At St Anne’s Community Services (St Anne’s), we process personal information about our staff, Clients, visitors, trustees and others to support the delivery of services and the operation of our business. We recognise the need for effective controls around the collection, creation, use, retention and destruction of personal data, as well as our duties under data protection laws, in particular our obligations under Article 5 of General Data Protection Regulation (GDPR) and processing activity requirements as set out in the Data Protection Act 2018 (DPA).

This policy forms part of our Information Governance Management Framework, which demonstrates how we comply with relevant legislation and guidance, including: the DPA, the Access to Health Records Act 1990, the Human Rights Act 1998, the Caldicott Principles/guidance, the Confidentiality Code of Practice Department of Health (2003), the Information Commissioners Office (ICO) Statutory Data Sharing Code of Practice and the ICO’s Anonymisation Code of Practice, the Health and Social Care Information Centre’s ‘A Guide to Confidentiality in Health and Social Care’ and the National Data Guardian’s ten data security standards, as well as observing the
common law duty of confidentiality.

All applicable legal and best practice standards are brought together in the Data Security and Protection Assurance Framework for Health and Social Care. St Anne’s will conduct an annual self-assessment of its compliance with this Framework through the Data Security and Protection Toolkit process.

This policy outlines the requirements of the DPA and confidentiality regarding the collection, use, transfer and security of personal data by or on behalf of St Anne’s. Our St Anne’s Community Services Staff Manual Privacy Notice contains more detail about the processing activities we undertake, as well as the categories of personal data we process.

Our Confidentiality and Data Protection policy can be accessed here: 7.03 Confidentiality and Data Protection Policy