East Durham College - UK General Data Protection Regulations (GDPR) Policy

POLICY TITLE: General Data Protection Regulations Policy
DOCUMENT NUMBER: 6.1
GROUPING POLICY: Security, Confidentiality & Information
AUTHOR / REVISOR / OWNER: Vice Principal - Finance & Business Planning
DATE OF CURRENT VERSION: Sept 2026
 

This policy sets out the College’s rules for compliance with the UK General Data Protection Regulation (UK GDPR) and wider UK data protection legislation and specifies the legal conditions that must be satisfied in relation to the obtaining, handling, processing, transportation, and storage of Personal Data. 

The personal data may relate to present and past individuals. 

This policy does not form part of the formal contract of employment, but it is a condition of employment that employees and contractors will abide by the rules and policies made by the College. Any failures to follow the policy can therefore result in disciplinary proceedings. 

Any member of staff, who considers that the policy has not been followed in respect of Personal Data about themselves or another individual, should raise the matter with their line manager or Data Protection Officer of the College initially. If the matter is not resolved, it should be raised as a formal grievance. For any questions in relation to this policy or the wider data protection legislation, please contact the Data Protection Officer on dpo@eastdurham.ac.uk. 

The requirement to comply with these regulations applies equally to activities performed both on and off college premises. 

Introduction and Definitions  

As a Data Controller, the College needs to collect and process information including personal information about the individuals that it deals with, to operate effectively and efficiently. 

Personal Data 

Article 4 of the UK GDPR defines personal data as “any information relating to an identified or identifiable natural person who can be directly or indirectly identified by reference to an identifier”. 

This definition provides for a wide range of personal identifiers to constitute personal data including name, identification number, location data or online identifier, reflecting changes in technology and the way organisations collect information about people. 

The UK data protection legislation applies to all personal data held electronically and to that personal data held in manual filing systems where personal data are accessible according to specific criteria. This could include chronologically ordered sets of manual records containing personal data. 

Personal data that has been pseudonymised e.g., key coded can fall within the scope of the UK GDPR depending on how difficult it is to attribute the pseudonym to an individual. 

Special Categories of personal data 

Special Category Data is personal data which Article 9 of the UK GDPR says is more sensitive, and so needs more protection and is an individual’s: 

• race
• ethnic origin
• politics
• religion
• trade union membership (within the meaning of the [1992 c. 52.] Trade Union and Labour Relations (Consolidation) Act 1992).
• Genetics
• Biometrics (where used for ID purposes)
• sexual life or sexual orientation
• health. 

Personal data relating to criminal convictions and offences are not included but similar safeguard apply to its processing (See Article 10 of the UK GDPR) 

Processing of personal data relating to criminal convictions and offences, or related security measures based on Article 6(1) of the UK GDPR shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of individuals. Any comprehensive register of criminal convictions shall be kept only under the control of official authority. 

Individuals and organisations that determine the purposes for which and the way personal data is processed are termed “data controllers” and are subject to the UK data protection legislation. East Durham College is a data controller. 

The act of “processing” personal data is a wide-ranging activity that includes obtaining, recording, holding, or storing personal data and carrying out any operations on it such as adaptation, alteration, use, disclosure, transfer, erasure, and destruction. 

Under Article 5 of the UK GDPR, the data protection principles set out the main responsibilities for organisations. 

*Article 5 of the UK GDPR states that personal data shall be: 

1. processed lawfully, fairly and in a transparent manner in relation to individuals.
2. collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes. 

3. adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. 

4. accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay. 

5. kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the UK data protection legislation in order to safeguard the rights and freedoms of individuals; and. 

6. processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures.” 

Article 5(2) of the UK GDPR states that: “the controller shall be responsible for and be able to demonstrate compliance with the principles.” 

The College shall identify and document an appropriate lawful basis under Article 6 UK GDPR for all processing activities and, where special category data is processed, an additional condition under Article 9 UK GDPR and Schedule 1 Data Protection Act 2018.

The College will ensure that it always has a nominated Data Protection Officer. 

The Principal & Chief Executive has delegated responsibility to the Data Protection Officer to co-ordinate corporate data protection compliance across the College, including managing internal data protection activities, advise on data protection impact assessments, train staff and conduct internal audits. 

The Data Protection Officer should be the first point of contact for: 

• Queries regarding the College’s data protection responsibilities.
• Information and Advice to College staff regarding data protection compliance.
• Subject access requests.
• Liaison with the Information Commission, including preparation and submission of the College’s annual data protection notification. 

A Data Protection Impact Assessment (DPIA) must be completed prior to commencing any processing likely to result in a high risk to the rights and freedoms of individuals.

This document is issued and controlled by Quality & Standards and may only be modified by the designated group after proposed modifications have been accepted by the College Management Group. The latest version of the policy will be maintained on the College Extranet.

Please feedback to Quality & Standards any constructive suggestions on how any aspect of the policy may be clarified or improved.