Policy prepared by: Brad Gravesen
Approved by: V. Sonia Gravesen DBA Sonia Dane Enterprises and SoniaDane.com
Policy became operational on: 1/1/2020
Next review date: 1/1/2024
Data protection law:
The General Data Protection Regulation (GDPR) applies in the UK and across the EU from May 2018. It requires personal data shall be:
Everyone at SoniaDane.com (Brad and Sonia are everyone) contributes to compliance with GDPR. As the only decision makers, they understand the requirements and accountability of the organization sufficiently to prioritize and support the implementation of compliance. Sonia and Brad are solely responsible for compliance with the regulations. These responsibilities include (but are not necessarily limited to):
Data Protection Officer (DPO) – the person responsible for fulfilling the tasks of the DPO in respect to SoniaDane.com is Brad Gravesen. The minimum tasks of the DPO are:
Scope of personal information to be processed
In this section you should detail:
the scope of the data you process, including whether you process any of the following:
names of individuals
postal addresses of individuals
email addresses
telephone numbers
online identifiers
any other information relating to individuals
where the data is collected from and stored
details of how you have made consideration to ensure that the data is accurate, (for example, what measures you have in place to check accuracy/duplication/completeness of data) relevant to the purpose, not excessive, up-to-date (for example, what measures you have in place to clean and update records) and not kept for longer than is necessary
When and how relevant data will be checked against industry suppression files, such as the telephone preference service, the mailing preference service and the fundraising preference service
Details of any sensitive special categories of personal information that it is necessary for SoniaDane.com to process. Describe the enhanced measures that are set in place to protect this information, and respect the rights and freedoms of the individuals to whom it relates
Uses and conditions for processing
Here, document the various specific types of processing that you carry out, intended purpose for that processing, the data to be processed and what is the lawful basis for processing, and how these conditions for processing are supported. Expand and add to the fields in the following table as required to give appropriate level of detail.
Consent
In cases where you rely on consent as the lawful condition for processing, you should be able to demonstrate and describe how you have reviewed your processes and systems to make sure that consent is freely and unambiguously given for specific purposes, and that you can evidence an affirmative action on the part of the data subject to have indicated consent, and such that data subjects can reasonably understand who is using their personal information, what information, and for what purposes, and using which communications channels. Do your practices and systems incorporate a suitable audit trail which would enable you to demonstrate how and when consent was obtained, upon request? Do your practices and systems communicate an individual's right to withdraw consent at any time, and do your processes and systems support the functionality to do so?
Where 'soft opt-in' is used in as the lawful basis for processing for electronic communications (email/SMS/automated-telephone) contact, you should record the notification statement detailing the intended use of personal information given at the point of collecting personal information during the course of sale or negotiation for sale which gave the customer the opportunity to opt out, and also how subsequently notify the customer of their right to unsubscribe with every following communication.
Where 'legitimate interest' is the lawful condition for processing, evidence should be given of the process by which the rights and freedoms of the individual have been weighed against the interests of the company, and how consideration/mitigation of the outcomes of the process have been made. How has the individual been informed of this processing, and what information have they been given to help them exercise their rights?
Privacy Impact Assessments
PIAs (also known as Data Protection Impact Assessments, DPIAs) form an integral part of taking a privacy by design, best practice approach, and there are certain circumstances under which organizations must conduct PIAs. They are a tool which can help organizations identify the most effective way to comply with their data protection obligations and meet individuals' expectations of privacy, and protect against the risk of harm through use or misuse of personal information. An effective DPIA will allow organizations to identify and fix problems at an early stage, reducing the associated costs and damage to reputation which might otherwise occur.
PIAs undertaken by your company may be detailed here, or else referenced here and presented as an appendix to this data management policy document. The DPIA should contain:
A description of the processing operations and the purposes, including, where applicable, the legitimate interests pursued by the controller.
An assessment of the necessity and proportionality of the processing in relation to the purpose.
An assessment of the risks to individuals.
The measures in place to address risk, including security and to demonstrate that you comply.
A DPIA can address more than one project.
Data Sharing
In this section provide details of any/all Third Party organizations that [name of company] intends to share personal information with.
Where consent is the basis for sharing, describe how SoniaDane.com has obtained and recorded the necessary specific, clear, granular permissions for sharing data with NAMED third parties, for specifically defined uses, and in specified communications channels.
Where other lawful conditions for processing are relied upon for data sharing, these should also be described.
Details should be given as to when data sharing agreements, describing and ensuring the arrangements concerning the collection of the necessary permissions, defining the scope of the personal data to be shared – along with the meta-data that will enable the receiving party to be able to create an audit trail, sufficient to enable them to respond to any challenge as to why an individual's data has been processed, or to facilitate a data subject access request, and which details the security measures that will be put in place to protect the data in transit, and which establishes the shared understanding of the receiving organizations obligations as a data controller with responsibility for all aspects of the regulation as data controllers of the new copy of the data which is being shared with them.
Security measures
Here, describe the measures that are in place to protect the personal information that you store from breach.
Details should be documented here of the technical infrastructure considerations and measures put in place to leverage technology to require or ensure compliance, such as restricting and protecting access to the data to those people for whom it is necessary to perform the processing - such as measures like security software and firewalls, encryption, the use of secure Virtual Private Networks (VPN), log-in restricted access and two step authentications, etc.
The procedural and organizational policy measures, such as protocols for safe transfer of data in transit, and protocols for password management, and data back-up should also be detailed.
Describe also the measures in place to enable your organization to know if a data breach has taken place and what measures are in place to ensure that reporting of any breaches are reported to the ICO within the required timescales. You should also articulate the measures you have in place to ensure that any data to be deleted, is deleted securely and without further risk of breach.
Automated processing
Provide details of any automated processing or decision making undertaken by your company name, including profiling. You should describe the lawful condition for that processing, what the outcomes are, and that in a case where such processing leads to a significant legal or other effect on the individual, how you have weighed the outcomes of that processing against the rights and freedoms of the individuals. The process of weighing the organization's interest against the rights of the individual should always be transparently demonstrated. Privacy statements should include details of any automated processing, (including details of any third party profiling tools or datasets that are used to append information which will build a profile of individuals) and the outcomes of this processing, together with details of how individuals can exercise their right not to be subjected to such.
Subject access requests
All individuals who are the subject of data held by your company are entitled to:
Ask what information the company holds about them and why
Ask how to gain access to it
Be informed how to keep it up to date
Be informed how the company is meeting its data protection obligations
Details should be given here of the process by which SoniaDane.com will fulfill subject access requests and how individuals are notified of this process.
The right to be forgotten
In certain circumstances, subjects have the right to be deleted from your database.
Here, articulate your organization's policy and process for evaluating this right, and how you would comply technically with those cases where you will carry out the individual's right to be forgotten – what would be deleted and what data would be retained anonymously.
Privacy notices
SoniaDane.com aims to ensure that individuals are aware that their data is being processed, and that they understand:
Ongoing documentation of measures to ensure compliance
Meeting the obligations of the GDPR to ensure compliance will be an ongoing process. SoniaDane.com details here the ongoing measures implemented to:
Once you have completed your first draft of this document, it will need ongoing review whenever any changes occur to personnel, practices or policies, or technical infrastructure that impact any of the information given. A formal date for holistic review is given in section 1, but the document should be considered a dynamic articulation of the organizations data management policy which is under constant revision.