A Quick Guide to Personal Data at Diamond

Diamond has been registered with the Information Commissioner’s Office (ICO) as a data controller since 26 June 2002.  The organisation has a responsibility as a data controller for complying with data protection laws and holding records to demonstrate this and co-operating with the ICO as the UK regulator of data protection law.

Diamond’s Data Protection Policy applies to everyone who processes personal data on behalf of Diamond. It sets out the data protection principles and the lawful basis of processing.

Diamond’s Privacy Notice details the types of information that Diamond processes, the purposes for which it is held and how it may be shared with other organisations.

Diamond’s Data Classification Policy is designed to ensure confidentiality, integrity and availability by the implementation of a data classification scheme to ensure secure accessing, storing and sharing of Diamond’s information internally and externally.  

If you have any queries relating to personal data at Diamond, you should contact the Data Protection Officer (DPO), Paul Jeffreys at [email protected] or the Legal team at [email protected].

If you handle any information relating to people at Diamond that identifies an individual, you need to be aware that you are processing personal data and ensure you know how to comply data protection laws.

DO

• Review Diamond’s Data Protection Policy and consider the data protection principles and what is the relevant lawful basis for processing.  
• Ensure individuals are aware of their rights and provide them with a link to Diamond’s  privacy notice prior to any collection of their personal data.
• Only collect personal data that you need for specified business purposes.
• Only use personal data in a way that falls within an individual's reasonable expectations.
• Before using or transferring personal data outside Diamond ensure that it is lawful to do so, for example, by obtaining the individual's consent.
• Where there is a new project involving personal data, contact the DPO or Legal to discuss data protection impact risk assessments.
• Contact the DPO or Legal immediately if you receive a request from an individual about Diamond’s use of their data.

DO NOT

• Share personal data with another organisation unless you are certain that all the risks have been considered and there is a written contract in place with the third party.
• Copy emails containing personal data wider than you need to.

• Release personal data held by Diamond unless you have the consent of the individual to do so.
• Collect irrelevant or excessive personal data.
• Ask for “special category data” or pass it on to anybody else unless you have first discussed with the DPO or Legal. Special category data includes racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic, biometric, health (physical or mental), sex life and sexual orientation.
• Ask for data regarding criminal offences unless you have first discussed with Legal or the DPO.

In order to ensure that the management of personal data held by Diamond complies with the relevant legislation, you must follow these steps:

DO

• Update personal data records promptly.
• Securely store hard copy personal data in locked draws and cupboards.
• Regularly check and delete personal data if you no longer need it.
• Dispose of confidential paper waste securely by shredding or by using the confidential waste bins provided.
• Keep your Fed ID and password secure.
• Lock your computer and/or your mobile device while it is unattended.
• When taking your computer and/or your mobile device with you to another country for business, ensure that it only contains the personal data that you need.
• Contact your line manager immediately if your Diamond computer and/or mobile device is lost or stolen.
• Consider a privacy screen for your computer and/or position your computer screen in such a way as to prevent accidental disclosure of personal data.
• Be wary of anyone trying to obtain personal data from you.
• Keep comments on people fair, accurate and appropriate.  Always assume that the comment might be disclosed to the person it’s about.
• Name your documents or files carrying personal data consistently and classify it in accordance with the Data Classification Policy.
• If you think there may be a possible breach of any personal data (an accidental leak or unauthorised access to) report it immediately. 

DO NOT

• Transfer personal data from business devices to your own personal devices.
• Take hard copies of personal data off Diamond’s premises unless they can remain secure at all times.

•  Inadvertently reveal personal data when talking to others.
• Store personal data in any removable medias. Instead, give preference to securely store personal data on software/hardware protected with encrypted facilities built in and by a strong password and/or a two-factor authentication system (if available).   
• Try and work around data protection laws.
• Keep copies of personal data – on electronic devices or on paper – for any longer than necessary.