GDPR General Data Protection Regulation

This document describes how BACKUP commits to respecting and protecting the privacy of young people, staff, volunteers and service users:

• BACKUP will only keep necessary personal data.
• BACKUP processes data under legal bases including contractual necessity for employees, provision of health/social care for young people, and legitimate interests for other data.
• Individuals have rights to access, rectify, erase, restrict processing, object to processing, and data portability.
• The Director of Business serves as BACKUP’s Data Protection Officer and is responsible for compliance, monitoring, and handling data protection issues.
• BACKUP uses secure servers and restricts access to personal data. They have policies for physical and digital security measures.
• Personal data is kept only as long as necessary, with regular reviews and a retention schedule.
• Information can be shared in limited circumstances like child safety risks or serious crimes. Otherwise, consent is required to share data.
• Extra protections are in place for sensitive data like race, information about health and sexual orientation.
• Specific procedures are in place for the handling of data about the young people supported by BACKUP
• There is guidance and separate policy in place governing the use of CCTV within the charity.
• Procedures are in place for reporting and handling data breaches.

The policy aims to ensure BACKUP complies with GDPR and data protection laws while delivering its services and managing employees. It emphasises protecting privacy while allowing necessary data use.

Downloads