Data Protection Policy for Dr Jeremy Side Educational Psychologist

This policy has been created to help you understand how and why your data is used. The new General Data Protection Regulations (2018) require anyone using data to be clear about what data is used, how it is stored, how long it is stored, what security measures are in place and to create a policy that clearly identifies the reasons why personal data is collected.

The personal data I collect enables me to support children and young people I work with and to write psychological reports regarding details of assessments. All information I collect is used in accordance with all laws concerning the protection of personal data, including the Data Protection Act 1998 and the GDPR 2018. As per these laws, Dr Jeremy Side is the data controller and data protection officer, please contact me if you have any questions or anything in this policy needs clarification.

For any further information please contact Information Commissioner's Office (ICO) https://ico.org.uk.

Data protection officer:
• Dr Jeremy Side.
• Email: jeremyside@hotmail.co.uk.
• Tel: 07931 262258.

Lawful basis for processing data:
• Signed consent forms by parent/carers.

Types of data collected:
• All background information about the pupil relevant to the assessment e.g. family name, date of birth, address, area of strengths and need, medical concerns, other services involved (sensitive data).
• Psychological reports for children and young people (sensitive data).
• Assessment materials (sensitive data).
• Email enquiries – schools are asked not to use a child or young person’s name in their emails and only use initials.
• All data is collected from children and young people with full parental consent.

Data processing:
• Reports written on a computer.
• Assessment materials held in paper copies and/or electronic copies.
• Hard copies of reports sent via post to schools and/or parents using Royal Mail next day signed for.
• Electronic copies of reports sent to schools using an encrypted email system.

Data storage:
• Hard copies of reports are locked in filing cabinets until they are scanned and then they are kept electronically and the hard copy is destroyed.
• Computer – password protected and on an encrypted volume.
• Electronic data back up on 2 external hard drives with encrypted volumes.

Subject Access Request Procedure:
• Should a subject request information on the data held about them, then they can request this within the limitations of the data retention schedule.

Data retention:
• Guidance from the Association of Educational Psychologists and the British Psychological Society indicate that data should be kept for a lifetime and provision is made for the data to be deleted upon death/incapacity or if I cease trading as an Educational Psychologist.

Data security - Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data:
• Filing cabinets are locked.
• Computer has an encrypted drive where electronic reports are kept.
• Firewall and anti-virus software on computer.
• Electronic data is backed up on 2 external hard drives and password protected.

Data Breach Procedure:
• The Information Commissioner’s Office will be contacted within a reasonable time frame as soon as made aware of a data breach.
• Schools and parent/carers will be contacted within a reasonable time frame as soon as made aware of a data breach.

Date of current policy and review period:
• Data policy created May 2018.
• Data policy review date May 2019.

If you would like any further information please contact me.