DS Achieve Data Protection Policy

Introduction

As part of our everyday activities DS ACHIEVE receives and stores personal data. The rights of individuals are protected by the Data Protection Act 2018 (DPA 2018) and the UK General Data Protection Regulation (UK GDPR), and other related legislation.  Taken together, these govern the way DS ACHIEVE can lawfully collect and use personal data. DS ACHIEVE is committed to conducting its activities in accordance with all applicable Data Protection laws and regulations, and in line with the highest standard of ethical conduct.

This policy applies to all personal data processed by the Charity, and all data controllers and data processors identified within DS ACHIEVE. All trustees, employees, volunteers, contractors, suppliers, and where appropriate involved third parties (acting on behalf of DS ACHIEVE) are required to comply with this policy.

This policy forms part of a wider governance framework of policies including the ‘DS ACHIEVE Cyber Security policy’, ‘DS ACHIEVE Privacy Policy’, the ‘DS ACHIEVE Privacy Statement for Staff and Volunteers’, the ‘DS ACHIEVE Subject Access Request Procedure’, the DS ACHIEVE Complaints Policy, the ‘DS ACHIEVE Data Protection Complaints Procedure’ and the ‘DS ACHIEVE Cookies Policy’. These policies are reviewed annually.

Definitions

Charity: Means DS Achieve, a registered charity.

UKGDPR: Means the UK General Data Protection Regulation.

DPA 2018: Means the Data Protection Act 2018

Responsible Person: Huw Watkins

Register of Systems: Means a register of all systems or contexts in which personal data is processed by the Charity.

The DPA 2018 includes a number of specific definitions and further information can be found on the Information Commissioner’s Office website: https://ico.org.uk/for-organisations/advice-for-small-organisations/key-data-protection-terms-you-need-to-know/.

statement of intent

DS ACHIEVE is responsible for collecting, processing, storing and safe keeping of personal data about individuals who we interact with as part of our activities. These include our donors and service users, as well as members of the public, employees and suppliers. The Charity takes the privacy and security of this information very seriously. We understand that when people give us their personal information, they want to ensure that it is kept private and secure.

The aim of this policy is to ensure that DS ACHIEVE has robust processes and systems in place so that personal information and privacy is safeguarded in line with legislation and facilitates both the effective provision of high-quality services and the effective management of the organisation.

Data protection principles

The Charity is committed to processing data in accordance with its responsibilities under the DPA 2018 and UK GDPR and the key principles which lie at the heart of the general data protection regime. Our privacy notices set out how we do this in practice.

Article 5 of the UK GDPR requires that personal data shall be:

  1. processed lawfully, fairly and in a transparent manner in relation to the data subject (lawfulness, fairness and transparency);

  2. collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes or to meet a clear legal obligation or function shall not be considered to be incompatible with the initial purposes (purpose limitation);

  3. adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (data minimisation);

  4. accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (accuracy);

  5. kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals (storage limitation); and

  6. processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (integrity and confidentiality).

Roles and Responsibilities

  1. The Board of Trustees has ultimate responsibility for agreeing and monitoring the use of the Data Protection Policy.

  2. The Responsible Person shall take operational responsibility for the Charity’s ongoing compliance with this policy by ensuring it is interpreted and applied in practice effectively. 

  3. The Charity is currently exempt from registering with the Information Commissioner’s Office. This exemption shall be reviewed each year to ensure compliance with ICO guidelines.

  4. All individuals required to comply with this policy are responsible for making themselves familiar with this policy, following the relevant processes and systems, and applying these effectively in practice.

Applying the Principles of Data Processing

Lawful, fair and transparent processing 

  1. Being transparent and providing accessible information to individuals about how their Personal Data is used is important for DS ACHIEVE. We will ensure that all processing of personal data is carried out in a lawful manner and complies with the relevant legislation. We will publish details of our processing activities within our framework of policies. These will be kept up to date and made available via websites.

  2. To ensure its’ processing of data is lawful, fair and transparent, the Charity shall maintain a Register of Systems which is a record of personal data process activities.  

    The Register of Systems will contain the following information:

    * a description of the data and how it is generated, and the purposes of the processing

    * a description of the categories of people about whom data is held “data subjects” and of the categories of personal data processed

    * the categories of recipients to whom the personal data have been or will be disclosed

    * where applicable, transfers of personal data to a third country or an international organisation

    * where possible, the envisaged time limits for erasure of the different categories of data

    * where possible, a general description of the technical and organisational security measures that are in place to protect the personal data.

    The Register of Systems will be reviewed at least annually. 

  3. The Charity is committed to ensuring that all applicable individuals are suitably trained and understand their responsibilities under the GDPR and this policy.

  4. Individuals have the right to access their personal data and any such requests made to the charity shall be dealt with in a timely manner and in accordance with the DS ACHIEVE Subject Access Request Procedure. The rights of data subjects are outlined later in this policy.

  5. Consent for processing personal information may be required for children age 12 or over. When parents provide express consent to us, we presume they have the authority of their child to share their data (if appropriate). In some circumstances we may seek to obtain express consent from a child as well as their parent before processing their data.

Lawful purposes

  1. All data processed by the charity must be done on one of the following lawful bases: consent, contract, legal obligation, vital interests, public task, recognised legitimate interests or legitimate interests (see ICO guidance for more information). 

  2. The Charity shall ensure the processing of personal data is only carried out for clearly identifiable and legitimate purposes, and will record the appropriate lawful basis in the Register of Systems.

  3. Where consent is relied upon as a lawful basis for processing data, evidence of opt-in consent shall be kept.

  4. Special category data is personal data that is sensitive in nature and as a general rule explicit consent of the data subject is required to process it. The processing of special category personal data will only be carried out where necessary and will comply with the requirements of Article 9 of GDPR. We will ensure that all applicable individuals are aware of their responsibilities in processing both personal and special category data and are able to apply appropriate safeguards to it. We will ensure that data subjects are given the opportunity to ‘opt-out’ of providing certain aspects of special category data relating to their race / ethnicity, gender, sexuality, and health, if they prefer. We will ensure that this does not detrimentally impact on data subjects who choose this option.

  5. Where communications are sent to individuals based on their consent, the option for the individual to revoke their consent should be clearly available and systems should be in place to ensure such revocation is reflected accurately in the Charity’s systems. 

Data minimisation

  1. The Charity shall ensure that personal data is adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. 

  2. The Charity shall conduct an annual data audit to ensure that only the minimum amount of personal data is held.

Accuracy

  1. The Charity shall take reasonable steps to ensure personal data is accurate

  2. Where necessary for the lawful basis on which data is processed, steps shall be put in place to ensure that personal data is kept up to date.

Archiving / removal

We will meet legislative and good practice guidelines for the retention and disposal of personal data. To ensure that personal data is kept for no longer than necessary, the Charity shall put in place a data archiving/removal procedure for each area in which personal data is processed. These procedures will be noted on the Register of Systems and reviewed annually.

Security

  1. We will aim to store most personal data and information electronically. Where we retain hard copy records, we will apply appropriate procedures to ensure these are held securely and confidentially. The Charity shall ensure that personal data is stored securely using modern software that is maintained.  

  2. Access to personal data will be limited to those individuals who need access to the information to fulfil their role with the Charity with appropriate security put in place to avoid unauthorised sharing of information. 

  3. We will train individuals in the appropriate handling of personal information and confidential data held on hard copy and electronic files.

  4. We will implement security processes and systems to protect the information we hold from unauthorised access, improper use or disclosure, unauthorised modification and unlawful destruction or accidental loss.

  5. When personal data is deleted, this should be done safely such that the data is irrecoverable. 

  6. Appropriate back-up and disaster recovery solutions shall be in place.

Sharing Personal Data

  1. We will only share personal data where we have a valid legal reason to do so, or where it is in the interest of the data subject. Where required we will ask for consent before sharing personal data.

  2. We will maintain a Third-Party Data Sharing Log which will identify those organisations with whom we share data and how the data sharing is implemented. Where we share personal data with other organisations or with data processors acting on behalf of DS ACHIEVE, we will ensure that they are compliant with the GDPR and related legislation, and are able to apply appropriate standards of security to that data to protect the privacy of individuals.

  3. DS ACHIEVE will ensure that all relationships with third parties involving the processing of personal data are subject to a contract that includes written obligations with regards to data protection.

Rights of Data Subjects

  1. We will provide advice and guidance to data subjects on their rights under the GDPR and how to apply these.

  2. Where appropriate we will seek to work with data subjects informally in the first instance by responding to requests as quickly as possible without invoking the need to exercise rights under the GDPR.

  3. Where applicable we will ensure that the rights afforded to data subjects under the GDPR are applied effectively within required timescales and in line with the Subject Access Request Procedure.

The right to be informed - We will notify the requesting data subject of the collection and use of their personal data.

The right of access - This is the ability for a data subject to have access to all personal data held. The request should be made and will be responded to in line with the Subject Access Request Procedure.

The right to rectification - This is correcting incorrect data about the data subject.

The right to erasure / to be forgotten - This allows personal data relating to the data subject to be removed / deleted from all systems and records.

The right to restrict processing - This allows the data subject to request that we restrict the processing of their personal data in certain circumstances.

The right to data portability - This is requesting the move, copy or transfer of the personal data provided by the data subject to be transferred and reused for their own purposes or ported to another data controller.

The right to object - This gives data subjects the right to object to the processing of their personal data in certain circumstances.

Rights in relation to automated decision making (ADP) and profiling - This gives data subjects the right to be informed if DS ACHIEVE intends to make significant decisions based solely by automated means, without any human intervention, which produce legal effects concerning the individual, so that the data subject might challenge any decision. Further restrictions include a general prohibition on decisions that are based on special category data. At present the Charity does not perform any automated profiling and decision-making based on personal data, that produces legal effects or similar, to subjects.

Right to withdrawal - A right to withdraw consent, where we are relying on it to use personal data. 

Marketing

Where we process personal data for marketing purposes we will comply with this policy. DS ACHIEVE may undertake electronic direct marketing without opt-in consent, provided that: 

(a) the marketing is for the sole purpose of furthering the charity’s charitable purposes; and (b) the recipient’s contact details were obtained in the course of that individual expressing an interest in, or offering or providing support for, those charitable purposes. 

Otherwise, we will ensure that appropriate consents are obtained if required, and that individuals are provided with clear information on how they may object to or opt-out of such marketing when they first provide their information to DS ACHIEVE, and in subsequent communications.

Breach

In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data, the Charity shall promptly assess the risk to individual’s rights and freedoms, and if appropriate report this breach to the ICO (more information on the ICO website) within 72 hours of becoming aware of that breach. A data breach should be reported immediately to the Responsible Person or Chair of Trustees for investigation. 

We will also inform the data subject of any data breaches, where these are likely to result in a high risk to the rights and freedoms of the individual. Where these circumstances apply, we will inform the data subject without delay.

Complaints

Individuals are encouraged to contact us if you have any questions, comments or concerns about how we handle personal data and any complaints will be managed in line with the DS ACHIEVE Complaints Policy.

Version 9.0 October 2026

Before you go...

Please consider making a small donation to support DS Achieve.