Policy on the management of records and information

Records required for the protection of our service users and for the effective and efficient running of the company must be maintained, up-to-date and accurate. Service users have access to their records and information held about them as well as opportunities to help maintain their records. Individual records are kept in a secure fashion and are constructed, maintained and used in accordance with the Data Protection Act 2018 and other statutory requirements.

The company is registered with the ICO and all storage and processing of personal data held both in manual records or on computers within the company should comply with the regulations of the Act. The company understands that, according to the Data Protection Act 1998, personal data should:

Be obtained fairly and lawfully;
Be held for a specific and lawful purpose;
Be processed in accordance with the person’s rights under the DPA;
Be adequate, relevant and not excessive in relation to that purpose;
Be kept accurate and up-to-date;
Not be kept for longer than is necessary for its given purpose;
Be subject to appropriate safeguards against unauthorised use, loss or damage;
Be transferred outside the European Economic Area only if the recipient country has adequate data protection.

Relevant records are retained within the agency (either within agency premises or at a secure location offsite) for a period of eight years. Records are disposed of in accordance with relevant legislation.