Element 9: Data protection An authority that handles personal information about individuals The has in-place wide-ranging data E09-01 ICO “SLAB 01 SLAB will – has a number of legal obligations to protect that information protection controls including high-level Registration” develop Data Sharing under the Data Protection Act 1998. procedures, staff training and guidance for Guidance to reinforce Data E09-02 The Keeper will expect an authority’s RMP to indicate compliance “SLAB specific activities . protection of personal with its data protection obligations. This might be a high level Protection Policy 2013” data shared with third statement of public responsibility and fair processing. training in Information’ ‘Protecting parties by the end of E09-03 Subject “ICO covers Data Protection at three different financial year. If an authority and process information about stakeholders, Access Request Guidance levels. clients, employees or suppliers, it is legally obliged to protect that used by staff” – RMP14 02 SLAB staff – information. Under the Data Protection Act, an authority must only All IAOs are currently attending a will undertake collect information needed for a specific business purpose, it must ‘Protecting E09-04 Subject “SLAB quarterly training programme with updates Information’ refresher on keep it secure and ensure it remains relevant and up to date. The Access Request from the Information Commissioners authority must also only hold as much information as is needed for an annual basis. procedures” Office detailing best practice in key data business purposes and only for as long as it is needed. The person protection who is the subject of the information must be afforded access to it on E09 -05 SLAB ‘Protecting request. Information’ training – Levels 1/2/3 Screen Shots Read further explanation and guidance about element 9 - E09-06 of SLAB “Examples specific privacy notices” E09-07 Access to “SLAB Information link to – external website” E08-03 of “Programme planned IAO Events.”
Element 9: Data protection An authority that handles personal information about individuals has a number of legal obligations to protect that information under the Data Protection Act 1998. The Keeper will expect an authority’s RMP to indicate compliance with its data protection obligations. This might be a high level statement of public responsibility and fair processing. If an authority and process information about stakeholders, clients, employees or suppliers, it is legally obliged to protect that information. Under the Data Protection Act, an authority must only collect information needed for a specific business purpose, it must keep it secure and ensure it remains relevant and up to date. The authority must also only hold as much information as is needed for business purposes and only for as long as it is needed. The person who is the subject of the information must be afforded access to it on request. Read further explanation and guidance about element 9 - The has in-place wide-ranging data protection controls including high-level procedures, staff training and guidance for specific activities . training in ‘Protecting Information’ covers Data Protection at three different levels. All IAOs are currently attending a quarterly training programme with updates from the Information Commissioners Office detailing best practice in key data protection E09-01 “SLAB ICO Registration” E09-02 “SLAB Data Protection Policy 2013” E09-03 “ICO Subject Access Request Guidance – used by staff” E09-04 “SLAB Subject Access Request procedures” E09 -05 SLAB ‘Protecting Information’ training – Levels 1/2/3 Screen Shots E09-06 “Examples of SLAB specific privacy notices” E09-07 “SLAB Access to Information – link to external website” E08-03 “Programme of planned IAO Events.” – 01 SLAB will develop Data Sharing Guidance to reinforce protection of personal data shared with third parties by the end of financial year. RMP14 – 02 SLAB staff will undertake ‘Protecting Information’ refresher on an annual basis.
Records_Management_Plan_Jan2014.docx