Personal data is any information about an identifiable living person. In an employment context this could include employees, workers, contractors or agency staff, as well as information about job applicants and individuals who have left the company. The person may be identified by name, an identification number, location data, an online identifier or by one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person. Schools will need to consider what methods could be reasonably used to identify the individual from the data. The GDPR applies to both automated personal data and to manual filing systems where personal data is accessible according to specific criteria. This is wider than the DPA definition and could include chronologically ordered sets of manual records containing personal data. Important Previously, the information had to have the individual as its focus i.e. being named on an email address list would not be sufficient. Now, the information may relate to an individual even if it does not focus on him/her. Examples of personal data include CCTV film, lift or floor access information, computer log on data, data on websites visited, phone calls made and emails sent or received. Sensitive Personal Data Businesses will need to continue to take additional care when processing sensitive personal data. The definition of sensitive personal data has not changed and continues to include: Racial or ethnic origin Political opinions Religious and philosophical beliefs Trade union membership Health, sex life or sexual orientation Genetic and biometric data Fair Processing (Privacy Notice & Consent Form) Under the DPA 1998, schools will have to provide individuals with information about how their data will be used (or ‘processed’) to ensure transparency. These are
Personal data is any information about an identifiable living person. In an employment context this could include employees, workers, contractors or agency staff, as well as information about job applicants and individuals who have left the company. The person may be identified by name, an identification number, location data, an online identifier or by one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person. Schools will need to consider what methods could be reasonably used to identify the individual from the data. The GDPR applies to both automated personal data and to manual filing systems where personal data is accessible according to specific criteria. This is wider than the DPA definition and could include chronologically ordered sets of manual records containing personal data. Important Previously, the information had to have the individual as its focus i.e. being named on an email address list would not be sufficient. Now, the information may relate to an individual even if it does not focus on him/her. Examples of personal data include CCTV film, lift or floor access information, computer log on data, data on websites visited, phone calls made and emails sent or received. Sensitive Personal Data Businesses will need to continue to take additional care when processing sensitive personal data. The definition of sensitive personal data has not changed and continues to include: Racial or ethnic origin Political opinions Religious and philosophical beliefs Trade union membership Health, sex life or sexual orientation Genetic and biometric data Fair Processing (Privacy Notice & Consent Form) Under the DPA 1998, schools will have to provide individuals with information about how their data will be used (or ‘processed’) to ensure transparency. These are
GDPR-Preparation-Pack-V4.docx