Our responsibilities and commitments under GDPR

• we aim to continue our work in embedding data protection into our culture
• all staff have completed mandatory online UK GDPR training sessions, which needs to be retaken regularly
• we have undertaken a comprehensive internal communication campaign to raise staff awareness of UK GDPR using key message emails, intranet articles and team training sessions
• we will continue training all staff on how to recognise and respond to subject access requests, freedom of information requests, data breaches, and the rights of data
• staff contracts require our employees to adhere to all council policies which include data protection and information security policies, which are reviewed annually
• all new starters undergo induction training which includes data protection and GDPR

• we are reviewing our systems, including cloud services, to ensure that they meet any specific requirements of UK GDPR, issuing contract variations where appropriate
• our technology and change department administer all internally held systems and they operate an information security management system which is certified to ISO 27001:2013
• Technology and change are also ISO 20000 certified
• ISO 20000 provides quality assurance to the processes, policies and procedures operated in the delivery of ICT services to the council and is the only standard specifically aligned to information technology service delivery and service management

• we have an ongoing process of updating privacy notices for data subjects (including employees as well as service users).
• We are reviewing all current policies and business processes and ensuring that they are UK GDPR compliant.
• A retention policy is in place which stipulates the retention and destruction of both electronic and paper documents.
• We are reviewing our information security incident procedure so that we are able to report breaches of data protection to the ICO, and potentially data subjects, within 72 hours.
• We are replacing our existing data protection policies with a new suite of UK GDPR and Data Protection Act 2018 compliant policies.
• Information security polices are reviewed annually under ISO 27001 requirements.
• We are amending our procedures in regards to processing information requests and other data subject rights.

In order to adhere to the UK GDPR requirement that a data controller must appoint a data processor in the form of binding written agreement, where personal data is processed (including the activities of any sub- processors), and that it is done so only on documented instructions from the controller or within the requirements of the law:

• we are reviewing current data processor arrangements by informing our data processors of changes to legislation
• inserting new data processor clauses in to new contracts and service level agreements
• reviewing existing data processing contracts

This will ensure that relevant wordings are in place to cover aspects such as: 

• the duration, nature and purpose of the processing
• the types of data processed
• the obligations and rights of the controller
• it will also, where applicable, cover cross border transfers and the use of any sub processors

We continually seek to ensure the confidentiality, integrity and availability of the personal data we store or process. We maintain appropriate technical and organisational security measures to protect personal data against accidental or unlawful destruction or loss, alteration, unauthorised disclosure or access.

The requirement to have organisational and technical safeguards in place to protect against breaches of confidentiality, integrity, and availability has remained intact through the migration from the Data Protection Act 1998 to the Data Protection Act 2018 and GDPR. Therefore while our security measures have been reviewed to ensure compliance under the Data Protection Act 2018 and GDPR, we have not deemed any changes to be necessary in this area.

• we currently have a suite of information security policies in place which covers general information security, document and record management, IT usage etc
• our servers are held to ISO 27001 standards
• connectivity to the data centre is secured
• data storage is not shared and is under our control
• network access for staff is controlled. Anti-virus is deployed across the network
• we have a routine backup procedure with data also being backed-up offsite
• we use electronic access control in all of our buildings
• locked cupboards are located throughout all offices with a method for the secure disposal of physical documents provided

Under the UK GDPR, where we process any personal or sensitive categories of data we must notify any data breach to the data protection officer without undue delay. We therefore have processes and procedures in place for identifying, reviewing and promptly reporting data breaches and where appropriate informing the ICO and the data subject(s) themselves.

We record:

• a description of the nature of the breach
• severity analysis of the breach
• likely consequences of the breach
• proposed and imposed measures that were taken to limit harmful effects

We have comprehensive technical and organisational security measures in place to mitigate against a data breach.