1. Purpose and scope
This policy sets out how Obsavia meets its obligations as a controller and, where applicable, as a processor of personal data. It applies to every employee, contractor and officer of Obsavia and to every system and process in which personal data is handled.
This policy is the internal counterpart to the privacy policy. The privacy policy explains processing to individuals. This policy explains how the organisation is structured to deliver what the privacy policy states.
2. Data protection principles
Personal data is processed in accordance with the following principles.
- Lawfulness, fairness and transparency. Every processing activity has an identified legal basis and is explained to the individual.
- Purpose limitation. Personal data is collected for specified and legitimate purposes and is not further processed in a manner incompatible with those purposes.
- Data minimisation. Only data that is adequate, relevant and limited to what is necessary is collected.
- Accuracy. Personal data is kept accurate and, where necessary, up to date, and inaccurate data is corrected without delay.
- Storage limitation. Personal data is kept in a form that permits identification no longer than is necessary.
- Integrity and confidentiality. Personal data is processed with appropriate security.
- Accountability. Obsavia is responsible for compliance with these principles and is able to demonstrate that compliance.
3. Roles and responsibilities
Responsibility for data protection is allocated as follows.
| Role | Responsibility |
|---|---|
| Board | Approves this policy, receives reporting on data protection risk and allocates resources. |
| Data protection officer or responsible officer | Advises on obligations, monitors compliance, acts as the point of contact for supervisory authorities and for individuals, and reports to the board. |
| Compliance | Operates screening and monitoring within the limits of this policy and handles authority requests. |
| Engineering | Implements technical measures, maintains access control and supports data subject requests. |
| Every member of staff | Follows this policy, completes training and reports a suspected breach immediately. |
4. Record of processing activities
A record of processing activities is maintained. For each activity the record states the purpose, the categories of data subject and personal data, the categories of recipient, transfers outside the country of collection and the safeguard relied on, the retention period and a general description of the security measures applied.
The record is reviewed at least annually and whenever a new processing activity is introduced or an existing activity changes materially.
5. Data protection impact assessments
An impact assessment is carried out before processing that is likely to result in a high risk to the rights and freedoms of individuals. This includes systematic monitoring on a large scale, the processing of biometric data for unique identification and the use of new technology in a way that changes the risk profile.
An assessment describes the processing, assesses necessity and proportionality, identifies risks and sets out the measures adopted to address them. Where a residual high risk remains, the supervisory authority is consulted before processing begins.
6. Data protection by design and by default
Data protection requirements are considered at the design stage of a system or a process and not after it is built. By default only the personal data necessary for a specific purpose is processed, access is restricted to those who need it and retention is configured to expire.
A change that introduces a new category of personal data, a new recipient or a new transfer requires review before release.
7. Processors and sub processors
A processor is engaged only where it provides sufficient guarantees of appropriate technical and organisational measures. Due diligence is carried out before engagement and repeated periodically.
Every engagement is governed by a written contract requiring the processor to act only on documented instructions, to impose confidentiality on its personnel, to apply appropriate security, to assist with data subject requests and breach notification, to obtain authorisation before engaging a sub processor, and to delete or return personal data at the end of the engagement.
8. Handling requests from individuals
A request to exercise a right is logged on receipt and acknowledged. Identity is verified before any personal data is disclosed. The request is answered within one month, extendable by two further months where the request is complex, and the individual is told of any extension within the first month.
Where a request is refused in whole or in part, the individual is told the reason, is told of the right to complain to a supervisory authority and is told of the right to a judicial remedy.
9. Personal data breach
A suspected breach must be reported internally without delay to the responsible officer. The response follows four stages.
- Contain. Stop the breach and limit further exposure.
- Assess. Establish the categories and approximate number of individuals and records affected, the likely consequences and the risk to rights and freedoms.
- Notify. Where the breach is likely to result in a risk, notify the supervisory authority without undue delay and where feasible within seventy two hours of becoming aware. Where the risk is high, notify the individuals affected without undue delay.
- Record and remediate. Record the facts, the effects and the action taken, and address the root cause.
10. International transfers
A transfer to a country that has not been recognised as providing an adequate level of protection is made only under a lawful transfer mechanism supported by a transfer risk assessment that considers the law and practice of the destination country and any supplementary measures required.
11. Training and awareness
Every member of staff completes data protection training on joining and at least annually thereafter. Staff in roles with elevated access complete additional training appropriate to the role. Completion is recorded.
12. Monitoring and audit
Compliance with this policy is monitored through periodic review of the record of processing activities, access reviews, retention checks and testing of the breach response. Findings are reported to the board with a remediation owner and a target date.
This policy is reviewed at least annually and whenever there is a material change in law, in the services offered or in the systems used.