A Quick Guide to Personal Data at Diamond

Diamond is registered with the Information Commissioner’s Office as a data controller and has been since 26 June 2002. 
Diamond processes personal data to enable the organisation to promote and supply the services offered, to maintain our accounts and records and to support and manage employees and third parties contracting with Diamond. 
 
Please contact the Data Protection Officer Paul Jeffreys (paul.jeffreys@diamond.ac.uk) should you have any questions/comments related to personal data at Diamond.
 
Where Diamond contracts with a third party and where appropriate, the contract will detail the arrangements for holding, processing and disclosing personal information.
 
Diamond employees give formal consent to Diamond to hold, process and disclose personal information for the purpose of efficiently operating their contract of employment with Diamond. This consent is granted in employees’ contracts of employment. Our Privacy Notice details the types of information that Diamond holds on its employees and the purpose for which it is held.
 
Diamond’s Data Protection Policy sets out responsibilities under the Data Protection Act. It includes fair processing guidelines; it confirms the type of information held by Diamond (and the purpose of keeping the information) and details arrangements for releasing data to other organisations. 
 
This quick guide is in addition to Diamond’s policies on privacy, data protection and information technology and does not replace these or any other Diamond policies.

Before undertaking any new types of processing of personal data, including collecting personal data for a new purpose, you must undertake a 'Data Protection Impact Assessment'. These assessments help us to comply with our data protection obligations and meet the privacy expectations of individuals. Please contact Diamond's Data Protection Officer at policies@diamond.ac.uk to assist with this.   

Diamond employees and third parties contracting with Diamond must take the following steps to comply with the Data Protection Act and to keep personal data that Diamond holds secure:

• Only collect personal data that you need for specified business purposes;
• Only use personal data in a way that falls within an individual's reasonable expectations;
• Before using or transferring personal data outside Diamond, ensure that it is lawful to do so, for example, by obtaining the individual's consent;
• Uphold the privacy of others by complying with Diamond’s policies and associated guidelines;
• Update personal data records promptly;
• Keep your Fed ID and password secure;
• Lock your computer and/or your mobile device while it is unattended;
• When taking your computer and/or your mobile device with you to another country for business, ensure that it only contains the personal data that you need;
• Contact your Diamond supervisor immediately if your Diamond computer and/or mobile device is lost or stolen;
• Consider a privacy screen for your computer screen and/or position your computer screen in such a way as to prevent accidental disclosure of personal data;
• Securely store hard copy personal data when it is not being used;
• Dispose of confidential paper waste securely by shredding or by using the confidential waste bins provided;
• Be wary of individuals trying to obtain personal data from you by telephone.

• Release personal data held by Diamond unless you have the consent of the individual to do so;
• Collect irrelevant or excessive personal data;
• Ask for sensitive personal data or pass it on to anybody else unless it is necessary for a legal or business purpose.  Sensitive personal data includes racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, physical or mental health, sexual life and criminal offences. 

If Diamond holds personal data about an individual, he/she has a right to a copy of that personal data.
If you would like a copy of the personal data that Diamond holds about you or if you are a Diamond employee and you receive such a request from an individual (a “subject access request”), please send the request to Diamond's Data Protection Officer Paul Jeffreys (paul.jeffreys@diamond.ac.uk) with the words “Subject Access Request” in the subject line and include specific details of the data requested.  Please keep in mind that Diamond has a maximum of 30 days to respond.
 

When creating new forms to collect personal data at Diamond, keep in mind that we need to know: 
  

• What personal data we hold;
• How we collect it (the systems/technologies used to collect the data);
• Where it is held;
• Why it is held;
• For how long it is held;
• How we protect it;
• How we destroy it; and
• Who we share the personal information with (and ensure that we have appropriate data processor agreements in place).

Updated March 2021