FAQ

The Information Commissioners Office (ICO) is the independent regulator set up to support data protection and enforce data protection laws in the UK. In the case of a breach of security of personal data it is the organisation’s legal responsibility to report the breach to the ICO.

Data controllers and data processors

The terms ‘data controller’ and ‘data processor’ are related to the organisation or individual who is processing data and the level of responsibility they are subject to.

• Data Controller: A data controller is the decision maker around how and why data is collected and used. This will generally be an organisation.
• Data Processor: A data processor acts upon instruction from a data controller. Generally individuals within organisations are data processors.

The first step is to carry out an information audit to find out what personal data your organisation holds and where it is. You should then know:

• What kind of data do you process? For example do you process special category data that requires a high level of security?
• Who processes that data? - Who within your organisation processes and has access to data. Are they aware of their responsibilities? Do they need training? How do you keep data safe? What systems do you use? If you keep information internally then is the information kept somewhere secure. If you use electronic systems what are their security arrangements? • How do you process consent? Are people aware of what information you collect about them and do they give their consent for you to do this?
• Why are you collecting that data? What is the purpose for collection? If this is understood then it will be possible to identify the lawful basis for collecting data. This may require the consideration of a legitimate interests assessment.

A personal data breach refers to a breach of security that has led to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

Example: A list of client details is accidentally attached to an email.

An organisation needs to have processes in place that tell individuals what to do in the case of a personal data breach. This will depend on the severity of the breach and the kind of personal data that has been involved.

In the event of a data breach an organisation is required to assess the severity of the breach. The main concern is to assess the potential for any negative consequences that could happen for an individual as a result of the breach. This assessment should also take into consideration whether any special category data was involved in the breach. If a decision is made not to report the breach then this decision must be justifiable and documented.

If the organisation determines that the breach could cause potential negative consequences then there two actions they must take:

• Report the breach to the ICO within 72 hours of its occurrence.
• Inform individuals involved that their data has been compromised.

Failure to report a breach can result in a fine of up to £8.7 million or 2 per cent of the organisation’s global turnover.

Equality, equity, diversity and inclusion (often shortened to EEDI) is the term used for policies and practices to ensure fair treatment and opportunity.   The terms around EEDI are used in slightly different ways depending on context, but when putting together a policy these definitions are helpful to consider:

Equality means ensuring that people have equal opportunities. Organisations should ensure that people are treated fairly and are not treated less favourably because of their protected characteristics.

Equity means ensuring people are not unfairly prevented from accessing resources or opportunities, and also that others do not benefit from unfair advantages. For example, an equitable approach to project planning would consider what changes might be needed to help people get equal outcomes from a project, service or process, and might mean - e.g. providing different opening hours, facilities or support for key groups of clients.

Diversity is about recognising and respecting differences. This can mean working with and including people with different protected characteristics, but can cover other factors like class background, nationality and working style. A diverse environment is one with a wide range of backgrounds, life experiences and mindsets.

Inclusion means creating an environment where everyone feels welcome and valued. An inclusive environment can only be created once issues of bias, prejudice and inequality are identified and actively challenged.