Our policies on information governance

Summary

We will always make sure that your personal data is protected and treated securely. Any information that you give will be held in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

We also make our Information Asset Register available for people to read to give further clarity about how data relating to them is managed and kept secure. This includes our retention schedule and clear details about the lawful basis for storing and keeping personal data.

We keep records to meet current and future business needs and comply with statutory, legal and corporate governance practice requirements. By maintaining a retention and disposal schedule we can ensure that the management of records is documented, understood and implemented. 

The Retention and Disposal Schedule is a list of the business records we hold, including examples, and the period at which each type of record will be reviewed for destruction. It should be noted that the Schedule focuses on managing content and not the format in which the record is held, for example, how long we keep an email will be dictated by its content rather than the fact it is an email. The Schedule is reviewed annually as part of our information asset review.