We all understand that we need to be aware of the risks of data breaches (including loss of personal information and damage to personal information). We all understand that each of us plays our part in keeping personal information secure. We all understand and care about the policies and processes that have been put in place to protect personal information and we follow them.

We all:

understand and comply with our All Staff Privacy Pledge;

understand and comply with our Tech Use and Confidentiality Policy;

understand and comply with our Information Retention and Disposal Policy; and

understand what to do if we suspect that there has been a data breach.

We also all understand that compliance with this Promise 6 is easier to achieve if: we collect less personal information in the first place; we only share the minimal personal information we collect with people we can trust and control; and we correctly delete the personal information when we no longer need it. So we all:

collect less personal information;

only share personal information wisely; and

delete personal information properly when we no longer need it.

Our Privacy Hub Owner and our Privacy Champions are responsible for implementing technical and organisational measures that have regard to:

the state of the art (i.e security controls will be chosen based on a consensus of up to date professional opinions);

the costs of implementation (i.e security controls will be the output of good management decisions);

the nature of the personal information we are processing (eg. is it special category data?);

the scope of our processing (eg. the volume of personal information we are processing);

the context of our processing (eg. as part of employee performance monitoring); and

the purposes of our processing activities.

Our Privacy Hub Owner and our Privacy Champions will:

manage user privileges to limit access to personal information;

establish controls over removable media which we all understand and follow;

take steps to prevent malware infecting our systems and educate us all in what we can do to help;

train all staff in relation to personal information security management, the laws associated with it and the policies which we must all adhere to;

ensure that controls are in place to make sure that personal information is secure when we are in the office and out of the office;

ensure that our network security is regularly monitored and tested;

ensure that all our systems are securely configured and security patches promptly applied;

be responsible for putting measures in place to ensure personal information is processed in accordance with our Information Retention and Disposal Policy; and

ensure that our Vendors and Partners protect personal information at least as well as we do and only work with sub-processors with our consent.

If a data breach occurs we will follow our Internal Breach Reporting Procedure and Incident Response Plan, including notifying the ICO and/or any other relevant supervisory authority and affected individuals, if necessary under that plan. We know that notification must occur without undue delay and, where feasible, not later than 72 hours after becoming aware of it. We understand that a data breach is more than just a loss of personal information – it is a breach of security leading to the destruction, loss, alteration, unauthorised disclosure of, or access to personal information.