Data protection impact assessment policy
Data protection policy
Yes, although you can only store people's Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. in a way that is compatible with your original purpose for collecting the data. This means that you must:
conduct a A process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a DPIA or privacy impact assessment. if appropriate, eg before introducing new technology as your storage solution or if you are required by law to do one (see Q&A 3);
only collect and keep Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. that is actually necessary for the purpose for which you are storing it (see Q&A 7);
make sure that any Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. you store is accurate and kept up-to-date where necessary (see Q&A 11);
not keep Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. for any longer than necessary (see Q&A 12); and
make sure that Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. is stored securely (see Q&A 18 and following).
You will need to have measures in place to comply with the above, including appropriate internal policies and training for your Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer.. You may be under a legal obligation to appoint a The area of law which deals with the way in which data can be handled. In a company: A legally defined term used to refer to the director, company secretary or managers of a company. Officers of a company have certain duties and responsibilities towards the company and can be held liable for company law breaches. (DPO), although most Small and Medium-sized Enterprises: Businesses which are small or medium sized in terms of their staff numbers, turnover or assets. will not need to. In any event, it is good practice to appoint someone to be in charge of The area of law which deals with the way in which data can be handled., not in a formal capacity as DPO, but rather as someone who has a reasonable knowledge about The area of law which deals with the way in which data can be handled. matters and can help you comply with the law. See Data protection officers and staff training for more information and how to check whether you need a formal DPO or not. It is particularly important that someone has oversight of setting appropriate Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measures and ensuring that these are updated on an ongoing basis.
Yes, it is important that you store information in such a way that you will be able to respond promptly to any An umbrella term for the different types of request that individuals can make to a business which has personal data about them, eg a request to delete or correct that data, or a request for a copy of it. (eg requests for erasure or correction of Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. or requests for copies of Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. from the individual concerned). Usually, you only have one month to respond to any such request. You should put in place appropriate organisational and technological systems to allow you to quickly isolate data that you hold on specific individuals (eg appropriate IT search functions). See Policies and procedures for dealing with data subject requests for full guidance on dealing with these requests and Data subject request policy for a template policy that your Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. can use when dealing with them.
If you store Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. for the purposes of your own business (ie you are a The person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers., not a A person or company which uses, stores or otherwise deals with personal data on instructions from someone else, eg a payroll provider is data processor for its clients of personal data about their staff.), you should consider whether you need to carry out a A process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a DPIA or privacy impact assessment. (Data protection impact assessment: A process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a privacy impact assessment.). It is recommended that you carry out a Data protection impact assessment: A process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a privacy impact assessment. before you first start storing Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. or if you are introducing new technologies to store data. It is a legal requirement to do a Data protection impact assessment: A process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a privacy impact assessment. in some circumstances, for example if your storing Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. is likely to result in a high risk to individuals, or if you intend to start storing Also known as special category data. Personal data which is particularly sensitive in terms of the impact it could have on the rights and freedoms of individuals. It includes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a person, data concerning health or data concerning a person's sex life or sexual orientation. on a large scale, eg health data.
The purpose of the Data protection impact assessment: A process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a privacy impact assessment. is to help ensure that you are storing data securely. You cannot treat it as a box-ticking exercise, and you must give proper consideration to making any Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. or safeguarding changes to your data storage systems that are suggested as a result of it. Failure to carry out a proper Data protection impact assessment: A process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a privacy impact assessment. when required to do so can result in a significant fine of up to £8.7 million or 2% of your global The amount of money taken by a business, before deductions (eg expenses, tax etc). (whichever is higher). If in doubt, it is better to carry out a Data protection impact assessment: A process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a privacy impact assessment. than not.
See Data protection impact assessments for how to carry out a Data protection impact assessment: A process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a privacy impact assessment.. See Data Protection impact assessment policy for an internal policy that you can adapt for your own use, including the Information Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals.'s suggested template form for carrying out a Data protection impact assessment: A process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a privacy impact assessment..
See also Q&A 4 for guidance on reviewing The area of law which deals with the way in which data can be handled. impact assessments.
As best practice, your Data protection impact assessment: A process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a privacy impact assessment. should be reviewed and updated on a regular basis, and in particular when you introduce new IT systems for storing your data. See Q&A 18 and following for more information about Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. steps you can take when storing Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual..
See Q&A 5 for information on DPIAs when using a A person who is not directly involved in an existing relationship, transaction or dispute; for example, someone who is not a named party in a contract. to store the Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual., and Q&A 6 on what to do if your Data protection impact assessment: A process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a privacy impact assessment. indicates that storage poses a significant risk.
Yes. If you are planning on using a A person who is not directly involved in an existing relationship, transaction or dispute; for example, someone who is not a named party in a contract. to store the Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. held by your business (eg a cloud service provider), you should seek their assistance when carrying out your Data protection impact assessment: A process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a privacy impact assessment.. At the very least you will need information about their Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measures and what will happen to the data at the end of the storage period.
See Data Protection impact assessment policy for an internal policy that you can adapt for your own use, including the Information Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals.'s suggested template form for carrying out a Data protection impact assessment: A process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a privacy impact assessment..
See Q&A 24 for more information on using a A person who is not directly involved in an existing relationship, transaction or dispute; for example, someone who is not a named party in a contract. to store the Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. held by your business.
If your Data protection impact assessment: A process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a privacy impact assessment. indicates that your storage of Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. would pose a significant risk to the rights and freedoms of individuals concerned and you do not think that you will be able to reduce that risk by reasonable means (eg the cost of using available Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. technology is too high), then you must consult the Information Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals. before you begin storing the data.
For example, storing large quantities of bank account and identification details is likely to pose a significant risk, because the consequences to the individuals concerned of a data Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. A violation of a legal or moral obligation. could be very serious. You must reduce the risk, for example by storing the data electronically with encryption, having controls on who can access it, and creating secure back ups. If you cannot take these sorts of steps, you must consult with the Information Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals..
You must only store Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. that is necessary for the purpose you collected it, and then only for as long as you need it for that purpose (see Q&A 12 for more information about how long you can store Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual.).
You cannot just simply change the purpose for which you are storing Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual.. You can only keep it for a new purpose if it is compatible with your original purpose. For example, you receive Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. provided as part of a sales contract. You could not store this data to later use for a marketing campaign unless the customer has consented to their data being used in that way. You are, however, permitted to use the information for purely statistical purposes without having to get further consent, in which case you should consider anonymising the data once the original purpose for you storing it has expired.
To ensure that you are only holding necessary Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual.:
do not hold irrelevant details. See Q&A 8 for further information;
keep the data you are storing under review. See Q&A 9 for further information; and
consider whether you can store the data in a way that means you cannot identify the person to whom it relates. See Q&A 10 for further information.
Once the data you are holding about an individual is no longer needed for the purpose for which it is being stored, the individual concerned has the right to have that data erased without delay. See Requests to delete data for more information about how to respond to requests to erase Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. and Checklist for responding to a request to delete data for a checklist to help you comply with your legal obligations when doing so.
No. You should not collect Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. from individuals that you do not need and you should delete or anonymise any data that you no longer need. This is because you must only store Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. that is necessary for the purpose you collected it (see Q&A 7).
For example, if you run a chain of restaurants and a customer provides their address to find out where their nearest restaurant is, you only need to collect their postcode for this purpose and will not need to retain this information once you have responded to their query.
If you need to hold particular information about certain individuals, you should collect and store it for those individuals only. This is particularly important in respect of Also known as special category data. Personal data which is particularly sensitive in terms of the impact it could have on the rights and freedoms of individuals. It includes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a person, data concerning health or data concerning a person's sex life or sexual orientation.. For example, if you need to obtain specific health information about some of your Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. because of the nature of the work they do (eg manual labour), you should not seek to obtain this information from all of your Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. as this would be irrelevant for any An individual hired personally to work under a contract of employment, usually in exchange for payment. Employees are normally fully integrated into the business and the employer exercises a large degree of control over their work. who works in an office.
See Q&A 7 for a full list of considerations when storing data to make sure you only store data that is necessary and you comply with your legal obligations.
Yes, you must keep the Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. you are storing under review to check whether you still need it for the purpose(s) for which it was collected (see Q&A 12 for more information about how long you can keep data). If you have Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. you no longer need, you must delete or anonymise it. This should be done in line with your data retention and disposal policies (see Q&A 16 for more information about how to delete data securely and Data protection policy for a template The area of law which deals with the way in which data can be handled. policy you can adapt for your business, which you can also create as part of our template Staff handbook and policies).
See Q&A 7 for a full list of considerations when storing data to make sure you only store data that is necessary and you comply with your legal obligations.
If you want to store Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. for the purposes of your own business (ie you are a The person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers., not a A person or company which uses, stores or otherwise deals with personal data on instructions from someone else, eg a payroll provider is data processor for its clients of personal data about their staff.), you must ensure that Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. is not kept for longer than necessary in a form which allows for people to be identified. You could, for example, anonymise data or use pseudonyms to help you to store it more securely.
Anonymisation
Consider whether you should anonymise certain categories of data (eg data that you are only keeping for purely statistical purposes, such as analytics on your monthly sales). Once you cannot identify the person to which the information relates, even when combined with any other information you have, the anonymised data no longer falls under The area of law which deals with the way in which data can be handled. law. It can be very difficult in practice to determine whether data has been fully and irreversibly anonymised, so you must take care with how you go about it.
Pseudonymisation
Pseudonymisation means keeping Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. in a form in which the individual can no longer be identified without the use of additional information, kept separately. Unlike completely anonymised data, pseudonymised data can still ultimately be traced back to identify the individual, therefore it still falls within the scope of The area of law which deals with the way in which data can be handled. law. It is a useful Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measure, helping to limit the damage caused in the event that your Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measures are compromised (see Q&A 26 for more information about what to do if your Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measures are compromised).
There are several different technical approaches to pseudonymisation (eg hashing) which are outside the scope of this service, but any technique that you use must be considered on a case-by-case basis for the type of data concerned.
See Q&A 7 for a full list of considerations when storing data to make sure you only store data that is necessary and you comply with your legal obligations.
If you want to store Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. for the purposes of your own business you must ensure it is kept up to date where necessary, or deleted if inaccurate.
In practice, this means you should correct any inaccuracies that are brought to your attention and review your records periodically to ensure that they are kept up to date. You should also delete data if appropriate.
To ensure the Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. you are storing is accurate you must:
Keep your records up to date
Whether you need to keep Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. that you are storing up to date depends on why you are keeping it. If you need it to be current (eg Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. bank details for payroll or customer address details for deliveries), you should obviously update it promptly. In most cases it will be clear whether it is appropriate to wait for the individual concerned to tell you about any changes to their Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. or not, eg you should wait for customers to tell you their new contact details in the event that they change, but it may be appropriate to check periodically with your Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. that the core personal details you hold about them are up to date.
Of course, any Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. that you keep as an historical record does not need to be updated.
Correct inaccuracies
If you find out that any Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. you are storing is inaccurate, you must take all reasonable steps either to rectify or delete it.
Individuals have the right to request that you rectify any inaccurate Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. that you hold about them. You must deal with any such request promptly, usually within one month of receipt. See Requests to correct inaccurate data for more information about how to respond and Checklist for responding to a request to correct data for a checklist to help you to comply with your legal obligations when doing so.
You must only store Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. for as long as it is necessary for the specific purpose(s) for which you collected it, or any related purpose.
For example, if your business has been conducting interviews for a new job, you should arrange for the interview notes to be destroyed after a fairly short period, as the purpose of them was to select a suitable candidate. The only other related use for the notes is to justify your hiring decision in the face of a potential claim for race or sex Treating someone differently directly or indirectly because of their age, disability, gender reassignment, marriage or civil partnership status, being pregnant and/or being on maternity leave, race, religion or belief, sex or sexual orientation. by an unsuccessful interviewee, which must be brought within three months. See Hiring staff for more information about your The area of law which deals with the way in which data can be handled. obligations when you are carrying out a recruitment process.
You are permitted to keep Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. indefinitely for statistical purposes after you have finished using it for its original purpose, although you must take appropriate steps to ensure that it is stored securely. Pseudonymisation is likely to be appropriate for some statistical Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. (see Q&A 10). You are also permitted to keep fully anonymised data indefinitely. As it cannot be traced to an identifiable person, once anonymised it does not qualify as Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. so is no longer protected by The area of law which deals with the way in which data can be handled. law (see Q&A 10).
Otherwise, there is no universal time period for which you are permitted to store Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual., so each category of Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. will need to be assessed on its own merits. In each case, you might consider:
how long the purpose for which you are collecting the Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. will apply (you are not permitted to hold Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. just in case you might need it for something else);
whether you might need to keep a record of an individual after your relationship ends, eg keeping data about customers who have bought Physical items being sold. Distinguished from digital content and services, neither of which are physical items. with a long (1) In the context of debt, a contract where someone agrees to pay if the debtor cannot pay themselves. (2) In the context of sale of goods, a promise to a customer which is given freely (without charging extra money) that the goods they are buying will meet certain standards, and if they do not the person making the promise will do something to make up for that (eg give a refund, or repair or replace the goods). period, or keeping basic information about former Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. in case you are asked for a reference;
whether you might need the data for any future legal action, eg complaints or claims about products or services you have provided;
if you need to retain certain categories of information for particular periods of time by law (eg Pay as you earn; the system of income tax collection used by employers. records must be kept for at least 3 years from the end of the financial year to which the records relate); and
any industry standards or guidance from any governing body relevant to your business.
Yes. You should keep your stated retention periods under review in case anything changes. When a data retention deadline that you have set passes, review whether or not you do still need the data, and act accordingly. If you do not need it any more, you should securely delete it, or anonymise it.
Yes. Your privacy policies, both for your Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. and for other people (eg customers or clients) should say how long you will keep each type of Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual., if possible. See Staff privacy notice for a template Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. A statement made by a business explaining what information it collects about individuals and how and why it will be used, stored and shared. (and Staff handbook and policies if you want to generate it as part of a full A staff handbook is a manual provided to employees by an employer which usually contains information about company policies and procedures.) and Privacy policy for a template A statement made by a business explaining what information it collects about individuals and how and why it will be used, stored and shared. for customers for use on your website.
Yes. An individual has the right to request that you erase all of their Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. in certain circumstances, eg if the Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. that you are holding about them is no longer necessary for the purpose you originally collected it, or if you are storing it on the basis of their consent and they withdraw that consent.
See Requests to delete data for more information about how to respond to requests for erasure of Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. and Checklist for responding to a request to delete data for a checklist to help you to comply with your obligations.
You may need to delete Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. you are storing if:
you have come to the end of the storage or retention period and it is no longer necessary for you to store the data;
the individual concerned has asked that it be deleted;
the Information Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals. or a court has instructed you to delete it; or
you are a A person or company which uses, stores or otherwise deals with personal data on instructions from someone else, eg a payroll provider is data processor for its clients of personal data about their staff. and the The person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers., at whose direction you are dealing with the data, has requested that you delete the data.
Whatever your reason for doing so, when you delete Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual., you need to ensure that this is done securely and in accordance with your The area of law which deals with the way in which data can be handled. obligations. You must keep a log when electronic Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. is erased, specifying that an item of data was erased on a stated date by a particular person. If your system was set up before 6 May 2016, you do not have to keep such a log until 6 May 2023 if it is a disproportionate effort to change your system to allow it.
Particular measures that you could take to ensure that erasure takes place securely include:
ensuring that hard copy Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. is shredded, either in-house or using a confidential shredding service;
ensuring that electronic Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. is permanently deleted rather than simply archived. If it is only archived, and can be retrieved, you will still be storing it for the purposes of The area of law which deals with the way in which data can be handled. law;
ensuring that copies of relevant Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. are also deleted from remote equipment, such as laptops and mobile phones;
ensuring that any back-up copies of the Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. that is being deleted are also erased; and
if someone is storing the data for you (eg a cloud provider - see Q&A 24), contact them to assist with the secure deletion of the information they hold.
If you have decided to make some Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. public and the person concerned requests that you delete it, you must take reasonable steps to inform anyone else who is using it about the request for deletion. What is reasonable will depend on the circumstances, but you must take into account available technology and the cost of any steps you could take. See Requests to delete data for more information about what to do if you get a request for erasure of Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. and Checklist for responding to a request to delete data for a checklist to help you to comply with your legal obligations.
Although it is likely that your business will be storing most of the Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. it has collected electronically (see Q&A 19 below), you may have some hard copy files containing Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. (for example you may have hard copy personnel files about your Individuals hired personally to work under contracts of employment, usually in exchange for payment. Employees are normally fully integrated into the business and the employer exercises a large degree of control over their work.). If this is the case, you will need to make sure that those files are physically secure by putting in place appropriate practical measures and training your Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. to use them. The full extent of Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. that will be necessary will depend on the type and volume of Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. that you are storing.
For example, you should:
make sure your business premises are physically secure and keep track of access given to anyone outside of your business, and consider the Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. implications of giving access;
as part of your The area of law which deals with the way in which data can be handled. and IT Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. policies, include procedures about Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. taking hard copy files off your premises (restricting this if practical) and train your Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. to appreciate the importance of The area of law which deals with the way in which data can be handled. and of carrying out any other internal data handling policies you have (see Data protection obligations for more information about The area of law which deals with the way in which data can be handled. policies and IT, communications and social media policy and Data protection policy for template policies you can use, which can be produced individually or as part of our template Staff handbook and policies);
use secure cabinets and make sure that only those who need to can access the files you are storing;
make sure that you have appropriate confidential waste bins and that all waste paper with Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. on it is shredded (see Q&A 16 for more information about how to dispose of Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. securely); and
think about whether it would be appropriate for you to store Also known as special category data. Personal data which is particularly sensitive in terms of the impact it could have on the rights and freedoms of individuals. It includes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a person, data concerning health or data concerning a person's sex life or sexual orientation. separately from other Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. to make sure that only those who strictly need to access it may do so.
You should test and evaluate the Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. of the measures you take regularly to protect Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. which you are storing, to make sure they remain sufficient for your purposes. Document the results of any testing and act on any shortcomings that are found.
The detail of the measures you should be taking will be heavily dependent on the nature of your business, any relevant industry standards and best practice guidance, what Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. you are storing and what format it takes. In the field of cybersecurity in particular, threats and solutions are always changing, so it is important to keep updating your cybersecurity measures, comprehensive treatment of which is outside the scope of the service. When determining what Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measures to put into place, you could consider the following:
the physical Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. of your equipment. See Q&A 20 for more information;
restricting access to Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual.. See Q&A 21 for more information;
using encryption. See Q&A 22 for more information; and
cybersecurity measures. See Q&A 23 for more information.
See Q&A 26 for what you should do if your Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measures are Violation of a legal or moral obligation. .
It is likely that your business will store much of the Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. it has collected in an electronic format. This could leave it exposed to Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. Violations of a legal or moral obligation. as a result of theft, loss or damage to physical equipment or attacks by malicious software, ransomware (which makes your data unusable until you pay a ransom) or phishing emails (fake emails sent to users asking for sensitive information or containing viruses).
It is important that you make sure that the equipment on which data is stored is physically secure, and the data itself is technologically secure. Train your Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. to appreciate the importance of The area of law which deals with the way in which data can be handled. and of carrying out any internal data handling policies you have (eg an IT Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. policy), including what to do about taking Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. offsite (eg on laptops, USB drives or phones). For template policies you can use setting out appropriate Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measures for your Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. to follow, use IT, communications and social media policy for a general IT policy and Bring your own device policy for a policy you can use where Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. use their own devices for work purposes.
You should test and evaluate the Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. of the measures you take to protect Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. which you are storing regularly, to make sure they remain sufficient for your purposes. Document the results of any testing and act on any shortcomings that are found.
Options for keeping the Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. your are storing electronically physically secure include:
if you have servers, storing them in a separate room which has additional Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. protection (eg a lock or access codes for entry);
ensuring that back-up or storage devices are kept securely, disconnected and locked away when not in use;
making sure that lost or stolen devices (eg smart phones) can be tracked, locked or wiped remotely (most devices include free web-based tools to do this); and
securely removing all Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. before disposing of old computers (by using software to do this or destroying the hard disk).
For template policies you can use to set out how your Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. should ensure the Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. of devices, see IT, communications and social media policy for a general policy and Bring your own device policy for a policy you can use when Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. are working on their own personal devices.
See Q&A 19 for more information on Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measures to take when storing Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. electronically.
You should restrict access to users and sources that you trust. You can do this in a variety of ways, for example:
use password protection on all equipment, giving each authorised user their own username and password and ensuring that your Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. are aware of the risks of disclosing their log-in details to their colleagues;
enforce strong passwords (with two (In finance) A financier who provides finance to a business by buying the business's debts under the terms of a factoring agreement. authentication where appropriate and practical), limit the number of failed login attempts and enforce regular password changes;
only allow authorised users to access, alter, disclose or destroy Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual., and cancel access rights as soon as a Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. member leaves your business;
if appropriate, store Also known as special category data. Personal data which is particularly sensitive in terms of the impact it could have on the rights and freedoms of individuals. It includes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a person, data concerning health or data concerning a person's sex life or sexual orientation. separately to ensure that only those who need to access it may do so;
only use A person appointed to manage the affairs and property of an insolvent company. accounts where strictly necessary (eg for installing known and trusted software) as attacks such as phishing can be far more damaging if access is gained to an A person appointed to manage the affairs and property of an insolvent company. account; and
do not allow untrusted devices to connect to your network and ensure that your Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. consider the risks of using work devices on untrusted networks, including the use of public Wi-Fi hotspots.
For template policies you can use to set out what Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measures your Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. must adhere to when storing Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. electronically, see IT, communications and social media policy for a general policy and Bring your own device policy for a policy you can use when your Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. members are working from their own devices.
See Q&A 19 for more information on Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measures to take when storing Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. electronically.
You should consider using encryption to ensure that Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. you are storing can only be accessed by authorised users who have the correct key to decode it (typically a strong password). Encryption could be particularly helpful to protect data that is being transferred from one device to another for storage (eg across an internet connection), data that is kept on a remote device (eg laptop or phone) which may be lost or stolen, or data which you are storing with a cloud service provider (see Q&A 24).
The level of encryption that you use will depend on the risks posed to the Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. stored by your business, but you should ensure that you have a clear encryption policy in place and that you have provided appropriate training to your Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer.. This should take into account any sector-specific guidance relevant to your business, and you should regularly review your policy and methods of encryption to ensure that is is providing an appropriate level of Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. .
See Q&A 19 for more information on Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measures to take when storing Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. electronically.
The Also known as the NCSC. An independent UK body providing support and guidance to the public sector, industry, SMEs and the general public on cyber security. (Also known as the National Cyber Security Centre. An independent UK body providing support and guidance to the public sector, industry, SMEs and the general public on cyber security.) estimates that half of all Small and Medium-sized Enterprises: Businesses which are small or medium sized in terms of their staff numbers, turnover or assets. have experienced a cyber Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. A violation of a legal or moral obligation. at some point. It is therefore important that you put in place measures to provide protection from cyber attacks which could compromise the Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. of the Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. you are storing.
The Also known as the National Cyber Security Centre. An independent UK body providing support and guidance to the public sector, industry, SMEs and the general public on cyber security. has a guide for small businesses which contains suggestions for improving cyber Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. within your organisation. Steps that you should consider taking include the following:
Back up your data
Make regular backups of the Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. that you store to ensure that it can be quickly restored in the event of natural disasters (eg fire or flood), theft or ransomware attacks (which make your data or systems unusable until you pay a ransom).
If practical, at least one of your back up copies should be kept off-site, or at the very least, separate from your network, and you should ensure there are strict Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measures in place. For example, you might consider restricting access to backups to certain individuals within your organisation. Consider using cloud services as a cost-effective and efficient way of backing up your files automatically (see Q&A 24 for more information about cloud services), but do not use cloud syncing services as your only backup.
Malware protection
Malware is malicious software or web content (eg viruses) that can harm your business by infecting your software. To prevent malware from The act of violating a legal or moral obligation.your data Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. , you should:
ensure that you have suitable, up to date anti-virus or anti-malware and anti-spyware software installed on all computers and laptops, and act upon any alerts that you receive;
switch on your boundary firewalls (most operating systems now include them);
switch on internet gateways to prevent your Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. from accessing websites or other online services that could be a Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. threat and prevent Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. from downloading apps or other products from unknown sources;
ensure that your computer equipment, software, mobile phones and apps are maintained and software is kept up to date, and remove unused software and services from your devices. In particular, you should install Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. updates as soon as they are available and use the most up-to-date versions of operating systems and apps;
consider restricting how USB drives and memory cards are used by your Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. to transfer files (eg by only permitting them to use approved drives on business devices); and
consider signing up to the Action Fraud Alert Service (this is a free service) to receive updates about cyber scams and fraud in your area.
Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. training
Train your Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. to:
recognise and deal with threats such as phishing emails and other malware (eg emails in relation to services you have not used with attachments containing malware, or emails containing poor grammar or from illegitimate email addresses)
use strong passwords (eg with a combination of letters, numbers and other characters) which are changed regularly. Note that the Also known as the National Cyber Security Centre. An independent UK body providing support and guidance to the public sector, industry, SMEs and the general public on cyber security. recommends using two-(In finance) A financier who provides finance to a business by buying the business's debts under the terms of a factoring agreement. authentication for important accounts where possible; and
understand what steps to take (eg who to report to) if they believe your business has been the victim of a cyber attack (see Q&A 26 for further guidance).
For template policies you can use to set Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. standards for your Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. to adhere to, see IT, communications and social media policy for a general policy and Bring your own device policy for a policy you can use when Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. members are working off their own devices.
Consider what additional steps will need to be taken if your Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. work remotely
When your Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. are working from home there may be additional cyber Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measures your business will need to take to address new vulnerabilities. See Staff working from home for further guidance.
Consider signing up to the Cyber Essentials certification scheme
If you want to reassure your clients or customers that you store their Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. in a secure environment, protected against cyber attacks, you could consider signing up to the United Kingdom of Great Britain and Northern Ireland government backed Cyber Essentials certification scheme.
See Q&A 19 for more information on Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measures to take when storing Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. electronically.
When you outsource storage of Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual., you must have in place a written contract with your storage provider (called a An agreement made between data controllers, to share personal data with each other, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data.), and you must ensure that the provider gives you (1) In the context of debt, contracts under which one person agrees to pay the debtor's debts if the debtor cannot pay themselves. (2) In the context of sale of goods, promises to a customer which are given freely (without charging extra money) that the goods they are buying will meet certain standards, and if they do not the person making the promise will do something to make up for that (eg give a refund, or repair or replace the goods). that their data storage is secure enough to meet your needs under The area of law which deals with the way in which data can be handled. law. Check any standard term contract that you are provided with to make sure it requires the storage provider to:
keep any Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. confidential;
take appropriate and proportionate Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measures when storing Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. for you;
only act on your instructions in respect of the Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. (unless they are under a legal requirement to do otherwise);
assist you (as far as possible) to comply with The area of law which deals with the way in which data can be handled. law, including helping you respond to any An umbrella term for the different types of request that individuals can make to a business which has personal data about them, eg a request to delete or correct that data, or a request for a copy of it. you receive (see Data subject requests in general for more information about how to deal with these); and
delete or return to you all of the Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. being stored on your behalf when the contract ends (unless they are legally obliged to keep a copy).
For more information about sharing Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. and Agreements made between data controllers, to share personal data with each other, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. see The rules about sharing personal data.
Hiring someone else to perform work which would otherwise have to be done by the business itself. your data storage (or other IT requirements) can be a highly cost effective storage solution. Many businesses choose to use cloud storage, including for Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual..
See Q&A 25 for information on the Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. risks associated with Hiring someone else to perform work which would otherwise have to be done by the business itself. data storage.
When Hiring someone else to perform work which would otherwise have to be done by the business itself. data storage, you must consider the additional Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. risks that sharing the data could present and assess the Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measures that the storage provider has in place to make sure that they are appropriate and adequately address the risks posed. In particular:
consider encrypting data before sending it to your storage provider to make sure that it can only be accessed by authorised users (see Q&A 19 for more information about encryption). Make sure you have access controls in place, especially for remote access to the cloud (eg two (In finance) A financier who provides finance to a business by buying the business's debts under the terms of a factoring agreement. authentication);
make sure that you know where the Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. is being stored by your storage provider. If the data will be stored outside of the United Kingdom of Great Britain and Northern Ireland, you must ensure that the country concerned has adequate The area of law which deals with the way in which data can be handled. safeguards or that you have other safeguards in place, such as suitable (1) In the context of debt, contracts under which one person agrees to pay the debtor's debts if the debtor cannot pay themselves. (2) In the context of sale of goods, promises to a customer which are given freely (without charging extra money) that the goods they are buying will meet certain standards, and if they do not the person making the promise will do something to make up for that (eg give a refund, or repair or replace the goods). in a contract between your business and the storage provider. See Sharing personal data outside the UK for how to go about checking this;
make sure that you are kept informed about any changes to your storage provider's Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. arrangements and keep your relationship with them under review;
consider putting in place an A thorough review or assessment of something. Often, an audit will inspect a business's accounts or the state of a business's premises. process that will alert you if there is any unauthorised access, deletion or modification of the Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. you are storing; and
check whether the storage provider adheres to any approved code of conduct or certification mechanism in respect of The area of law which deals with the way in which data can be handled..
Note that if you are using Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. at the direction of another business (ie you are a A person or company which uses, stores or otherwise deals with personal data on instructions from someone else, eg a payroll provider is data processor for its clients of personal data about their staff.), you must not outsource the storage of that Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. without prior authorisation from them.
For more information about your obligations when transferring Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. to a cloud storage provider or other A person who is not directly involved in an existing relationship, transaction or dispute; for example, someone who is not a named party in a contract., see The rules about sharing personal data.
See Q&A 24 for more on Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measures to take when Hiring someone else to perform work which would otherwise have to be done by the business itself. the storing of Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. to a A person who is not directly involved in an existing relationship, transaction or dispute; for example, someone who is not a named party in a contract..
If your Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measures have been weakened or compromised, you must assess immediately whether there has been a A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. . A A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. is when a problem with your Also known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. leads to Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. being lost, destroyed, changed, or accessed or disclosed without authorisation. Note that this covers a much wider range of events than having your system hacked or a Anybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. member's laptop being stolen. It also includes much less dramatic data Violations of a legal or moral obligation. such as if Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. is accidentally sent to the wrong person (eg in an incorrectly addressed email), or becomes inaccessible (eg if your storage system gets corrupted and you do not have a back up copy).
If you believe that a A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. may have occurred, it is vital that you are able to respond quickly and effectively. If the data was for use by your business and you were acting as a The person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers., you may have to notify the Information Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals. and/or any individuals affected. Failure to notify the Information Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals. when you are required to can result in a fine of up to £8.7 million or 2% of your The amount of money taken by a business, before deductions (eg expenses, tax etc)., whichever is highest.
You do not have to notify the Information Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals. of every A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. . You must notify them if the A violation of a legal or moral obligation. is likely to put the rights and freedoms of the people involved at risk. This requires you to consider every data A violation of a legal or moral obligation. in terms of the likely effects on individuals. For example, if a A set of data, stored and accessed electronically. containing customers' financial details is hacked, the potential impact on those customers is serious and it is reasonably likely that the details will be used or sold on to unscrupulous third parties, so the Information Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals. should be notified. You can call the Information Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals. on 0303 123 1113 if you think you might need to report a A violation of a legal or moral obligation. . Notification must be made within 72 hours of your becoming aware of it.
You may need to notify the individuals concerned if the A violation of a legal or moral obligation. is highly likely to put their rights and freedoms at risk – so a higher threshold than for reporting to the Information Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals.. Any such notification must be prompt, but is not subject to the 72 hour time limit for notifying the Information Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals..
In all cases, you should document your decision so that you can later justify it if needed.
If you think that your business may have been the victim of online fraud, scams or extortion, you should report this through the Action Fraud website. The Also known as the NCSC. An independent UK body providing support and guidance to the public sector, industry, SMEs and the general public on cyber security. (Also known as the National Cyber Security Centre. An independent UK body providing support and guidance to the public sector, industry, SMEs and the general public on cyber security.) has produced a 5-point action plan for small businesses to help them to respond and recover from cyber attacks.
For full guidance about how to respond to Any information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. Violations of a legal or moral obligation., see Obligations when a data breach occurs and for a summary of the steps you should take after you become aware of a data A violation of a legal or moral obligation. , see Checklist for responding to a data breach.