GDPR Policy

Data Protection Policy (Personnel)

Name of governing body: Trustees of the Inniskillings Museum

 

Date on which this policy was approved by governing body: ­­­­­­­­­­20^th June 2024

 

Date on which this policy is due for review: ­­­­­­­­­­ June 2027

 

Purpose and scope of this policy statement:

• To protect the rights and obligations of those who share their personal data with the Inniskillings Museum.

 

Definition

Personal data means data held either on a computer or in a paper-based filing system which relates to a living individual who can be identified from that data.

As an employee, you need to be aware that the Inniskillings Museum will hold details pertinent to your employment on file as part of its personnel records.  This may include sensitive information.  This information may be processed for administrative or legal purposes or as required by your continued employment.  This may include passing certain employment related data to third parties such as government authorities, suppliers or contractor organisations supplying services which require the use of certain employee data (for example: Performance Annual Reviews to Regimental Headquarters The Royal Irish Regiment).  Your data may also be used in emergency situations, to protect the legal interests and other rights of the Inniskillings Museum or in other situations, where you have consented to the disclosure of such information.

 

Data Protection Act 1998

The Data Protection Act defines the legal responsibilities of data users such as ourselves.  The Act governs the collection, storage, use and transfer of personal data, for example, name, address, e-mail, age, etc.

The Inniskillings Museum will endeavour to update employee, client or visitor files on a regular basis.  It is your responsibility to ensure that any changes in personal details are communicated in writing to the Inniskillings Museum immediately, or as soon after the change as is practicable; and to inform your next of kin (or whoever you give as a emergency contact) that their details may be held on a personnel file.

 

 

Privacy Statement

The Inniskillings Museum recognises the need to comply with the various laws regulating the processing of personal data. It is our desire that employees/contractors recognise the risks involved when dealing with such information and fully understand the steps that must be taken in order to minimise such risks. The Inniskillings Museum’s policy is to educate and inform employees/contractors about the dangers of inappropriate and illegal use of the personal data they may have access to.

Employees in this instance refers to paid staff, volunteers and Trustees.

 

Procedure

Examples of Data Held:

It should also be noted that the Inniskillings Museum might hold the following information about you, for which disclosure will be made only when strictly necessary for the purposes set out below:

 

Personal Data

The following list contains examples of information which may be retained by the Inniskillings Museum as part of its employee records.  The list is not exclusive or exhaustive:

• Unspent convictions to enable us to assess your suitability in employment for relevant roles;
• Recruitment details, including grade and job duties;
• Training records;
• Performance management, for records of career development;
• Disciplinary or grievance issues;
• Health, in compliance with our health and safety and our occupational health obligations;
• Reasonable adjustments required to assist you at work;
• Absence records, including holiday records and self-certification forms;
• Communication with Regimental Headquarters The Royal Irish Regiment;

• Contact names and addresses, including emergency contact/s.

 

Sensitive Personal Data

The following list contains examples of sensitive data.  The list is not exclusive or exhaustive:

• Racial or ethnic origin;
• Political opinions;
• Religious or similar beliefs;
• Trade union membership;
• Physical or mental health or condition;
• Sexual orientation;
• Committing or allegations of committing of any offence by you.

The Inniskillings Museum will process sensitive data primarily where it is necessary to enable the Inniskillings Museum to meet its legal obligations and in particular to ensure adherence to health and safety and vulnerable groups protection legislation or for equal opportunities monitoring purposes. In most cases, the Inniskillings Museum will not process sensitive personal data without your consent.

 

Handling Personal Data

Whenever you are involved in processing any personal data, you must ensure that all associated procedures have been sanctioned by your manager.  You must only operate within sanctioned procedures;

• If for any reason registration of the information us withdrawn you must stop using the particular data immediately. Your manager will advise you of this.
• You must ensure that your appropriate records are maintained and safe and are only used to perform your particular job.
• You must ensure that all personal data us used, held and disclosed only for the registered purpose: you should not use any of the systems outside of this criteria.
• Information must be collected and processed in a prudent and lawful manner and should be kept up to date at all times.
• Information must not be transferred to external organisations without authorisation from your Line Manager.
• Information must not be transferred to countries outside the UK without authorisation from your Line Manager.
• The information should only be retained for the period necessary, and for the purpose for which it is held.

If you have any concerns or questions regarding the processing or use of personal data, you should contact your manager as soon as possible.  If in any doubt, you should cease to process the information.

 

Accuracy of Personal Data

The Inniskillings Museum will review personal data regularly to ensure that it is accurate, relevant and up to date.

To ensure the Inniskillings Museum’s files are accurate and up to date, and so that the Museum is able to contact you or, in the case of an emergency, another designated person, you must notify the Inniskillings Museum as soon as possible of any change in your personal details (e.g. change of name, address, telephone number, loss of driving licence where relevant, next of kin details, etc.).

 

Security of Personal Data

If you are required to use electronic equipment such as a computer or data-holding device, your actions should comply with this policy and the ICT use policy. It is your responsibility to ensure that reasonable measures are taken to ensure the security of information contained within them. Such measures include keeping equipment in a lockable location when not in use and/or using password protection for files containing information covered by data protection legislation.

The Museum will ensure that personal data is not processed unlawfully, lost or damaged. If you have access to personal data during the course of your employment, you must also comply with this obligation. If you believe you have lost any personal data in the course of your work, you must report it to your manager immediately. Failure to do so may result in disciplinary action up to and including dismissal without notice.

 

Access to Personal Data [“Subject Access Requests”]

The Data Protection Act gives you the right to access the personal data held about you by the Museum. Upon receipt of a written request, the Museum will arrange for you to see or hear all personal data held about you within 40 days.

 

Reporting a Data Breach

A breach of the data protection regulations of failure to adhere to the Inniskillings Museum’s policies could have serious repercussions for the Inniskillings Museum and for yourself, if you are found responsible. It may also be treated as a serious disciplinary matter and may result in the termination of your employment.

The Museum will ensure that personal data is not processed unlawfully, lost or damaged. If you have access to personal data during the course of your employment, you must also comply with this obligation. If you believe you have lost any personal data in the course of your work, you must report it to your manager immediately. Failure to do so may result in disciplinary action up to and including dismissal without notice.

If you are aware of any breech of Data Protection, you must bring it to the attention of your Line Manager immediately.  Any failure to do this may result in disciplinary action against you, even if you are not responsible for the initial breach.

The organisation must report any Data Breaches to the Information Commissioner’s Office.  Guidance can be found online via the Information Commissioner’s Office’s website or this link:

UK GDPR data breach reporting (DPA 2018) | ICO

If you have access to or are responsible for collecting personal information that relates to any of the Inniskillings Museum’s clients, visitors or employees, the above guidance should be strictly adhered to.

 

Communicating and Reviewing the Policy

The Inniskillings Museum will make staff, volunteers and participants aware of the Data Protection Policy through the following means:

• The policy will be permanently held on the museum website and on a shared drive for staff and volunteers.
• During specific group activity, participants will be made aware of the policy and how to access it online, or accessible copies can be requested.

The Senior Manager (or Chair) will keep the Trustee Board informed of the number and nature data breaches.  They will report to the Board on this at least annually.

This policy will be reviewed when there are changes in legislation, by the Senior Manager annually, and the Board of Trustees every 3 years.