Information Governance
The governance of data within third sector organisations is a critical aspect that ensures the integrity, security, and effective use of data. As your organisation operates primarily to serve the public, the manner in which you handle and protect data is of paramount importance.
Data governance encompasses a collection of practices and processes which help to manage data assets effectively, ensuring that the data's accuracy, availability, and security are maintained. These practices and processes are defined in the Data Protection Act (2018) Data Protection Act (2018) overview with additional regulation provided through the General Data Protection Regulation (GDPR) and regulated by The Information Commissioner’s Office (ICO).
Your Board/Management Committee holds significant governance responsibility in relation to data governance, including setting the strategic direction, ensuring compliance with legal and regulatory requirements and fostering a culture of data protection within the organisation. By establishing robust data governance policies, the Board/Management Committee not only protects the organisation but also builds trust with stakeholders, beneficiaries, and the broader community.
This page will signpost you to the most suitable resources to build your organisations skills in relation to the management of data and other information.
Key Principles
Article 5(1) of the GDPR outlines seven key data protection principles for information governance: [# external: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/]
- Lawfulness, fairness and transparency: personal data must be processed lawfully, fairly and in a transparent manner in relation to individuals.
- Purpose limitation: personal data shall be collected for specified, explicit and legitimate purposes in a manner which is compatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purpose.
- Data minimisation: adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed
- Accuracy: accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay
- Storage limitation: kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals
- Integrity and confidentiality: processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’)
Section 5(2) adds:
- Accountability: The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1
Data Management Tools
Data Protection Self-Assessment
The ICO provides a self-assessment toolkit which will support your management and Board/Management Committee to assess you current compliance with the legislation and which provides recommendations for improvement.
This includes areas such as:
- Data Processing
- Information Security
- Direct Marketing
- Records Management
- Data-sharing and Subject Access
- CCTV
Data-sharing Agreements
If you wish to work with another organisation to share data, the legislation provides opportunities to do this. The ICO provides a Code of Practice which will guide you.
There are frequent misconceptions about the sharing of data so it is in your interest to gain advice from your local authority’s Information Governance Teams or from your local Third Sector Interface (TSI).
Data Protection Impact Assessment
A data protection impact assessment (DPIA) is a document which would allow you to assess the risks and benefits of sharing data as part of the production of a data-sharing agreement. Further information is available at ICO
Subject Access Request
A subject access request (SAR) is a formal request to your organisation for information which you might hold – for example, about an employee or service user. The process for managing a SAR is available at ICO.
Legal framework
The Data Protection Act (2018) is the core legislation in the UK which details how to manage data.
The General Data Protection Regulation (GDPR)] was introduced in 2018 and provides detail about the management of personal data. Further information can be found at ICO here.
Training
The ICO provides training and awareness in data protection on its website.
Cyber Essentials is a government-backed certification scheme that helps keep your organisation’s and your customers’ data safe from cyber-attacks.
Further resources and links
The Information Commissioner’s Office (ICO)
SCVO - Data protection pages
For further free, well-informed information, find your local Third Sector Interface (TSI) at the directory page here