8. Where we are processing data based on your consent, you have the right to withdraw that consent at any time. 9. Other than as mentioned below, we will only disclose information about you to third parties if we are legally obliged to do so or where we need to comply with our contractual duties to you, for instance we need to pass on certain information to HMRC, SPPA as pension provider, Practice accountants. 10. We have in place safeguards to ensure the security of your data. Paper records are held in your personnel file, in a locked filing cabinet, with restricted access. Electronic data is held on the Practice Manager’s computer with access restricted to her. 11. Your personal data will be stored for a period of: Payroll data – 6 years. Pension data – 10 years but it should be considered if records of superannuation should be kept until the person reaches retirement age. All other information – for as long as legally necessary or for 6 years following completion of employment. 12. If in the future we intend to process your personal data for a purpose other than that which it was collected we will provide you with information on that purpose and any other relevant information. Your rights 13. Under the General Data Protection Regulation (GDPR) and The Data Protection Act 2018 (DPA) you have a number of rights with regard to your personal data. You have the right to request from us access to, and rectification or erasure of, your personal data; the right to restrict processing; object to processing; in certain circumstances the right to data portability. 14. If you have provided consent for the processing of your data you have the right (in certain circumstances) to withdraw that consent at any time which will not affect the lawfulness of the processing before your consent was withdrawn. 15. If you have any concerns as to how your data is processed you can contact: Practice Manager or one of the GP partners, either in writing or by email 16. You have the right to lodge a complaint to the Information Commissioners’ Office if you believe that we have not complied with the requirements of the GDPR or DPA 18 with regard to your personal data. Identity and contact details of controller and data protection officer 16. Anstruther Medical Practice is the controller and the Practice Manager is the processor of data for the purposes of the DPA 18 and GDPR.
8. Where we are processing data based on your consent, you have the right to withdraw that consent at any time. 9. Other than as mentioned below, we will only disclose information about you to third parties if we are legally obliged to do so or where we need to comply with our contractual duties to you, for instance we need to pass on certain information to HMRC, SPPA as pension provider, Practice accountants. 10. We have in place safeguards to ensure the security of your data. Paper records are held in your personnel file, in a locked filing cabinet, with restricted access. Electronic data is held on the Practice Manager’s computer with access restricted to her. 11. Your personal data will be stored for a period of: Payroll data – 6 years. Pension data – 10 years but it should be considered if records of superannuation should be kept until the person reaches retirement age. All other information – for as long as legally necessary or for 6 years following completion of employment. 12. If in the future we intend to process your personal data for a purpose other than that which it was collected we will provide you with information on that purpose and any other relevant information. Your rights 13. Under the General Data Protection Regulation (GDPR) and The Data Protection Act 2018 (DPA) you have a number of rights with regard to your personal data. You have the right to request from us access to, and rectification or erasure of, your personal data; the right to restrict processing; object to processing; in certain circumstances the right to data portability. 14. If you have provided consent for the processing of your data you have the right (in certain circumstances) to withdraw that consent at any time which will not affect the lawfulness of the processing before your consent was withdrawn. 15. If you have any concerns as to how your data is processed you can contact: Practice Manager or one of the GP partners, either in writing or by email 16. You have the right to lodge a complaint to the Information Commissioners’ Office if you believe that we have not complied with the requirements of the GDPR or DPA 18 with regard to your personal data. Identity and contact details of controller and data protection officer 16. Anstruther Medical Practice is the controller and the Practice Manager is the processor of data for the purposes of the DPA 18 and GDPR.
PRIVACY+NOTICE+FOR+PRACTICE+EMPLOYED+STAFF.docx