Patching policy implemented Firewalls and anti-virus current and up to date Encryption of storage media Organisational measures – Secure premises including server rooms and physical storage Security and data protection policies, processes and training Application of retention schedule Processing purpose Categories of data subjects Categories of personal data Recipients (inc. third countries or international organisations) Transfers to a third country or international organisation …… (Article 49 (1)) Retention period (given where practicable o/w see SQA retention schedule) Organisational and technical security measures …. (Article 32 (1)) Certification of candidates (schools) Candidates (schools) Personal details Scottish Candidate Number (SCN) Centre details Attainment details Candidates Centres Local authorities – Director of Education Scottish Council of Independent Schools (SCIS) UCAS Scottish Government – Education Analytical Services Division N/A Permanent As above Certification of candidates (colleges/training providers) Candidates providers) Personal details Scottish Candidate Number (SCN) Centre details Attainment details Candidates Centres Skills Development Scotland (SDS) UCAS Only where the candidate resides outside of the EEA Permanent As above
Return of externally assessed materials Candidates Personal details Contact details Centre Bank details/payment card details SQA employees N/A 2 years after materials returned As above. Qualification approval and verification Candidates Personal details Contact details Qualification details SQA employees Yes – if centre is based outside of the EEA 5 years after current year As above. System approval and verification Candidates Centre employees Personal details Contact details Qualification details Centre financial details SQA employees Yes – if centre is outside of the EEA 5 years after current year As above. Accreditation of awarding bodies Awarding body employees Sector skills council employees Personal details Contact details SQA Accreditation employees N/A 6 years after accreditation As Accreditation of qualifications Awarding body employees Sector skills council employees Personal details Contact details SQA Accreditation employees N/A Until superseded As above. Awarding body monitoring Candidates Awarding body employees Personal details Contact details Scottish Candidate Number (SCN) Qualification entries SQA Accreditation employees N/A 6 years As above.
Certification of candidates (Dangerous Goods Driver Training, Dangerous Goods Safety Adviser and Petroleum Driver Passport qualifications and the Marine and Coastguard Agency Certificates of Competency) Candidates Personal details Candidates Centres The following recipients only receive personal data for which they are the joint data controller: Marine and Coastguard Agency Department for Transport Yes – if candidate is based outside of the EEA Termination of contract with client plus 1 year As above. Production of licence/authorisation cards (StreetWorks and Dangerous Goods Driver Qualifications) Candidates Personal details Photographs Attainment details Candidates Centres N/A SWQR – 7 years after licence expiry As above. Marking of examination scripts Candidates Personal details Scottish Candidate Number (SCN) SQA employees Appointees N/A 12 months after examination date As above.
Examination scripts/assessment materials years for cases with possible criminal/civil prosecution) Investigation of complaints Candidates Centre employees Personal details Examination scripts/assessment materials SQA employees SPSO N/A 3 years after conclusion of complaint As above. Regulatory audits SQA employees Centre employees Personal details Contact details SQA employees Regulators - SQA Accreditation, Ofqual, Qualification Wales N/A Awarding body/provider audits - 6 years Regulated qualification audits - 1 year As above. Recruitment Applicants Personal details Employment history Educational history Equal opportunities details SQA employees Appointees N/A 15 months after appointment for unsuccessful applicants As above. Employee management SQA employees Personal details Employment history Educational history Attendance and leave details Contracts Working arrangements Maternity/Paternity details SQA employees N/A 6 years after termination of contract As above.
Medical/occupational health details Disciplinary details Equality monitoring SQA employees Equal opportunities details SQA employees N/A 6 after termination of contract As Employee training SQA employees Personal details Training/development requirements Training providers N/A Training requests – 1 year after completion of training Performance Management Review/Personal Development Plan – 6 years after termination of contract As above. Appointee management Appointees Personal details Gender Employment details Qualification details Training/development requirements SQA Employees N/A 1 year after current year As above. Childcare voucher scheme enrolment SQA employees Personal details Payroll number Child’s personal details including indication of disability SQA employees Voucher scheme provider N/A 6 years after termination of contract As above.
(Retained as part of an employee’s personnel file) Pension scheme enrolment SQA employees Appointees Personal details Salary details Medical health details SQA employees Pension scheme providers – Strathclyde Pension Fund, Scottish Public Pensions Agency N/A End of financial year plus 6 years As above. Payment of employees/appointees/ contractors/suppliers SQA employees Appointee Contractors Suppliers Personal details Bank details Tax details Deductions SQA employees N/A End of financial year plus 6 years As above. Statutory financial reporting SQA employees Appointee Contractors Suppliers Personal details Tax details Deductions SQA employees HMRC Pension scheme providers – Strathclyde Pension Fund, Scottish Public Pensions Agency N/A End of financial year plus 6 years As above. Billing of colleges and overseas centres Candidates Personal details SQA employees Centres Yes – where centre is based outside of the EEA End of financial year plus 6 years As Procurement Supplier employees Personal details including CVs Contact details SQA employees N/A Successful: 6 years after contact end Unsuccessful: As above.
1 year after contract start date Contract bid development SQA staff Consultants Personal details Contact details Qualification details Employment details SQA employees Contracting bodies Yes – if bid is made to an organisation based outside of the EEA Until completion of lessons learned following bid outcome As above. Travel and accommodation booking SQA employees Appointees Personal details Contact details Travel details inc. passport number SQA employees Travel provider - Redfern N/A 1 year following date of booking Regular traveller profiles: Until termination of contract As above. Application for travel SQA employees Appointees Personal details Contact details Travel details inc. passport number Family details i.e. spouse’s name SQA employees department issuing visa Yes – where visa application is for a country outside of the EEA. Until visa expiration As above. Events administration Event delegates – centre Personal details Contact details Access/dietary requirements SQA employees N/A Conclusion of event plus 3 years As above.
Responding to subject access requests Requestors (Candidates, SQA Employees, Appointees) Personal details Request Details Qualification details Post result services/exceptional circumstances requests and outcomes Script cover sheets SQA records SQA employees Requestors Yes – if requestor is based outside of the EEA End of calendar year plus 3 years As above. Responding to enquiries inc. Freedom of Information requests Requestors Personal details Contact details SQA employees Yes – if requestor is outside of the EEA End of calendar year plus 2 years As above. Stakeholder communication Appointees Local provider employees Awarding body employees Regulator employees Scottish Government employees SDS employees Personal details Contact details SQA employees N/A superseded and/or unsubscribe As above.
Council for the Curriculum, Examinations and Assessment employees Sector Skills Council employees Marketing Colleges and training providers employees Consultants General Public Candidates Personal details Contact details SQA employees N/A Until superseded and/or unsubscribe As Recording and publication of video/photographic content Candidates SQA employees Centre employees Images SQA employees Appointees General public Images may be utilised in publicity material for the international market. Until the content is no longer required or consent is withdrawn As above. Security incident management SQA employees Personal details Contact details SQA employees N/A Conclusion of investigation plus 5 years As above. Business continuity planning SQA employees Personal details Contact details SQA employees N/A Incident Management and Executive Management Team Plans and supporting As above.
Appointee Visitors to SQA premises Data back up SQA Employees Candidates Appointees Local Authority employees Centre employees Awarding body employees Regulator employees Scottish Government employees SDS employees Council for the Curriculum, Examinations and Assessment employees All personal data as described above SQA employees N/A Daily back-ups: End of each day plus 1 week Weekly back-ups: End of each working week plus 1 month Monthly disc back-ups: End of each month plus 3 months Monthly tape back-ups: End of each month plus 1 year As above and in addition: Secure servers