This is the “appropriate policy document” for Lattice Training Limited (“Lattice”) setting out how we will protect Special Categories of Personal Data.
This document meets the requirement of the Data Protection Act 2018 that an appropriate policy document be in place where Processing Special Categories of Personal Data in certain circumstances.
Controller: the person or organisation that determines when, why and how to Process Personal Data.
Data Privacy Impact Assessment (DPIA): tools and assessments used to identify and reduce risks of a data processing activity. A DPIA can be carried out as part of Privacy by Design and should be conducted for all major system or business change programmes involving the Processing of Personal Data.
Data Retention Policy: explains how the organisation classifies and manages the retention and disposal of its information.
Data Subject: a living, identified or identifiable individual about whom we hold Personal Data. Data Subjects may be nationals or residents of any country and may have legal rights regarding their Personal Data.
DPA 2018: the Data Protection Act 2018.
Data Protection Officer (DPO): the person required to be appointed in specific circumstances under the GDPR. Where a mandatory DPO has not been appointed, this term means a data protection manager or other voluntary appointment of a DPO or refers to the organisation’s data privacy team with responsibility for data protection compliance.
GDPR: the UK General Data Protection Regulation.
Personal Data: any information identifying a Data Subject or information relating to a Data Subject that we can identify (directly or indirectly) from that data alone or in combination with other identifiers we possess or can reasonably possess. Personal Data includes Special Categories of Personal Data.
Processing or Process: any activity that involves the use of Personal Data. It includes obtaining, recording or holding the data, or carrying out any operation or set of operations on the data including organising, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transmitting or transferring Personal Data to third parties.
Special Categories of Personal Data: information revealing racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health conditions, sexual life, sexual orientation, biometric or genetic data.
We process Special Categories of Personal Data for the following purposes:
The GDPR requires personal data to be processed in accordance with the six principles set out in Article 5(1). Article 5(2) requires controllers to be able to demonstrate compliance with Article 5(1).
We comply with the principles relating to Processing of Personal Data set out in the GDPR which require Personal Data to be:
We are responsible for and must be able to demonstrate compliance with the data protection principles listed above (Accountability).
Personal Data must be processed lawfully, fairly and in a transparent manner in relation to the Data Subject.
We will only Process Personal Data fairly and lawfully and for specified purposes. The GDPR restricts our actions regarding Personal Data to specified lawful purposes. We can Process Special Categories of Personal Data only if we have a legal ground for Processing and one of the specific Processing conditions relating to Special Categories of Personal Data applies. We will identify and document the legal ground and specific Processing condition relied on for each Processing activity.
|Lawful processing basis||Processing condition for special categories of personal data|
|Data concerning health & gender identity Compliance with a legal obligation (Article 6 (1)(c)) or necessary for the performance of a contract with the Data Subject (Article 6(1)(b)).||Explicit consent of the Data Subject (Article 9(2)(a) GDPR)|
Personal Data must be collected only for specified, explicit and legitimate purposes. They must not be further Processed in any manner incompatible with those purposes.
Personal Data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.
We will only collect or disclose the minimum Personal Data required for the purpose for which the data is collected or disclosed. We will ensure that we do not collect excessive data and that the Personal Data collected is adequate and relevant for the intended purposes.
Personal Data must be accurate and, where necessary, kept up to date. It must be corrected or deleted without delay when inaccurate.
We will ensure that the Personal Data we hold and use is accurate, complete, kept up to date and relevant to the purpose for which it is collected by us. We check the accuracy of any Personal Data at the point of collection and at regular intervals afterwards. We take all reasonable steps to destroy or amend inaccurate or out-of-date Personal Data.
We only keep Personal Data in an identifiable form for as long as is necessary for the purposes for which it was collected, or where we have a legal obligation to do so. Once we no longer need Personal Data it shall be deleted or rendered permanently anonymous.
Personal Data shall be Processed in a manner that ensures appropriate security of the Personal Data, including protection against unauthorised or unlawful Processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
We will implement and maintain reasonable and appropriate security measures against unlawful or unauthorised Processing of Personal Data and against the accidental loss of or damage to Personal Data.
We are responsible for, and able to demonstrate compliance with these principles. Our DPO is responsible for ensuring that we are compliant with these principles. Any questions about this policy should be submitted to the DPO.
We take the security of Special Categories of Personal Data very seriously. We have administrative, physical and technical safeguards in place to protect Personal Data against unlawful or unauthorised Processing, or accidental loss or damage. We will ensure, where Special Categories of Personal Data are Processed that:
This policy on Processing Special Categories of Personal Data is reviewed annually.
The policy will be retained where we process Special Categories of Personal Data and for a period of at least six months after we stop carrying out such processing.
A copy of this policy will be provided to the Information Commissioner on request and free of charge.
For further information about our compliance with data protection law, please contact our DPO [email protected], Unit 11 Eastside Rd, Clarencefield, Chesterfield S41 9AT.