Carmel Caterpillars Preschool

Carmel Caterpillars Pre-School

General Data Protection Regulation Policy (2018)

The General Data Protection Regulation (GDPR) is a new EU law that comes into effect on the 25th May 2018. It replaces the current Data Protection Act (1998)

Principles

GDPR condenses the Data Protection Principles into 6 areas which are referred to as the Privacy Principles. They are:

1. You must have a lawful reason for collecting personal data, and must do it in a fair and transparent way. 
2. You must only use the data for the reason it is initially obtained. 
3. You must not collect any more data than is necessary.
4. It has to be accurate and there must be mechanisms in place to keep it up to date. 
5. You can not keep it any longer than needed. 
6. You must protect the personal data. 

These privacy principles are supported by a further principle - accountability i.e to show that all correct measures are in place to demonstrate how compliance is achieved. 

Privacy notices

Any data collected will only be used for the reason it was obtained and will not be kept any longer than is needed ( please refer to our record keeping policy and procedure). 

This information will only be shared within the setting by relevant members of staff, on a need to know basis. 

Only relevant information will be shared with outside agencies if and when appropriate, and with your permission. 

As parents you have the right to withdraw your consent for information to be held on your child, however, this will have an impact on your child remaining at Carmel Caterpillars Pre-School. 

You have a right to lodge a complaint with the Information Commissioners Office ( ICO). 

Individual Rights

Carmel Caterpillars Pre-School will ensure that mechanisms are in place to allow individuals to exercise these rights. These include:

• Informing you as to what data we are collecting and what that data will be used for. 
• Allowing you to see the data after we have collected it. 
• We will make any changes if the data is incorrect. 
• We will not collect or process certain data if you do not want us to do so. 
• We will allow you to take data away if it is appropriate to do so.
• We will take in to account any objections to the data we hold and what we do with your data. 
• We will allow you to ask us not to make any automated decisions about the data you have given. 

Consent

All data collected is for legitimate reason, consent freely given, specific, informed and unambiguous for each purpose for which it has been processed. 

Data Processing

GDPR sets out the lawful basis for processing your personal data. This means your personal data can only be processed if one or more of the lawful conditions are met. For example: with regards to child safeguarding issues, it may be necessary to give your data to the relevant authorities, without your consent. 

Data Agreements

GDPR has placed an obligation on Carmel Caterpillars Pre-School to ensure that any arrangements we make with dad processors, are governed by written agreements. Carmel Caterpillars Pre-School will only use processors offering sufficient guarantees that processing will meet GDPR requirements.

New Projects

Carmel caterpillars Pre-School ensures that data protection is incorporated into the development phase of new projects and services. In certain circumstances risk assessment will be undertaken to ensure that appropriate measures are in place to keep personal data secure. 

Breach notification

GDPR introduces an obligation to notify the Information Commissioner's Office (ICO) of a data breach within 72 hours of becoming aware of the breach. if it is a high risk to the individual, for example, if the type of data compromised could lead to identity theft and fraud, then we will also notify the individuals concerned. 

Fines

Carmel Caterpillars Pre-School is aware that fines are in place should we not handle people's data appropriately. 

The original of this document was signed on behalf of Carmel caterpillars Pre-School Committee by the current Chairperson