This document outlines the requirements for sourcing, storing and handling personal data in accordance with the General Data Protection Regulation (GDPR) 25th May 2018
The requirements set out in this document apply to persons and 3rd party entities who control or process data on behalf of Treacle Media Ltd.
Any contravention of this policy which constitutes a breach of the GDPR can incur significant penalties not only to Treacle Media Ltd but also to the individual who caused the data breach.
Violation of this policy is considered gross misconduct or at least gross negligence and is therefore grounds for dismissal or, in relation to 3rd parties, legal action.
Context and overview Key details:
Treacle Media Ltd needs to gather and use certain information about individuals.
These can include customers, suppliers, business contacts, employees and other people the organisation has a relationship with or may need to contact.
This policy describes how this personal data must be collected, handled and stored to meet the company’s data protection standards and to comply with the law.
Why This Policy Exists
This data protection policy ensures Treacle Media Ltd:
Data Protection Law
The General Data Protection Regulation (GDPR) describes how organisations — including Treacle Media Ltd — must collect, handle and store personal information.
These rules apply regardless of whether data is stored electronically, on paper or on other materials.
To comply with the law, personal information must be collected and used fairly, stored safely and not processed or disclosed unlawfully.
The Data Protection Act is underpinned by eight important principles. These say that personal data must:
This policy applies to:
It applies to all data that the company holds relating to identifiable individuals, even if that information technically falls outside of the General Data Protection Regulation (GDPR).
Data Protection Risks
Everyone who works for or with Treacle Media Ltd has some responsibility for ensuring data is collected, stored and handled appropriately.
Each team that handles personal data must ensure that it is handled and processed in line with this policy and data protection principles.
However, these people have key areas of responsibility:
These roles and responsibilities for the primary data and processors, however, it should be made clear that everyone within the company and those working on behalf of Treacle Media Ltd have specific roles and responsibilities when it comes to processing data. The General Data Protection Regulation (GDPR) identifies certain roles and defines their responsibilities as:
The natural person or legal entity that determines the purposes and means of the processing of personal data (e.g., when processing an employee’s personal data, the employer is considered to be the controller). It is possible to have joint data controllers in certain circumstances. For example, when a company operates in multiple countries, but decisions on processing purposes are being made both by central and local entities, the scenario would qualify as a joint controller.
The key responsibility of a controller is to be accountable, i.e., to take actions in line with GDPR, and to be able to explain the compliance with GDPR to data subjects and the Supervisory Authority, as and when required.
The natural person or legal entity that processes personal data on behalf of the controller (e.g., a call centres acting on behalf of its client) is considered to be a processor. At times, a processor is also called a third party.
The key responsibility of the processor is to ensure that conditions specified in the Data Processing Agreement signed with the controller are always met, and that obligations stated in GDPR are complied with.
Assumed Roles And Responsibilities
When dealing with data on a daily basis individuals will naturally assume one of the identified roles and therefore its responsibilities. In most cases members of staff will naturally assume the role of data processor in their day to day handling of customer data.
The following table provides a summary of the information classification levels that have been adopted by Treacle Media Ltd and which underpin the principles of information security defined in the Information Security Policy (Section 2.1). These classification levels explicitly incorporate the General Data Protection Regulation’s (GDPR) definitions of Personal Data and Special Categories.
|Security Level||Definition||Examples||FOIA2000 Status*|
|1. Confidential||Normally accessible only to specified members of Treacle Media Ltd staff. Should be held in an encrypted state outside Treacle Media Ltd systems; may have encryption at rest requirements from providers.||GDPR-defined Special Categories of personal data (passwords; large aggregates of personally identifying data (>1000 records) including elements such as name, address, telephone number.||Subject to significant scrutiny in relation to Appropriate exemptions/ public interest and legal considerations.|
|2. Restricted||Normally accessible only to specified members of Treacle Media Ltd staff or authorised 3rd parties.||GDPR-defined Personal Data (information that identifies living individuals including home / work address, age, telephone number, Education, photographs); reserved management business; draft reports, papers and minutes; company asset information;||Subject to significant scrutiny in relation to appropriate exemptions / public interest and legal considerations.|
|3. Internal Use||Normally accessible only to members of Treacle Media Ltd staff and authorised 3rd parties.||Internal correspondence, company papers and minutes; company asset information||Subject to scrutiny in relation to appropriate exemptions/ public interest and legal considerations|
|4. Public||Accessible to all members of the public||Annual accounts, minutes of statutory and other formal Committees; information available on the Treacle Media Ltd website or through Treacle Media Ltd publications;||Freely available on the website or through Treacle Media Ltd publications|
Explicit Data Controllers And Other Rights Of Access To Information
Treacle Media Ltd recommends that branches, departments and authorised partners explicitly designate data controllers and data processors.
Other users may have rights of access to data according to the terms of engagement under which the data was gained or created.
Granularity Of Classification
The sets of information being classified should, in general, be large rather than small. Smaller units require more administrative effort, involve more decisions and add to complexity, thus decreasing the overall security.
There may be minimum or maximum time-scales for which information must be kept. These may be mandated in a commercial or legal contract. Other forms of information retention may be covered by environmental or financial regulations.
These rules describe how and where data should be safely stored. Questions about storing data safely can be directed to the IT manager or data controller.
When data is stored on paper, it should be kept in a secure place where unauthorised people cannot see it.
These guidelines also apply to data that is usually stored electronically but has been printed out for some reason:
When data is stored electronically, it must be protected from unauthorised access, accidental deletion and malicious hacking attempts:
Personal data is of no value to Treacle Media Ltd unless the business can make use of it. However, it is when personal data is accessed and used that it can be at the greatest risk of loss, corruption or theft:
The law requires Treacle Media Ltd to take reasonable steps to ensure data is kept accurate and up to date.
The more important it is that the personal data is accurate, the greater the effort should put into ensur- ing its accuracy
It is the responsibility of all employees who work with data to take reasonable steps to ensure it is kept as accurate and up to date as possible.
All individuals who are the subject of personal data held by Treacle Media Ltd are entitled to:
If an individual contacts the company requesting this information, this is called a subject access request.
Subject access requests from individuals should be made by email, addressed to the data protection officer at email@example.com. The data controller can supply a standard request form, although individuals do not have to use this.
Individuals may be charged up to £10 per subject access request. The data controller will aim to provide the relevant data within 14 days or a maximum of 40 calendar days from receipt of the subject access request. There will be no charge to Treacle Media Ltd employees for subject access requests.
The data controller will always verify the identity of anyone making a subject access request before handing over any information.
In certain circumstances, the General Data Protection Regulation (GDPR) allows personal data to be disclosed to law enforcement agencies without the consent of the data subject.
Under 5(1)(a) and (b) of the General Data Protection Regulation (GDPR), there is an obligation not to process and disclose personal data unfairly, unlawfully or for a purpose incompatible with the purpose for which it was collected. However, schedule 2 of the Data Protection Act 2018 disapplies those provisions to the extent that would likely be prejudice the prevention or detection of crime and advise to not inform the owner of the personal data provided the prejudice can be identified.
Under these circumstances, Treacle Media Ltd will disclose requested data. However, the data controller will ensure the request is legitimate, seeking assistance from the board of directors and from the company’s legal advisers where necessary.
Treacle Media Ltd aims to ensure that individuals are aware that their data is being processed, and that they understand:
To these ends, the company has a privacy statement, setting out how data relating to individuals is used by the company.
[ This is available on request. A public version of this statement is also available at www.treaclemedia.com/privacy/]