MARKETING AND PROMOTIONAL MATERIALS

If sent via email, then there should be an “unsubscribe” facility and the business should keep a list of those who do unsubscribe so as not to send materials to that person again. If promotional materials are sent to someone new who has not been in contact with the business before, then you must employ an “opt in “system – i.e. request the person’s consent to send further materials in future. If a response is NOT received in these cases, then consent is NOT given and you cannot follow up on this at all. If you decide to try this marketing, I respectfully suggest that we work on the appropriate wording together to get the best results.

CLIENT QUESTIONNAIRE

There may be a questionnaire to be completed by clients when contracting Keira’s services. I recommend that the following text be considered in addition. It does not need to be in large or bold font, but must be legible: “All personal data/special category data submitted herein are processed in accordance with UK data protection legislation, including UK GDPR. All feasible security measures are in place. Further information is available on the website and/or just ask”

CLIENT AGREEMENT

If a Client Agreement is put in place, I recommend that the following text be considered for inclusion: “All personal data/special category data that may be collated by Keira Anderson during the term of this Agreement are processed in accordance with UK data protection legislation, including UK GDPR. Further information is available in the Privacy Notice on the website and/or from Keira.”

DATA RETENTION SCHEDULE

This document is new under “GDPR” and is now a legal The details mean that it can also be used to evidence that a “Data Audit “ has been conducted by the business owner – also a legal requirement. “Data Audit” is not a requirement for a new business. This is just so anyone who may need to access the records knows where to look for the information. This is a “living” document that can be built and amended over time. Think about how long you need to hold the data. You can legally hold any data that helps you to provide your services to a client, and/or if there is a legal time frame, such as accounts for the current year plus 6 years.

DATA BREACHES

The business is required to record any data breaches that occur. A Data Breach can be something as much human error as anything else – such as sending an email to incorrect addressee. I recommend that a spreadsheet be set up with the following columns as a base:

DATE NATURE OF BREACH NUMBER OF INDIVIDUALS AFFECTED

HIGH/LOW RISK ACTION TAKEN

Despite being a Sole Trader, it can still be useful to hold this document. I find it helps to focus the mind when sending emails etc.

ACCOUNTABILITY

Under the GDPR provisions, organisations are now required to keep an “Accountability” document within their administrative documentation. This document needs to contain certain elements and can be issued if required. To meet these requirements, I recommend that the text below is kept in a folder in the Business administration.

“ACCOUNTABILITY

Keira Anderson (me) is a hypnotherapist. I am based at Silverthorn, Canfield Road, Takeley CM22 6SZ. I can be contacted via this website, by phone, 07766551954 or via email, info@keiraandersonhypnotherapy.co.uk . I can also be found on Instagram and Facebook. I may process “personal data” and/or “special category personal data” (as defined in UK data protection legislation, including UK GDPR) as part of the contracted services and/or for administration. Information is kept while it remains relevant to the reason for collection and/or if there is a statutory retention period. All feasible security measures are in place, including secure destruction when required. Security of data in my care is important to me. Data may be shared with third parties as part of the contracted services, for administrative purposes and/or if I am required by law to do so. I cannot accept any liability for any processing conducted by any third party outside my remit. There is a data retention schedule in place. This will allow the Business to locate data quickly if required as well as documenting the Retention Policy for data. Data is separated and held in more than one place to provide security. There are technical security measures in place – encryption where necessary and restriction of access to data to maintain integrity and privacy. Data may be held electronically on local servers and/or a cloud-based system. The security of all systems utilised has been assessed.

Organisational measures such as the privacy notice and additional notices on forms are in place to demonstrate my transparency. Organisational measures are also in place to maintain integrity and security of data when working with third parties. Data may be held on paper on clients as well. It may be entered into the electronic system at some point and then destroyed securely. All destruction of data is by secure means. “

PROCEDURES FOR RESPONDING TO REQUEST FOR SUBJECT ACCESS

Any written request for personal information - by an individual (client or supplier) for their information – should be processed in accordance with data protection legislation. This document is designed to help you through the process. Once a request for personal information is received by the business, the time limit for responding starts! This is only 28 days under the 2018 legislation so it is important that the request is processed as soon as possible. The receipt should be acknowledged. Do you have enough information in the Request to identify the subject of the data to be found? Are you sure that the person making the request has the legal right to do so. You can ask for more information if you need it. Search through all systems ( manual or electronic) for information. Then go through all the documents to extract the personal information to be disclosed. Remember that expressions of opinion count. It is not about disclosing whole documents, but the relevant data within those documents.

THIRD PARTIES – any data about someone other than the data subject is a third party. You should seek the consent of a third party to disclose their data IF it cannot be deleted from the data without destroying the data itself. In most cases this should be possible. You are responsible for the information the Business holds so just make sure that the Response includes details of where you got the information from. You need to assess what is disclosable in each case.

RESPONSE

In the Response, you need to state that you are disclosing what is held and possible to disclose under the legislation. You can withhold anything given to you by the requester but offer a copy if they wish it. You can decide to include it but make sure the Requester is aware of what is the source of the data.

You should give the Requester the opportunity to request a review by the Business on what’s been disclosed if they think you haven’t released everything you should. They also have the right to go to the Information Commissioner’s Office as well and you should provide contact details for them.