Introduction

The EU General Data Protection Regulation (“GDPR”) comes into force across the European Union on 25th May 2018 and brings with it the most significant changes to data protection law in two decades. Based on privacy by design and taking a risk-based approach, the GDPR has been designed to meet the requirements of the digital age.

The 21st Century brings with it broader use of technology, new definitions of what constitutes personal data, and a vast increase in cross-border processing. The new Regulation aims to standardise data protection laws and processing across the EU; affording individuals stronger, more consistent rights to access and control their personal information.

You can read our privacy policy here.

ICO Registration

Home-Start UK has registered with the Information Commissioners Office (ICO) - Reference Z7678729.

Our Commitment

Home-Start UK (‘we’ or ‘us’ or ‘our’) is committed to ensuring the security and protection of the personal information that we process, and to provide a compliant and consistent approach to data protection. We have always had a robust and effective data protection program in place which complies with existing law and abides by the data protection principles. However, we recognise our obligations in updating and expanding this program to meet the demands of the GDPR.

Home-Start UK is dedicated to safeguarding the personal information under our remit and in developing a data protection regime that is effective, fit for purpose and demonstrates an understanding of the new Regulation. Our preparation and objectives for GDPR compliance have been summarised in this statement and include the development and implementation of new data protection roles, policies, procedures, controls and measures to ensure maximum and ongoing compliance.

How have we prepared for GDPR

Home-Start UK have always had a clear focus on data protection and security across our organisation. In preparing for GDPR we have put in place:

Information Audit

We will regularly carry out a company-wide information audit to identify and assess what personal information we hold, where it comes from, how and why it is processed and if and to whom it is disclosed. Data Protection Impact Assessments (DPIA) will help us develop stringent procedures and assessment templates for carrying out impact assessments that comply fully with the GDPR’s Article 35[1] requirements. We have implemented documentation processes that record each assessment, allow us to rate the risk posed by the processing activity and put in place mitigating measures to reduce the risk posed to the data subject(s).

Policies and procedures

Revising data protection policies / procedures to meet GDPR requirements and standards including data protection, IT security, data retention and erasure, data breaches and third party transfers and disclosures.

Subject Access Request / Right to Be Forgotten

We have revised our SAR procedures to accommodate the revised 30-day timeframe for providing the requested information and for making this provision free of charge. Our new procedures detail how to verify the data subject, what steps to take for processing an access request, what exemptions apply and a suite of response templates to ensure that communications with data subjects are compliant, consistent and adequate. If you wish for your data to be erased from our records, please contact us via [email protected] or 0116 464 5490 for our Subject Access Request information.

Breach Notification

We have a notification process in place for any breach. For further information on this, please contact the Data Protection Officer via 0116 4645490.

Data Transfer Statement

We have revised our consent mechanisms for obtaining personal data, ensuring that individuals understand what they are providing, why and how we use it and giving clear, defined ways to consent to us processing their information. Home-Start UK will at times, on an anonymised basis, use personal information to demonstrate the impact of our services. Any case study information shared will always be on an anonymised basis unless we have further explicit consent from individuals.

Home-Start UK may use data for specific purposes of statistical analysis and the promotion of our work nationally as well as any reporting requirements for funders who support the network on a national level. Home-Start UK will share personal information with law enforcement or other authorities if required by applicable law (including, in line with our Safeguarding and Promoting the Welfare of Children/Safeguarding Adults at risks policies, where there are concerns about the safety or wellbeing of a child or adult at risk and it is considered necessary for their welfare and protection).

Home-Start UK will not share your personal information with any other third party without first obtaining your explicit consent.

Direct Marketing/Fundraising

We have revised the wording and processes for direct marketing, including clear opt-in mechanisms for marketing subscriptions, a clear notice and method for opting out and by providing unsubscribe features on all subsequent marketing materials.

Data Subject Rights

In addition to the policies and procedures mentioned above that ensure individuals can enforce their data protection rights, we provide easy to access information of an individual’s right to access any personal information that Home-Start UK processes about them and to request information about: -

• What personal data we hold about them
• The purposes of the processing
• The categories of personal data concerned
• The recipients to whom the personal data has/will be disclosed
• How long we intend to store your personal data for
• If we did not collect the data directly from them, information about the source
• Right to have incomplete/inaccurate data corrected/completed and the process for requesting this
• The right to request erasure of personal data (where applicable) or to restrict processing in accordance with data protection laws, as well as to object to any direct marketing from us and to be informed about any automated decision-making that we use
• The right to lodge a complaint or seek judicial remedy and who to contact in such instances

Processor Agreements & 3rd parties

Where we use any third-party to process personal information on our behalf we drafted procedures for ensuring they (as well as we) meet and understand GDPR obligations. Home-Start UK gains explicit consent from organisations we work with, suppliers and partner organisations to demonstrate that they too are compliant with GDPR legislation. We hold copies of these statements and for further information on our policy on this, please contact the Data Protection Officer.

Special Categories Data

Where we obtain special category information, we do so in compliance with the Article 9 requirements and have high-level encryptions and protections on all such data. Where we rely on consent for processing, this is explicit and is verified by a signature, with the right to modify or remove consent being clearly signposted.

Legal Basis for Processing - we are reviewing all processing activities to identify the legal basis for processing and ensuring that each basis is appropriate for the activity it relates to. Where applicable, we also maintain records of our processing activities, ensuring that our obligations under Article 30 of the GDPR and Schedule 1 of the Data Protection Bill are met.

GDPR Roles and Employees

Home-Start have designated Trish Knight as our Data Protection Officer and we have prompted awareness of the GDPR across the organisation, assessing our GDPR readiness, identifying any gap areas and implementing the new policies, procedures and measures.

Home-Start UK understands that continuous employee awareness and understanding is vital to the continued compliance of the GDPR and have involved our employees in our preparation plans, induction and annual training program. All staff are trained and updated on GDPR every two years (or sooner if there is a major change in legislation).

Lodging a complaint

If you wish to raise a complaint regarding the processing of your personal data or are unsatisfied with how we have handled your information, you have the right to lodge a complaint with the ICO by calling their helpline on 0303 123 1113.

If you have any questions about our preparation for the GDPR, please contact our Data Protection Officer Trish Knight at RGDP  Tel: 0131 222 3239 Email: [email protected] 

 

[1] Article 35 of the General Data Protection Regulation (GDPR) stipulates that a Data Protection Impact Assessment (DPIA) should be carried out if the processing of data is likely to create a high risk.