what is a dpia?
a dpia is a process designed to help organisations identify and minimise the data protection risks of a project. where the processing (eg obtaining or recording) of personal data (eg names, addresses and information about racial or ethnic origin) is likely to result in a high risk to individuals, a dpia needs to be completed. for more information, read data protection impact assessments.
what is an appropriate policy document?
an appropriate policy document (apd) is a document outlining the organisation’s compliance measures and retention policies for special category 'sensitive' personal data (eg information about racial/ethnic origin, physical/mental health, sexual life and biometrics) and criminal offence data (eg criminal convictions and offences or related security measures). for more information, read compliance for dpias.
what does an apd cover?
an apd covers:
-
the condition(s) for processing the organisation is relying on - setting out the specific condition for processing as set out in the data protection act 2018
-
the organisation’s procedures for complying with data protection principles - these principles are set out in the uk gdpr and must be complied with by all organisations who process personal data. read data protection principles for more information
-
the organisation’s data retention and deletion policies - these are the policies the organisation has in place regarding the processing of such data. any such policies should be made available to the individuals whose data is being processed
-
a retention period for the specific data - this is how long the data in question will be kept for by the organisation
you can create your apd with 2022世界杯32强抽签时间 .
do i need an apd?
organisations will need to have an apd in place when they process special category 'sensitive' personal data or criminal offence data under certain specified conditions, as a specific accountability and documentation measure. where an apd is required, it must be in place at the time of processing.
special category 'sensitive' personal data
an apd is needed when an organisation processes special category data under the ‘employment, social security and social protection’ condition or the ‘substantial public interest’ condition (depending on the ‘associated conditions’ relied on, which organisations need to demonstrate to show that they have a substantial public interest in the processing).
an apd must always be in place under the employment, social security and social protection condition.
for the substantial public interest condition, an apd must be in place for all associated conditions, apart from the journalism, academia, art and literature condition.
an apd is not needed where data is being disclosed (or prepared to be disclosed) to the relevant authorities for the associated conditions of preventing or detecting unlawful acts and anti-doping in sport. for all other processing activities relating to these associated conditions, an apd must be in place.
criminal offence data
an apd must be in place when an organisation is authorised to process criminal offence data by uk law under one of the following conditions:
-
employment, social security and social protection
-
statutory and government purposes
-
administration of justice and parliamentary purposes
-
protecting the public against dishonesty
-
regulatory requirements
-
preventing fraud
-
suspicion of terrorist financing or money laundering
-
counselling
-
safeguarding of children and individuals at risk
-
elected representatives responding to requests
-
disclosure to elected representatives
-
informing elected representatives about prisoners
-
publication of legal judgments
-
standards of behaviour in sport
-
administration of accounts used in the commission of indecency offences involving children
-
insurance
as with special category personal data above, an apd is not needed where data is being disclosed (or prepared to be disclosed) to the relevant authorities for the associated conditions of preventing or detecting unlawful acts and anti-doping in sport. however, for all other processing activities relating to these associated conditions, an apd must be in place.
do i need multiple apds?
where an organisation processes special category or criminal offence data for various different purposes, they don’t generally need separate apds for each processing activity or condition for processing. instead, they can use one apd to cover their processing, provided that they provide the data subject with sufficient information to understand how the organisation is processing the data in question and how long they will keep the data for.
what is the retention period?
an apd should be kept by the organisation for the duration of the processing and until 6 months after the processing has stopped. during this time, the organisation should keep the apd under review, to ensure that it continues to remain relevant and so that the organisation continues to have a lawful basis for processing.
while an apd does not need to be published and made available to the public, doing so is considered good practice. if the ico asks for a copy of an organisation's apd, this must be provided free of charge.
do other documents need to be updated?
where an apd is completed, the organisation will also need to include further details in its general documentation of processing activities. for more information, read the ico’s guidance.
where relevant, organisations will specifically need to set out:
-
the lawful basis for processing (and how this is satisfied)
-
the conditions for processing special category or criminal offence data
-
if the data retention and deletion policies are followed and, if not, why this is the case
if you have any questions or require assistance, ask a lawyer.
