Data Protection Policy

Data Protection Policy 

Please click here to download the PDF.

Davidson Primary Academy is committed to safeguarding and promoting the welfare of children and young people and expects all staff and volunteers to share this commitment.

The Data Protection Act 1998 ensures a balance between an individual’s rights to privacy and the lawful processing of personal data undertaken by organisations in the course of their business. It aims to protect the rights of individuals about whom data is obtained, stored, processed or supplied and requires that organisations take appropriate security measures against unauthorised access, alteration, disclosure or destruction of personal data.

The Academy will protect and maintain a balance between Data Protection rights.
The following information is supplied pursuant to the Data Protection Act 1998, the Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations and reflects the Academy’s current practice. This policy does not form part of any individual’s terms and conditions of employment with the Academy and is not intended to have contractual effect.

However, all members of staff are expected to familiarise themselves with its content and comply with the provisions contained in it.

Processing Personal Data

What is personal data?

Personal data is information relating to an individual which is stored either electronically or as part of a structured manual filing system in such a way that it can be retrieved automatically by reference to the individual or criteria relating to that individual.

An individual about whom such information is stored is known as the Data Subject. It includes but is not limited to employees. The organisation storing and controlling such information (“the Academy”) is referred to as the Data Controller.

What is Sensitive Personal Data?

Data consisting of information concerning an individual Data Subject’s racial or ethnic origin, political or religious beliefs, trade union membership, physical and mental health, sexuality, commission or alleged commission of an offence or any proceedings in relation to the same is deemed to be Sensitive Personal Data.

What constitutes processing for the purposes of this Policy?

Processing data involves any operation including but not limited to: obtaining, recording or holding data or carrying out any operation on that data such as organisation, dissemination, erasure, alteration, or retrieval.

When can the Academy process Personal Data?

The Academy may only process a member of staff’s Personal Data if the Data Subject consents or if the processing is necessary for any of the following:

1. The performance of a contract to which the Data Subject is a party or for taking steps at their request to enter into a contract;
2. Compliance with any legal obligation (other than a contractual obligation) to which the Data Controller is subject;
3. To protect the vital interests of the Data Subject;
4. For the administration of justice or the exercise of any functions conferred on any person by or under any enactment; and
5. For the purposes of legitimate interests pursued by the Data Controller or by third parties to whom Data is disclosed provided it would not prejudice the rights and freedoms or legitimate interests of the Data Subject.

When may the Academy process Sensitive Personal Data?

The Academy may only process Sensitive Personal Data if, in the circumstances of the case:

1. We would be entitled to process Personal Data and
2. Either:
a) the Data Subject has given his or her explicit consent to processing; or
b) any of the following circumstances apply:
i) The processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed on the Academy by law in connection with the Data Subject’s employment. This may include, but is not limited to, dealing with sickness absence, dealing with disability and making adjustments for the same, arranging private health care insurance and providing contractual sick pay;
ii) The processing is necessary in relation to legal rights, advice or proceedings. This may include, but is not limited to, obtaining legal advice, establishing or exercising or defending legal rights or the conduct of any legal proceedings (including prospective legal proceedings);
iii) The processing is necessary to trace equality of opportunity between people of different racial or ethnic backgrounds.

The Academy will process staff’s Personal Data for legal, personnel, administrative and management purposes including, but not limited to, processing:

  • information about a member of staff’s physical or mental health or condition in order to monitor sick leave and take decisions as to their fitness for work;
  • the member of staff’s racial or ethnic origin or religious or similar beliefs, age and sexual orientation, political beliefs and sexual life in order to monitor compliance with equal opportunities legislation and carry out vetting and screening of applicants and current staff in accordance with regulatory and legislative requirements from time to time in force;
  • information relating to the commission or alleged commission of any criminal offence for insurance purposes and in order to comply with legal requirements and obligations to third parties;
  • information relating to any criminal proceedings in which the member of staff has been involved for insurance purposes and in order to comply with legal requirements and obligations to third parties; and
  • information relating to the any member of staff’s union membership for the purposes of administering collective or individual consultations, or managing any internal procedures at which staff have the right to be accompanied by a trade union representative.
Principles of Data Processing

The following principles shall apply whenever staff’s Sensitive Personal Data is handled or processed by the Academy:

  • The information to be obtained and processed will be obtained and processed fairly and lawfully;
  • No member of staff shall be knowingly deceived or misled as to the purposes for which the information has been obtained or processed;
  • The Academy shall wherever reasonably practicable advise the Data Subject of any information it intends to retain, the purpose of processing and any further information necessary for the processing of that data to be fair;
  • Information will only be obtained or processed for one or more specified and lawful purposes;
  • Information held on a Data Subject should be adequate, relevant and not excessive in relation to the specified purpose for which it has been obtained or processed;
  • Information shall be accurate and where necessary will be kept up to date;
  • No information will be kept for longer than is necessary to satisfy the purpose for which it was originally obtained or processed;
  • All information shall be subject to the access rights described below;
  • All information must be protected against unauthorised processing or damage. The level of security shall be appropriate to the nature of the data and the harm which could result from its misuse;
  • No information will be exported outside the EEA unless it is to a country where the rights of the Data Subject can be adequately protected.
Data Subject’s rights of access

A Data Subject has the right to be informed by the Academy of the following:

1. The fact that the Personal Data about him or her is being processed;
2. A description of the information that is being processed;
3. The purpose for which the information is being processed;
4. The recipients/class of recipients to whom that information is or may be disclosed;
5. Details of the Academy’s sources of information obtained;
6. In relation to any Personal Data processed for the purposes of evaluating matters in relation to the Data Subject that has constituted or is likely to constitute the sole basis for any decision significantly affecting him or her, to be informed of the logic of the Data Controller’s decision making. Such data may include, but is not limited to, performance at work, creditworthiness, reliability and conduct.

Any Data Subject who wishes to obtain the above information must notify the Academy in writing of his or her request. This is known as a Data Subject Access Request.

The request should in the first instance be sent to the Academy’s Bursar and must be accompanied by the prescribed fee. Under statutory provisions the Academy is entitled to charge a fee of up to £10 depending on the nature and scope of the request.

The Academy will endeavour to comply with a request as soon as is reasonably practicable. Please note that the Academy is not obliged to comply with a request in cases where it reasonably requires further information to establish the identity of the
requesting Data Subject or to locate the information that has been requested until that further information has been supplied.

Where compliance with any request made by the Data Subject would involve disclosing information concerning another individual who may be identified therein, the Academy may only comply with the request if the individual identified has consented.

A Data Subject’s right to prevent processing by the Academy

This qualified right applies if a member of staff believes that the Academy is processing either Personal Data or Sensitive Personal Data concerning him or her and the purpose or manner in which that information is being processed is either unwarranted or is causing or is likely to cause substantial damage or distress to him or her or any other individual.

In such circumstances, the member of staff may notify the Academy in writing at any time and require it at the end of such period as is reasonable in all the circumstances of the case to stop or not begin (as the case might be) processing that data or processing in a specified manner or for a specified purpose any personal data that relates to him or her.

The Academy will notify the member of staff within 21 days of receiving his or her request whether it has or intends to comply with the request or whether it considers the request unjustified and the extent (if at all) that the Academy is able to comply with it.

August 2015

To be reviewed August 2016

Translate »