IMSL Data Protection Training Policy
Purpose
In order to achieve accreditation IMSL must have a data protection policy in place that conforms to the requirements of the accrediting body.
Roles and Responsibilities
Individuals:
- Contact IMSL to ask for a copy of the information contained in their personal data, if you wish
- Notify IMSL if any information we are holding on you is incorrect or incomplete
All IMSL employees, associates and contractors:
- Comply with the requirements of this policy
Data
IMSL are required to hold general personal information on learners which includes name, date of birth, equal opportunities information, the qualifications/units for which they are registered and assessment data relating to the student. Most of the information we process is provided to us directly by you. We also receive information from the government Learning Records Service.
Under GDPR, we have a legal obligation to process this information.
IMSL takes all steps to comply with the requirements of the Data Protection Act (2018) and GDPR or any legislation in a jurisdiction other than England which has an equivalent purpose or effect, including how individuals can obtain access to information held about them.
Data must be:
- fairly and lawfully processed
- processed for limited purposes
- adequate, relevant and not excessive
- accurate
- not kept longer than necessary
- processed in accordance with the data subject’s rights
- secure
- not transferred to countries without adequate protection
Under this Act we process any information that we receive in a lawful and fair manner. We will not disclose information to any third party unless:
- we are specifically required to do so by law
- in response to a valid, legal request by a law enforcement or governmental authority
- we need to share or send information to third parties who work with us or on our behalf
- we are authorised to do so in writing by the student
Security
IMSL will ensure that adequate safeguards are in place to keep information secure and ensure the right of the individual to privacy. We depend on the use and storage of information in the organisation, vital to the work we do and recognise that information handling represents a risk. We retain your information for 3 years following the completion of the course. Following this time, digital files will be deleted and hard copy files will be shredded.
Access to Data
Under the Data Protection Act 2018, individuals have right of access to a copy of the information contained in their personal data.
Under data protection law, you have rights including:
Your right of access - You have the right to ask us for copies of your personal information.
Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances.
Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
Requests should be made in writing to: Laura Bailey (Data Controller) and Jo Weston (Deputy Data Controller) at the below address.
IMSL will validate the authenticity of all requests before data is issued. If students believe that any information IMSL are holding is incorrect or incomplete, they should inform IMSL as soon as possible.
