’s accounts as they leave the business
we have introduced a clear strategy for managing all our computer security
tools

E-mail and Internet privacy
The inappropriate use of e-mail and the Internet by employees, e.g. using the Internet for
non-work purposes, can have significant consequences for our Organisation. This can be interms of:embarrassment/damage to the Organisation’s reputation
loss of productivity
increased risk of liability and legal action, e.g. for sexist or racist e-mails
increased virus risk.

To avoid inappropriate usage, we have introduced security electronic safeguards. A firewall
checks, guarantees and manages e-mail attachments. The Organisation has installed
filtering software that searches e-mails for specific words or phrases, normally obscene or
discriminatory, and monitors which websites our employees are accessing as well as filtering
which types of websites our employees can access.
Acceptable use of E-mail and the Internet
Please see the E-mail and Internet Acceptable Usage Policy.
In addition, the Organisation’s employees will be kept fully informed about overall information
security procedures and the importance of their role within these procedures. Similarly,
manual filing systems are held in secure locations and only authorised employees canaccess them.
Responsibilities & Review
The Managing Director has overall responsibility for the administration and implementationof the Organisation’s Data Protection Policy.
Each Department Manager will assume authority for the compliance of the employees within
their department.

Company No, Connect Solutions Group Ltd, company number is 11405300 ConnectSolutions Group is a trading name of V I Resourcing Ltd.
Registered Address: Alvaston Lodge, Alvaston Business Park, Middlewich Road, Nantwich,Cheshire, CW5 6PF