2.14 What security and audit measures have been implemented to secure access to and limit use of personal identifiable information? Username and password: Keys to locked cabinets: Restricted access to network Door access Other (provide description): 2.15 Will any information be sent offsite i.e. outside the organisation and its computer network? – And, are you transferring personal data to a country or territory outside of the EEA? 2.16 Please state by which method the information will be transferred? Email (internal): Email (external): Website access: Post (internal): Post (external): Telephone: Fax: Courier: By hand: Wireless network: (please specify): 2.17 Are disaster recovery and contingency plans in place? Yes/No 2.18 Is mandatory staff training in place for the following? Dates Data collection Yes/No Use of the system or service Yes/No Collecting consent Yes/No Information Governance Yes/No 2.19 Are there any new or additional reporting requirements for Yes/No this project? Who will be able to run reports? Who will receive the report or where will it be published? Will the reports be in person-identifiable, pseudonymised or anonymised format? 2.20 If this new/revised function should stop, are there plans in Yes/No place for how the information will be retained/archived/transferred or disposed of? 2.21 How will individuals be informed the proposed uses of their personal data? (e.g. privacy notices) 2.22 Are arrangements in place for recognising and responding to Yes/No members requests for access to their personal data? 2.23 Will members be asked for their consent for their information Yes/No to be collected and/or shared? If no, list the reason for not gaining consent, e.g. relying on an existing agreement, consent is implied or other. How will you manage the member/service user dissent?
2.14 What security and audit measures have been implemented to secure access to and limit use of personal identifiable information? Username and password: Keys to locked cabinets: Restricted access to network Door access Other (provide description): 2.15 Will any information be sent offsite – i.e. outside the organisation and its computer network? And, are you transferring personal data to a country or territory outside of the EEA? 2.16 Please state by which method the information will be transferred? Email (internal): Email (external): Website access: Post (internal): Post (external): Telephone: Fax: Courier: By hand: Wireless network: (please specify): 2.17 Are disaster recovery and contingency plans in place? Yes/No 2.18 Is mandatory staff training in place for the following? Data collection Use of the system or service Collecting consent Information Governance Yes/No Yes/No Yes/No Yes/No Dates 2.19 Are there any new or additional reporting requirements for this project? Who will be able to run reports? Who will receive the report or where will it be published? Will the reports be in person-identifiable, pseudonymised or anonymised format? Yes/No 2.20 If this new/revised function should stop, are there plans in place for how the information will be retained/archived/transferred or disposed of? Yes/No 2.21 How will individuals be informed the proposed uses of their personal data? (e.g. privacy notices) 2.22 Are arrangements in place for recognising and responding to members requests for access to their personal data? Yes/No 2.23 Will members be asked for their consent for their information to be collected and/or shared? If no, list the reason for not gaining consent, e.g. relying on an existing agreement, consent is implied or other. How will you manage the member/service user dissent? Yes/No
170App1.docx