1. Purpose

 

1. To ensure that all Special People Partnership Ltd. staff understand the principles set out in UK GDPR in relation to data retention and data security.
2. By reviewing this policy, Special People Partnership Ltd. will be able to consider appropriate retention periods for the personal data it processes and ensure that it stores personal data for an appropriate period of time.
3. This policy will enable Special People Partnership Ltd. staff to review the policies and procedures they have in place to ensure that personal data they process is kept secure and properly protected from unlawful or unauthorised processing and accidental loss, destruction, or damage.
4. To meet the legal requirements of the regulated activities that {Special People Partnership Ltd.} is registered to provide:
   • Data Protection Act 2018
   • UK GDPR

 

2. Scope

1. The following roles may be affected by this policy:
   • All staff
2. The following Client/Service Users may be affected by this policy:
   • Client/Service Users
3. The following stakeholders may be affected by this policy:
   • Family
   • Advocates
   • Representatives
   • Commissioners
   • External health professionals
   • Local Authority
   • NHS

3. Objective

1. To enable Special People Partnership Ltd. to ensure that its data retention and data security policies are UK GDPR compliant.
2. This policy will assist with defining accountability and establishing ways of working in terms of the use, storage, retention and security of personal data.

4. Policy

1. Data Retention: As a general principle, Special People Partnership Ltd. will not keep (or otherwise process) any personal data for longer than is necessary. If Special People Partnership Ltd. no longer requires the personal data once it has finished using it for the purposes for which it was obtained, it will delete the personal data unless it is required by law to retain the data for an additional period of time.
2. Special People Partnership Ltd. may have legitimate business reasons to retain the personal data for a longer period. This may include, for example, retaining personnel records in case a claim arises relating to personal injury caused by Special People Partnership Ltd. that does not become apparent until a future date. Special People Partnership Ltd. will consider the likelihood of this arising when it determines its retention periods – the extent to which medical treatment is provided by Special People Partnership Ltd. will, for example, affect the likelihood of Special People Partnership Ltd. needing to rely on records later. A link to the NHSX Records Management Code of Practice 2021 is available in the Underpinning Knowledge section. It is a guide in relation to the practice of managing records, with minimum retention periods for different types of records relating to health and care.
3. Special People Partnership Ltd. may be required to retain personal data for a specified period of time to comply with legal or statutory requirements. These may include, for example, requirements imposed by HMRC in respect of financial documents, or guidance issued by UK Visas and Immigration and Immigration Enforcement in respect of the retention of right to work documentation (see the “Underpinning Knowledge” section).
4. Special People Partnership Ltd. understands that claims may be made under a contract for 6 years from the date of termination of the contract, and that claims may be made under a deed for a period of 12 years from the date of termination of the deed. Special People Partnership Ltd. may therefore consider keeping contracts and deeds and documents and correspondence relevant to those contracts and deeds for the duration of the contract or deed plus 6 and 12 years respectively.
5. Special People Partnership Ltd. will consider how long it needs to retain HR records. Special People Partnership Ltd. may choose to separate its HR records into different categories of personal data (for example, health and medical information, holiday and absence records, next of kin information, emergency contact details, financial information) and specify different retention periods for each category of personal data. Special People Partnership Ltd. recognizes that determining separate retention periods for each element of personal data may be more likely to comply with UK GDPR. Special People Partnership Ltd. may decide, however, that separating its HR records into different elements is not practical, and that it can determine a sensible period of time for which to keep the HR records in their entirety. The period of time that is appropriate may depend on the likelihood of a claim arising in respect of that employee in the future. If, for example, if Special People Partnership Ltd. is concerned that an employee may suffer personal injury as a result of their employment, they may choose to retain its HR records for a significant period of time. If any such claim is unlikely, Special People Partnership Ltd. may choose to retain its files for 6 or 12 years (depending on whether the arrangement entered into between Special People Partnership Ltd. and the employee is a contract or a deed).
6. Special People Partnership Ltd. will consider the following advice and guidelines when deciding for how long to retain HR data. Special People Partnership Ltd. acknowledges that the suggested retention periods below are based on guidance within relevant legislation:
   • Immigration checks – three years after the termination of employment.
   • PAYE records – at least three years after the end of the tax year to which they relate.
   • Payroll and wage records for companies – six years from the financial year-end in which payments were made.
   • Records in relation to hours worked and payments made to workers – three years beginning with the day on which the pay reference period immediately following that to which they relate ends.
   • Records required by the Working Time Regulations:
     • Working time opt out – three years from the date on which they were entered into.
     • Compliance records – three years after the relevant period.
   • Maternity records – four years after the end of the tax year in which the maternity pay period ends.
   • Accident records – at least four years from the date the report was made, or potentially longer if deemed appropriate given the possibility of ongoing relevance of the records.
7. Special People Partnership Ltd. will consider for how long it is required to keep records relating to Client/Service Users. In doing so, Special People Partnership Ltd. will consider the data retention guidelines provided by the NHS, if applicable. Those guidelines can be accessed by using the link in the “Underpinning Knowledge” section. If the NHS guidelines do not apply to Special People Partnership Ltd., Special People Partnership Ltd. will determine an appropriate retention policy for Client/Service User personal data. Special People Partnership Ltd. may choose to retain personal data for at least 6 years from the end of the provision of services to the Client/Service User in case a claim arises in respect of the services provided.
8. Irrespective of the retention periods chosen by Special People Partnership Ltd., they must ensure that all personal data is kept secure and protected for the period in which it is held. This applies to special categories of data.
9. Special People Partnership Ltd. must record all decisions taken in respect of the retention of personal data. If the ICO investigates the policies and procedures at Special People Partnership Ltd., a written record of the logic and reasoning behind the retention periods adopted must be available.
10. Special People Partnership Ltd. must implement processes for effectively and securely destroying and/or deleting personal data at the end of the relevant retention period. They must consider whether personal data stored on computers, including in emails, is automatically backed up and how to achieve deletion of those backups or ensure that the archived personal data is automatically deleted after a certain period of time. Special People Partnership Ltd. will also consider circulating guidance internally to encourage staff to regularly delete their emails. Special People Partnership Ltd. will introduce policies relating to the destruction of hard copies of documents, including using confidential waste bins or shredding them.
11. Data Security : Special People Partnership Ltd. must take steps to ensure that the personal data it processes is secure, including by protecting the personal data against unauthorized or unlawful processing and against accidental loss, destruction or damage.
12. Special People Partnership Ltd. understands that all health and care organisations, as detailed below, are required to comply with the Data Security and Protection Toolkit. A link to an explanatory guidance note is included in the “Underpinning Knowledge” section. Compliance with the Data Security and Protection Toolkit facilitates compliance with UK GDPR. Special People Partnership Ltd. understands that the following types of organization must comply with the Data Security and Protection Toolkit:
    • Organisations contracted to provide services under the NHS Standard Contract
    • Clinical Commissioning Groups
    • General Practices that are contracted to provide primary care essential services.
    • Local authorities and social care providers must take a proportionate response to the new toolkit:
      • Local authorities should comply with the toolkit where they provide adult social care or public health and other services that receive services and data from NHS Digital or are involved in data sharing across health and care where they process confidential personal data of Client/Service Users who access health and adult social care services.
      • Social care providers who provide care through the NHS Standard Contract should comply with the toolkit. It is also recommended that social care providers who do not provide care through the NHS Standard Contract consider compliance with the toolkit as this will help to demonstrate compliance with the ten security standards and UK GDPR.
13. Special People Partnership Ltd. will implement and embed the use of policies and procedures to ensure that personal data is kept secure. The suggestions below apply in addition to the steps Special People Partnership Ltd. is required to take pursuant to the Data Security and Protection Toolkit, if the toolkit applies to Special People Partnership LTD. Special People Partnership Ltd will bear in mind the following principles when deciding how to ensure that personal data is kept secure:
    • Confidentiality – ensuring that personal data is accessible only on a need-to-know basis.
    • Integrity – ensuring that there are processes and controls in place to make sure personal data is accurate and complete.
    • Availability – ensuring that personal data is accessible when it is needed for business purposes of Special People Partnership Ltd.
    • Resilience – ensuring that personal data is able to withstand and recover from threats for paper documents, these will include, where possible.
    • Keeping the personal data in a locked filing cabinet or locked drawer when it is not in use.
    • Adopting a “clear desk” policy to ensure that personal data is not visible or easily retreved.
    • Ensuring that documents containing personal data are accessible only by those who need to know/review the documents and the personal data contained within them.
    • Redacting personal data from documents where possible.
    • Ensuring that documents containing personal data are placed in confidential waste bins or shredded at the end of the relevant retention period.
    • Minimizing the transfer of personal data from outside of business premises and, where such transfer cannot be avoided, ensuring that the paper documents continue to be kept confidential and secure.

    For electronic documents, the measures taken by Special People Partnership Ltd. will include, where possible:

    • Password protection or, where possible, encryption.
    • Adopting a ‘clear screen’ policy where users lock screens when they are away from their computers.
    • Ensuring that documents containing personal data are accessible only by those who need to know/review the documents and the personal data contained within them.
    • Ensuring ongoing confidentiality, integrity and reliability of systems used online to process personal data (this may require a review of IT systems and software currently used by Special People Partnership Ltd. )
    • The ability to quickly restore the availability of and access to personal data in the event of a technical incident (this may require a review of IT systems and software currently used by Special People Partnership Ltd. )
    • Taking care when transferring documents to a third party, ensuring that the transfer is secure, and the documents are sent to the correct recipient.

    Special People Partnership Ltd. will ensure that all business phones, computers, laptops and tablets are password protected. Special People Partnership Ltd. will encourage staff to avoid storing personal data on portable media such as USB devices. If the use of portable media cannot be avoided, Special People Partnership Ltd. will ensure that the devices it uses are encrypted or password protected and that each document on the device is encrypted or password protected.

14. Special People Partnership Ltd. will implement guidance relating to the use of business phones and messaging apps. Special People Partnership Ltd. understands that all personal data sent via business phones, computers, laptops and tablets may be captured by UK GDPR, depending on the content and context of the message. As a general rule, Special People Partnership Ltd. will ensure that staff members only send personal data by text or another messaging service if they are comfortable that the content of the messages may be captured by UK GDPR and may need to be provided pursuant to a Subject Access Request (staff should refer to the Subject Access Requests Policy and Procedure at Special People Partnership Ltd. for further details).
15. Special People Partnership Ltd. will ensure that all staff are aware of the importance of keeping personal data secure and not disclosing it on purpose or accidentally to anybody who should not have access to the information. To achieve this, Special People Partnership Ltd. will:
    • Provide training to staff where necessary on security of personal data.
    • Consider, in particular, the likelihood that personal data (including special categories of data) will be removed from the premises of Special People Partnership Ltd. and taken to, for example, Client/Service User’s homes and residences
    • Control access to premises
    • Ensure that all staff understand the importance of maintaining the confidentiality of personal data away from the premises.
    • Take care to ensure that the personal data is not left anywhere it could be viewed by a person who should not have access.
16. Special People Partnership Ltd. will adopt policies and procedures in respect of recognising, resolving and reporting security incidents including breaches of UK GDPR. Special People Partnership Ltd. understands that it may need to report breaches to the ICO and to affected Data Subjects, as well as to CareCert if it is required to comply with the Data Security and Protection Toolkit.
17. Special People Partnership Ltd. will adopt processes to regularly test, assess and evaluate the security measures it has in place for all types of personal data.
18. Privacy by Design: Special People Partnership Ltd. will take into account the UK GDPR requirements around privacy by design, particularly in terms of data security.
19. Special People Partnership Ltd. understands that privacy by design is an approach set out in UK GDPR that promotes compliance with privacy and data protection from the beginning of a project. Special People Partnership Ltd. will ensure that data protection and UK GDPR compliance is always at the forefront of the services it provides, and that it will not be treated as an afterthought.
20. Special People Partnership Ltd. will comply with privacy by design requirements by, for example:
    • Identifying potential data protection and security issues at an early stage in any project or process, and addressing those issues early on;
    • Ensuring that the default position in projects involving personal data is privacy centres i.e. privacy by default; and
    • Increasing awareness of privacy and data protection across Special People Partnership Ltd., including in terms of updated policies and procedures adopted by Special People Partnership Ltd.
21. Special People Partnership Ltd. will conduct Data Protection Impact Assessments to identify and reduce the privacy and security risks of any project or processing carried out by Special People Partnership A template Data Protection Impact Assessment along with the circumstances in which a Data Protection Impact Assessment should be conducted is available within the Data Protection Impact Assessment (DPIA) Policy and Procedure at Special People Partnership Ltd.

5. Procedure

1. Special People Partnership Ltd. must consider data retention and data security issues and concerns at the beginning of any project (whether the project is the introduction of a new IT system, a new way of working, the processing of a new type of personal data or anything else that may affect the processing activities at Special People Partnership Ltd.). Special People Partnership Ltd. appreciates that this is key for complying with the privacy by design requirements in UK GDPR.
2. Special People Partnership Ltd. will review the periods for which it retains all the personal data that it processes.
3. Special People Partnership Ltd. will, if necessary, adopt new policies and procedures in respect of data retention and will circulate those policies and procedures to all staff. Special People Partnership Ltd. will also consider providing training to staff in respect of data retention.
4. Special People Partnership Ltd. will review the security measures currently in place in respect of all the personal data it processes.
5. Special People Partnership Ltd. will document the decisions it takes, and the logic and reasoning behind those decisions, in respect of both data retention and data security. Special People Partnership Ltd. will keep a record of all policies and procedures it implements to demonstrate its compliance with UK GDPR.

6. Definitions

6.1 Personal Data

• Any information about a living person from which they are or can be identified (directly or indirectly) including but not limited to names, email addresses, postal addresses, job roles, photographs, CCTV and special categories of data, defined below

6.2 Process or Processing

• Doing anything with personal data, including but not limited to collecting, storing, holding, using, amending, or transferring it. You do not need to be doing anything actively with the personal data – at the point you collect it, you are processing it.

6.3 UK General Data Protection Regulation (UK GDPR)

• The UK GDPR is the retained EU law version of GDPR that forms part of English law.

6.4 Special Categories of Data

• Special categories of data include but are not limited to medical and health records (including information collected as a result of providing health care services) and information about a person’s religious beliefs, ethnic origin and race, sexual orientation and political views

6.5 Data Subject

• The individual to whom the personal data relates.

6.6 CareCERT

• The Care Computer Emergency Response Team, developed by NHS Digital. CareCERT offers advice and guidance to support health and social care organisations to respond to cyber security threats.

6.7 Data Protection Act 2018

• The Data Protection Act 2018 is a United Kingdom Act of Parliament that updates data protection laws in the UK. It sits alongside the UK General Data Protection Regulation.

Key Facts- Professionals

 Professionals providing this service should be aware of the following:

• Anybody who processes personal data on behalf of Special People Partnership Ltd. should be made aware of and should comply with the policies at Special People Partnership Ltd. in respect of data retention and data security.
• Personal data will not be kept longer than necessary.
• Personal data will be deleted when no longer needed.
• Personal data may be held for longer than needed for the purposes of processing if there are justified reasons such as to meet regulations, insurance or other statutory requirements.
• Retention periods are the decision of Special People Partnership Ltd., but guidance should be sought by referring to the Records Management Code of Practice 2021
• All personal data will be kept securely.
• All retention periods need to be documented and justified.
• Special People Partnership Ltd. has effective and robust processes for destroying personal data.
• Special People Partnership Ltd. will comply with the Data Security and Protection Toolkit when necessary.
• Documents containing personal data are only shared with people who need to know the content.
• Electronic devices will be password protected to aid security.

Key Facts – People affected by the service

People affected by this service should be aware of the following:

• Special People Partnership Ltd. will implement and embed the use of policies and procedures to ensure that all personal data processed about people affected by the services provided by Special People Partnership Ltd., including you, is retained and is kept secure and protected in accordance with UK GDPR

 Contact

If you wish to contact Special People Ltd. in relation to this privacy please contact info@specialpeople.org.uk