GDPR

General Data Protection Regulation

Partners in Advocacy deals with confidential and sensitive information under GDPR Principle ‘Legitimate Interest’. This means that we need some personal information in order to deliver our independent advocacy services. We store all such information legally and securely in accordance with GDPR as follows:

Principles of Data Protection

Partners in Advocacy will ensure that all personal data that it holds will be:

• processed lawfully, fairly and in a transparent manner
• collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes (purpose limitation)
• adequate, relevant and limited to what is necessary (data minimisation)
• accurate and kept up to date (data accuracy)
• kept in a form which permits identification of data subjects for no longer than is necessary (storage limitation)
• processed in a manner that ensures appropriate security of the personal data, including protection against accidental or unauthorised access to, or destruction, loss, use, modification, or disclosure of personal data (integrity and confidentiality)

Lawful, fair and transparent

To ensure processing of data is lawful, fair and transparent, Partners in Advocacy shall keep and maintain Data Audits to record where and why we process personal data. The Data Audits will be kept up to date and fully reviewed every year.

Data Audits will record our lawful bases (our reasons) for processing any personal data, this must be one of the following as required by legislation:

• consent
• contract,
• legal obligation,
• vital interests,
• public task
• legitimate interests

The way in which we process personal data is detailed within our privacy notice, which is freely available on our website www.pia.scot.  Our privacy notice will be kept up to date and fully reviewed every year.

Partners in Advocacy is fully committed to meeting the data protection principles of lawfulness, fairness and transparency, and legitimate interests.

Purpose limitation

Partners in Advocacy will be clear about what our purposes for processing data are from the start. We will record these purposes in our Data Audits and include details in our public privacy notice.

We will not use personal data for any other purpose unless this is compatible with our original purpose, we obtain consent, or we have a clear obligation or function set out in law.

Data minimisation

We will make sure that the personal data we are processing is:

• adequate – sufficient to properly fulfil our stated purpose;
• relevant – has a rational link to that purpose; and
• limited to what is necessary – we do not hold more than we need for that purpose.

Data accuracy

Partners in Advocacy will take all reasonable steps to ensure the personal data we hold is not incorrect or misleading as to any matter of fact.

We may need to keep the personal data updated, although this will depend on what we are using it for.

If we discover that personal data is incorrect or misleading, we will take reasonable steps to correct or erase it as soon as possible.

Storage limitation

Partners in Advocacy will not keep personal data for longer than we need it.

How long we keep personal data will depend on our purposes for holding the data. We have a separate Data Retention Policy which records how long we keep personal data for and how it will be erased, anonymised, or removed from our systems.

We may keep anonymised data for longer for public interest archiving, scientific or historical research, or for statistical purposes.

Integrity and confidentiality

Partners in Advocacy takes the security of personal data extremely seriously. We do this using a variety of technical and organisational security measures, including but not limited to:

• regular GDPR and cyber security training for trustees, staff and volunteers
• our cyber security policy covers technical measures such as passwords, two factor authentication, encryption, clarity on which systems must be used
• a named Data Protection Officer (DPO) to provide advice, support, training, resources, and updates on all aspects of Data Protection.
• Our security measures are regularly updated, tested and reviewed to make sure that we keep personal data secure and confidential.

Rights of individuals

Individuals have the right to access their personal data, and any such requests made to Partners in Advocacy shall be dealt with in line with legal requirements, with some limited exceptions.

The UK GDPR provides the following rights for individuals in relation to their personal data:

• the right to be informed – we do this by making sure our privacy notices are correct and up to date and direct individuals to these notices on our website pia.scot
• the right to access their own data – any subject access requests must be notified to our Data Protection Officer (DPO) who will co-ordinate a full search all of our systems before responding to the individual within 30 days, as required by law.
• rectification – we will quickly update any personal data which has been identified as inaccurate or incorrect.
• erasure – we will remove any personal data if an individual request this, unless we have another lawful basis which would prevent this e.g., we cannot delete employee records as we need to keep these to comply with employment legislation
• to restrict processing – where there is a dispute about the accuracy, validity or legality of personal data held by us, an individual has the right to require us to cease processing the data for a reasonable period of time to allow the dispute to be resolved.
• the right to data portability – we will provide an individual with their data in a common and machine-readable electronic format.
• the right to object – complaints or objections to processing personal data will be dealt with quickly and accurately.
• rights in relation to automated decision making and profiling – we do not carry out any automated decision making or profiling of any individual.

Privacy by design

• Privacy by design is an approach that promotes privacy and data protection compliance from the beginning.
• When relevant, and when it does not have a negative impact on an individual, privacy settings will be set to the most private by default.