Data Protection Policy
1. Introduction
Remake Scotland is fully committed to complying with the UK GDPR and the Data Protection Act 2018.
This policy ensures that all employees, volunteers, trustees, and other stakeholders who access personal data held by or on behalf of Remake Scotland are fully aware of their responsibilities and act in accordance with the law.
We aim to ensure personal data is handled securely, transparently, and only for legitimate purposes.
2. Scope
This policy applies to all personal data held by Remake Scotland, including:
- Staff, volunteers, and trustees
- Members, clients, and customers
- Suppliers and partners
3. Key Roles and Responsibilities
| Role | Responsibilities |
|---|---|
| General Manager | Oversees compliance, advises staff, monitors GDPR adherence, reports to the Board |
| Board of Trustees | Ensure organisational accountability and support GDPR compliance |
| Managers / Team Leads | Ensure staff and volunteers follow the policy |
| Staff / Volunteers | Collect, use, and store personal data responsibly; report breaches immediately |
4. Definitions
- Personal Data: Any information relating to an identified or identifiable person (e.g., name, contact info, employment records).
- Special Category Data: Sensitive data requiring extra protection (e.g., health, ethnicity, religion, sexual orientation, trade union membership).
- Data Controller: The entity deciding why and how personal data is processed (Remake Scotland).
- Data Processor: Any person or organisation processing personal data on behalf of the controller.
- Processing: Any operation relating to personal data (collection, storage, sharing, or destruction).
5. Data Protection Principles
- 1. Process personal data lawfully, fairly, and transparently.
- 2. Collect data for specific, legitimate purposes.
- 3. Only collect adequate, relevant, and necessary data.
- 4. Keep data accurate and up to date.
- 5. Retain data only as long as necessary.
- 6. Ensure appropriate security against unauthorised access, loss, or damage.
- 7. Demonstrate compliance with these principles.
6. Lawful Bases for Processing Personal Data
All personal data processing must have a lawful basis under UK GDPR (Article 6).
| Lawful Basis | Examples at Remake Scotland |
|---|---|
| Consent | Member newsletter sign-ups, photo permissions |
| Contract | Employment contracts, volunteer agreements |
| Legal Obligation | Payroll, health & safety reporting |
| Vital Interests | Protecting someone’s life in an emergency |
| Public Task | Delivering funded projects, compliance reporting |
| Legitimate Interests | Sending non-intrusive updates about services |
It covers all formats: paper, electronic, and verbal data.
Special Category Data may only be processed if a specific condition applies, e.g., explicit consent, legal obligations, or funder requirements.
7. Purpose Limitation and Use of Data
Remake Scotland only uses personal data for purposes compatible with the original collection.
Examples of Data Use
| Data Subject | Purpose |
|---|---|
| Staff / Volunteers | Employment administration, training, safeguarding, fundraising reports |
| Members / Clients | Service delivery, communications, events, newsletters, research |
| Suppliers / Partners | Contract management, payment processing, project reporting |
Note: Any new purpose must be communicated to the individual, and the lawful basis recorded.
8. Data Security
We protect data using physical, digital, and organisational measures:
- Physical: Locked cabinets, restricted access.
- Digital: Password-protected files, encryption, secure cloud services, firewalls, antivirus software.
- Organisational: Staff training, references/PVG checks, role-based access.
Data Breach Management:
- Report all breaches immediately to the General Manager.
- High-risk breaches must be reported to the Information Commissioners Office ICO within 72 hours.
- Investigate, contain, and remediate breaches following the Data Breach Procedure.
9. Data Retention
Personal data will only be kept for as long as necessary. Retention is determined by:
- Legal and contractual requirements
- The purpose of processing
- Risk to the individual if data is retained unnecessarily
Retention Table
| Data Type | Retention Period |
|---|---|
| Staff / Volunteer records | 6 years post-employment |
| Financial records | 7 years |
| Member contact details | Until membership ends + 2 years |
| Funded project records | Funders’ retention period + 2 years |
| Special Category Data | Only as required, then securely anonymised or destroyed |
Destruction Methods:
- Paper: shredding
- Digital: secure deletion/wiping
10. Rights of Individuals
Individuals have the following rights under UK GDPR:
| Right | How to Exercise |
|---|---|
| Be informed | Privacy notices must be used; staff and volunteer guidance provided |
| Access | Submit a Subject Access Request (SAR) |
| Rectification | Contact the General Manager to update errors |
| Erasure | Request deletion where lawful |
| Restrict processing | Apply in specified circumstances |
| Data portability | Receive data in a structured, commonly used, and reusable format |
| Object | Opt out of marketing or legitimate interest processing |
Process: Individuals submit requests to the General Manager. Responses are provided within one month unless extended for complex requests.
11. Training and Awareness
- Mandatory GDPR and Data Protection training for all staff and for volunteers where relevant to their role.
- Bi-annual refresher training and updates for policy changes.
- New staff receive training during onboarding.
12. Monitoring and Review
- Internal audits to monitor GDPR compliance.
- Policy reviewed annually or following major legislative changes.
- Board approval required for all revisions.
13. Practical Guidance and Checklists
Before Collecting Data
- Identify purpose and lawful basis
- Only collect necessary information
- Inform individual how data will be used
Before Sharing Data
- Confirm recipient is authorised
- Share minimal information
- Use secure transmission methods
Before Deleting Data
- Check retention schedule
- Ensure secure destruction
14. References
15. Appendices
Appendix A: Special Category Data Conditions
- Explicit consent
- Employment and social security law obligations
- Vital interests
- Public health or research purposes
- Legal claims or rights enforcement