|
 |
 |
 |
|
Our website > Data protection policy
VSO is committed to meeting its obligations under the Data Protection Act of 1998. VSO will strive to observe the law in all collection and processing of subject data and will meet any subject access request in compliance with the law. VSO will only use data in ways relevant to carrying out its legitimate purposes and functions as a charity in a way that is not prejudicial to the interests of individuals. VSO will take due care in the collection and storage of any sensitive data. VSO staff will do their utmost to keep all data accurate, timely and secure.
As an international charity, VSO will share its data with VSO staff and partners overseas but will work to ensure that all staff understand they are required to observe UK data protection laws when handling data transferred overseas from London.
All VSO staff, whether permanent or temporary, and voluntary workers, must be aware of the requirements of the Data Protection Act when they collect or handle data about an individual. VSO staff must not disclose data except where there is subject consent, or legal requirement. Data sent to outside agencies must always be protected by a written contract. All collection and processing must be done in good faith.
The Data Protection Desk (based in the Chief Executive’s Office) will keep records of all complaints by data subjects and the follow up. It will also keep a record of all data access requests. There will be a repository of all VSO statements of Data Protection Law compliance and information about any contacts made with the Data Protection Registrar. This information will be available to staff and data subjects on request.
VSO will inform subjects of any processing, disclosure or overseas transfer that does not fall within VSO’s purpose in a way that any individual supplying could be expected to understand. VSO will keep registration (now called notification) up to date.
Principles of data protection outlined in the Data Protection Act
Anyone processing personal data must comply with the eight enforceable principles of good practice. These state that data must be:
- fairly and lawfully processed
- processed for limited purposes
- adequate, relevant and not excessive
- accurate
- not kept longer than necessary
- processed in accordance with the data subject's rights
- secure
- not transferred to countries without adequate protection
|
|
 |
|
 |
|
|
