Personal data encompasses any type of information that relates to an identifiable individual. Various types of personal data Wellbeing Matters-Talking Therapies may collect, store and process could include:
The above list is by no means exhaustive and should be used merely as a point of reference from which a working definition of personal data can be established and further developed.
Sensitive personal data
Under GDPR, sensitive personal data is defined as encompassing any of the following:
It is paramount that all sensitive personal data is kept under stringent control as part of the implementation of our data security policy.
Purposes of personal data
Wellbeing Matters-Talking Therapies uses personal data for a range of various purposes. These purposes may include:
Please note the above list is by no means exhaustive and should merely be used as a reference point from which a working definition of purpose can be established.
Wellbeing Matters-Talking Therapies must carry out a range of functions and processes as part of our operational activity. Data kept in relation to these activities fall under the category of data for business purposes, which includes information of the following nature:
The above list is by no means exhaustive and should be used merely as a point of reference from which a working definition of business purposes can be established and further developed.
At Wellbeing Matters-Talking Therapies there will be occasions when employees will need to process personal data; however, processing activities must always be carried out in a fair and lawful manner that is compatible with the rights of each corresponding individual. Consequently, we should avoid processing the personal data of any individual who has not provided us with explicit consent.
Our company must strive to obtain explicit consent at all costs, and we must clearly identify to the individual what data is being processed, why we need to use it and who will have access to their data. These factors must be identified and clearly reiterated to the individual at the point of request for consent.
It’s worth noting there may be exceptional circumstances in which we are asked to process sensitive personal data without consent. An example of an exceptional circumstance could include legal obligations we may need to carry out to comply with health and safety regulations.
Wellbeing Matters-Talking Therapies endeavours to take all actions necessary to ensure that all personal data we obtain, process and store is accurate, relevant and adequate in relation to the reason in which we asked for that information. We should not hold excessive or irrelevant data on any individuals, and we will not process any personal data for a purpose unrelated to the purpose in which the relevant individual has consented to the processing of their data.
Our roles and responsibilities
Data security is a critical component of our business. It falls on everyone at Wellbeing Matters-Talking Therapies to take responsibility for data security, and all employees must familiarise themselves with our data security policy and do everything within their power to uphold that policy on a day-to-day basis.
Please note that Wellbeing Matters-Talking Therapies takes data protection incredibly seriously, and we expect all staff members to adhere to this data security policy. Any failure and refusal to comply with this policy could ultimately place our company at risk.
Bearing that in mind, personal non-compliance with this data security policy could lead to disciplinary action as they relate to ordinary personnel procedures. Please contact your line manager with any further questions concerning data protection at Wellbeing Matters-Talking Therapies.
As a staff member at Wellbeing Matters-Talking Therapies, you can expect to receive data protection training in line with our data security policy. All incoming employees will be provided training as an aspect of the wider staff induction process, and all staff members can anticipate the requirement to undergo additional training as a result of subsequent regulatory updates to GDPR or other relevant legislation as it relates to data security.
Data security will inevitably encompass a range of additional responsibilities for various roles within the company. These roles and their responsibilities include (but are not limited to):
Information technology plays a crucial role in the way our company operates. Any processes relating to IT and the processing and storage of data must be carefully monitored, assessed and guided by an IT Manager.
It is the responsibility of Wellbeing Matters-Talking Therapies IT Manager to:
A significant proportion of our marketing activities involve the collection, storage and processing of data. Consequently, our Marketing Manager must oversee the following responsibilities:
Our data security policies
Wellbeing Matters-Talking Therapies takes data security extremely seriously, and we place the rights of the individual and regulatory adherence at the heart of everything we do as a company.
Data storage policy
All information or data that is collected and processed is subject to all of the applicable requirements as outlined and documented within this policy. This includes information collected electronically, by paper, telephone or data collected through any other means.
Please note that Wellbeing Matters-Talking Therapies will carry out regular system audits to monitor and ensure ongoing compliance with this data security policy and all regulatory requirements as outlined under GDPR.
Data retention policy
While Wellbeing Matters-Talking Therapies must routinely collect and store data, we are committed to the rights of individuals. That’s why we retain all information and personal data for no longer than we need to.
The necessary length of retention will often be decided on a case-for-case basis, bearing in mind the rationale and original purpose surrounding data collection and retention. Decisions of this nature must be made in a way that is compatible with our existing data retention guidelines under GDPR.
For additional guidance, consult the following corresponding documents:
Data retention and erasure policy document
International data transfer policy
Employees must observe a series of restrictions that apply towards the international transfer of data or personal information. Employees are not permitted to transfer personal information or data outside of the United Kingdom without having obtained explicit permission in the first instance from the company’s Data Protection Officer.
Data encryption and anonymisation policy
Wellbeing Matters-Talking Therapies deploys encryption to secure and protect data that is stored on devices from unlawful processing or unauthorised access. Encryption is also used to protect information that is in transit.
We also use the anonymisation of personal data wherever deemed prudent to ensure the rights of the individual are fully protected and observed.
In line with these principles, we are committed to using both encryption and anonymisation as a risk management tool alongside existing systems, to protect the company from accidental loss, as well as from the damage or destruction of data or personal information.