performance of a contract with the data subject or to take steps to enter into a contract individuals and processing of this to send/fulfil an online purchase and manage returns programme conditions should be provided for record with the Data Collection Assessment Form Processing is necessary for compliance with a legal obligation The HMRC requires the Union to provide certain information for tax purposes A note should be made on the data collection assessment form of the legal obligation Processing is necessary to protect the vital interests of a data subject or another person If someone was in a medical position that their personal information needed to be released to medical practitioners to preserve life Post releasing this data the Data Protection Officer should be advised Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The Union does not process any data in the public interest. Necessary for the purposes of legitimate interests pursued by the controller or a third party, except where such interests are Members could legitimately expect their information to be processed to enable membership focussed services For new processing activity based on legitimate interest a legitimate impact assessment must be completed to ensure a
retention periods. Only hold such data for so long as necessary for those purposes. In this connection we have decided that ten years following the last contact with an individual is usually an appropriate period to hold data covering the legal limitation period (six years) and a moderate margin. As in most cases this is only archived data, not sensitive, not dangerous and will not be used there seems little risk to data subjects. Only process such data on grounds for lawful processing provided within GDPR Article 6 Lawful reasons detailed above on page 5. Send or otherwise provide appropriate notices to whose personally identifiable information (“Personal Data”) is processed by us including our employees, volunteers and individuals or individuals within partners who supply us with goods or Always direct individuals to for further information Article 13 notices must be provided when the Students’ Union collects data. An example Article 13 notice can be found on the and Committee Hub Article 14 notices must be Drive
services. We will also send such notices to individuals within organisations to whom generic marketing communications (e.g. newsletters) are sent. provided when data is provided to us. An example Article 14 notice can be on the and Committee Hub Not engage in direct marketing to clients or prospects otherwise than in accordance with the relevant legislation and guidance from the ICO. More information on Marketing and Communications can be found in the Membership Communications guidance section of this handbook. Utilise appropriate organisational and technical measures to ensure that Personal Data processed by us is kept secure. More information on data security measures can be found in the in the Information Security guidance section of this handbook. Where we use third party data processors we will choose them carefully with a view to their data security and compliance with GDPR and have GDPR compliant contracts with them. A list of approved third party data processors can be found in the sharing information guidance of this handbook. Not transfer Personal Data (which includes giving third parties access to it within our IT system) to Drive
24 hours via and be alert to any return emails where additional actions may be required Respecting individuals rights Follow the guidance set out in the Individuals’ rights section of this handbook. Gain consent for special categories of data If you are required to capture special categories of data (remember joining a group linked to a special category of data is not personal data) then you must do so with a clear consent except for where the disclosure is to preserve life or for legal purpose. Responding to subject access requests Follow the guidance set out in the Individuals’ rights section of this handbook - ensuring the Data Protection Officer is informed within 5 days
received by an employee or volunteer, please refer the requestor to the Students’ Union’s Data Protection Officer. Information security breaches A personal data breach means a breach of security leading to the destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This means that a breach is more than just losing personal data. A data security breach can happen for a number of reasons: Loss or theft of data or equipment Inappropriate access controls allowing unauthorised use Equipment failure Human error Unforeseen circumstances such as fire or flood Hacking attack Deception of the organisation through ‘blagging’ offences Detecting data breaches Detecting a data breach or the potential of a data breach can happen in a variety of ways. The table below identifies some of the methods of detection and processes for handling such detections. Detection Method Action for potential breach Action for actual breach Employee/ Volunteer Detection If you think you have identified a potential for data security to be breached you must immediately inform your line manager (or staff contact if you are a volunteer) and the Data Protection Officer. They may immediately cease processing this data until the potential for breach is resolved based upon an assessment of the risk to individuals privacy. Immediately report the matter to the Data Protection Officer, permanent staff contact (if volunteer) or line manager - isolating any potential for further breach where appropriate. The DPO and other involved parties should follow the CIRP detailed below. Accidental Breach (such If there is a high likelihood Immediately report the
as loss of laptop) of this breach happening you should immediately adjust your processes and procedures to reduce the likelihood. Always ensure data is secured and encrypted as detailed in the information security section of this handbook. Consult the Data Protection Officer or line manager where appropriate. matter to the Data Protection Officer, permanent staff contact (if volunteer) or line manager - isolating any potential for further breach where appropriate. The DPO and other involved parties should follow the CIRP detailed below. Audit or assessment The Union conducts data audits of its spaces and IT infrastructure once per semester using the internal . These may highlight weaknesses in the organisations information security and should be responded (with advice from the Data Protection Officer) in a timely manner to ensure data privacy of individuals. Immediately report the matter to the Data Protection Officer, permanent staff contact (if volunteer) or line manager - isolating any potential for further breach where appropriate. The DPO and other involved parties should follow the CIRP detailed below. Complaint from either an individual, Where there is a risk of complaint Immediately report the matter to