Completing the DSPT

Data Privacy Policy

Your data privacy policy is an overarching document which sets out how you collect personal data, what it is used for and how long it is retained. It must also stipulate how individuals can view or challenge the use of this data.  This policy must be easily accessible and produced on demand.  It may consist of several documents or a single document. Most organisations publish this on their website (often as a permanent link in the page  footer) it may also be included in your service user contracts.  There are many standard templates available that are GDPR compliant.

You can see the associations privacy policy at https://www.wmca.care/privacy. You will need to state that you have a policy and specify where it is held.

Staff Data Policy

Staff must be aware of the safe and secure use of data and their individual responsibilities pertaining to its use and access.  This should be included in your standard staff procedures and manuals. All staff must be made aware of your policies and their responsibilities on induction and reviewed regularly. You can see an example policy  here . You will need to state that you have a policy and specify where it is held.

Data Register

This is a list of all the data you hold, where it is held and whether or not this is shared with other organisations. The Data Register is made up of several different documents. It is entirely up to you if you maintain a single register or have them as separate documents. These are:

• Information Asset Register : This is a document including details of the type, location, software, owner, support and maintenance arrangements, quantity of data and how critical they are to the organisation. You will need to state that you have a policy and specify where it is held.
• Retention Register. A document stating how long data is held and when it is due for destruction/disposal
• List of Suppliers and any data sharing arrangements (if applicable) : You must be able to provide a list of your current suppliers with whom you share data or who process personal data of your service users or staff. It must also include the nature of the data processing and when the contract expires (e.g. outsourced payroll). If you do not have any such arrangements, you can state not applicable in the Toolkit. If you do, you will need to state that you have a register and specify where it is held.

At a future date we are going to produce a template spreadsheet which brings all these documents together.

Staff Bring Your Own Device Policy

If you allow staff to use their own phones/mobile devices you must have a policy outlining how this works and how it is managed. You do not need this policy if staff do not use their own devices.