Information and Data Protection Policy
The Data Protection Act 1998 requires every data controller who is processing personal data to notify unless they are exempt. Failure to notify is a criminal offence. Joel Alexander has set up a direct debit to renew our notification each year for the following purposes:
- Staff administration
- Advertising, marketing and public relations
- Accounts and records
- Administration of membership records
- Advertising, marketing and public relations for others
- Consultancy and advisory services
- Information and databank administration
- Journalism and media
- Legal services
- Processing for not for profit organizations
- Realising the objectives of a charitable organization or voluntary body
- Trading/sharing in personal information
If Joel Alexander needs to collect data for any purpose not stated above we should notify the Information Commissioner before collecting that data.
Eight Data Protection Principles
Whenever collecting information about people Joel Alexander agrees to apply the Eight Data Protection Principles:
- Personal data should be processed fairly and lawfully
- Personal data should be obtained only for the purpose specified
- Data should be adequate, relevant and not excessive for the purposes required
- Accurate and kept up-to-date
- Data should not be kept for longer than is necessary for purpose
- Data processed in accordance with the rights of data subjects under this act
- Security: appropriate technical and organizational measures should be taken unauthorized or unlawful processing of personal data and against accidental loss or destruction or damage to personal data.
- Personal data shall not be transferred outside the EEA unless that country or territory ensures an adequate level of data protection.
Joel Alexander has taken measures to guard against unauthorised or unlawful processing of personal data and against accidental loss, destruction or damage.
- Adopting an information security policy (this document is our policy)
- Taking steps to control physical security (projects and staff records are all kept in a locked filing cabinet)
- Putting in place controls on access to information (password protection on files and server access)
- Establishing a business continuity/disaster recovery plan (Joel Alexander takes regular back-ups of its computer data files and this is stored away from the office at a safe location)
- Training all staff on security systems and procedures
- Detecting and investigating breaches of security should they occur