Introduction
In compliance with the requirements of the General Data Protection Regulations and the Data Protection Act 2018, Story Contracting Ltd shall only collect, retain and process personal information on its employees with their express permission.
Aims
- Comply with General Data Protection Regulations and the Data Protection Act 2018
- Ensure data is collected, processed and stored correctly
- Reduce the risk of data breaches
Principles
Permission to Share: Information will not be disclosed to third parties (save those to whom we have a statutory duty to disclose) without the employee providing express written approval.
Comply with Data Protection: In all instances the principles of data protection shall be applied. Data shall be:
- Fairly and lawfully processed
- Processed for limited purposes
- Adequate, relevant and not excessive
- Accurate
- Not kept longer than necessary
- Retained and processed in accordance with the individual’s rights
- Secure
- Not transferred to countries without adequate protection
Sensitive Data: Sensitive Data as may be obtained under the Police Act 1997 shall only be requested after receiving explicit prior consent from the individual involved. Data of this nature will only be held by the People Team.
Data Access Request: We will only consider requests to access data made in writing to the company Data Controller. Valid requests shall be responded 40 days of receiving the request.
Information update: It is the responsibility of colleagues to inform the company if their personal information changes.
Raise awareness: Include information about data protection in our employee training and internal communications.
Compliance and standards: We adhere to relevant regulations, cross industry standards, industry specific standards, and best practice in health, safety and wellbeing management.
Policy Governance
The commitments of this policy are implemented through Story processes, supplemented by guidance and forms. Adherence to these is monitored through internal assurance process. The policy is reviewed annually.
