Introduction
This policy aims to outline Lockleaze Neighbourhood Trust’s commitment to protecting the rights and privacy of individuals. It sets out the ways in which Lockleaze Neighbourhood Trust handles data and maintains records to be in adherence with the General Data Protection Regulation 2018.
Lockleaze Neighbourhood Trust will remain the data controller for the information held, and the board of Trustees will determine the purposes and means of processing personal data.
Staff, volunteers and Trustees responsible for processing data have a legal obligation to maintain records of all processing activities and maintaining the confidentiality of all privileged information. Personal data can be held on computer or in a manual file, and includes email, minutes of meetings, and photographs.
Scope
The General Data Protection Regulation (GDPR) governs the use of ‘personal data’ meaning any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.
This includes, but is not limited to:
∙ Name
∙ E-mail address
∙ Telephone number
∙ Address
∙ Bank details
As well as ‘sensitive personal data’, including:
∙ Religious beliefs
∙ Political affiliations
∙ Racial information
∙ Sexual orientation
Lawful Basis for Processing
Lockleaze Neighbourhood Trust must have a valid legal basis in order to process personal data. This must be approved by the board of Trustees, recorded and communicated to the individual providing data within the privacy notice.
The lawful basis for processing are;
∙ Consent
∙ Contract
∙ Legal Obligation
∙ Vital Interests
∙ Public Task
∙ Legitimate Interests
These lawful bases also require and an additional condition:
∙ Special category data
∙ Criminal offence data
Individual Rights
Lockleaze Neighbourhood Trust will ensure that an individual’s rights are upheld in regard to the personal information they have provided. These rights are as follows;
1. The right to be informed
2. The right of access
3. The right of rectification
4. The right to erasure
5. The right to restrict processing
6. The right to data portability
7. The right to object
8. Rights in relation to automated decision making and profiling
If an individual requests access to their personal data or information about how it is being processed, this will be provided free of charge and within one month of the request.
Aims
Lockleaze Neighbourhood Trust will adhere to the data protection principles set out in the GDPR and fulfil their responsibilities as an organisation to ensure that personal data is: ∙ Processed lawfully, fairly and in a transparent manner.
∙ Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
∙ Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
∙ Accurate and, where necessary, kept up to date and that steps will be taken to rectify or erase inaccurate personal data.
∙ Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
Processed in a manner that ensures appropriate security of the personal data including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
The LNT Board of Trustees are ultimately responsible for, and must be able to demonstrate, compliance with the principles set out above.
Implementation
Lockleaze Neighbourhood Trust is committed to being transparent in the collection and processing of personal data. To ensure adherence to the GDPR we will:
∙ Conduct annual information audits to find out what personal data we hold and whether it is still necessary to ongoing projects, as well as up to date
∙ If it is found that the information will no longer be required for its stated purpose it will be destroyed in a way which retains confidentiality
∙ Contact existing individuals who we hold personal data on for continued consent to process this data, if still necessary
∙ Make sure all staff, volunteers and Trustees who process personal data have read and understood this policy;
∙ Provide training to ensure best practice is adhered to for all staff regularly dealing with personal data, with a focus on the transition from the Data Protection Act 1998 to the GDPR ∙ Not hold information about individuals without their knowledge and consent and will make the purpose of data collection clear from the first point of contact
∙ All information will be stored on a password-protected computer, with any hard copies only accessible by Lockleaze Neighbourhood Trust staff.
∙ All requests for personal data will contain a clear and easy to understand privacy notice informing them of the period for which their data will be retained and the lawful basis for collecting information. If the lawful basis is consent there will also be a clear ‘positive opt-in’.
The Board of Trustees on behalf of Lockleaze Neighbourhood Trust will ensure this policy is kept up to date and reviewed annually. The Operations Manager will also oversee the implementation and adherence to the GDPR on a day-to-day basis.
Personal Data Breaches
Any breach of confidentiality by staff, trustees or volunteers will be dealt with in accordance with our disciplinary procedure. This includes the destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
If the breach will result in a severe risk to people’s rights and freedoms, in which case it will be reported to the ICO and the individual’s affected within 72 hours.
Lockleaze Neighbourhood Trust
The Hub, Unit 1 Fedden Buildings
Gainsborough Square, Lockleaze, BS7 9FB
Telephone number: 0117 914 1129
Email address: info@lockleazent.co.uk
VERSION CONTROL – Approval and Review
| Version No | Approved By | Approval Date | Main Changes | Review Period |
| 1.0 | LNT BOARD | 11/3/2015 | ||
| 2.0 | LNT BOARD | 13/2/2018 | Annually | |
| 3.0 | CEO | Sept 2025 | Annually |