Data Protection Policy
1. Purpose and scope
The purpose of the Data Protection Policy is to clarify the requirements under data protection legislation which primarily includes the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018) in the context of Ayurva Academy, to outline the associated internal allocation of responsibilities and duties, and to set out the structure within which compliance will be facilitated. This policy supports Ayurva Academy in demonstrating its compliance with data protection legislation to data subjects and the regulator for data protection and privacy in the UK (Information Commissioner’s Office).
This policy applies to students of Ayurva Academy as defined under Ordinance 2 – students of Ayurva Academy and any other party engaged where personal data is processed on behalf of Ayurva Academy.
This policy does not apply where students process personal data on their own behalf as part of their Academy studies, such as those studying undergraduate and postgraduate taught courses. However, in those circumstances students should ensure that any personal data is handled responsibly and securely, completing data protection impact assessments where required and complying with other Academy processes (e.g. ethical reviews).
2. Policy
Ayurva Academy shall at all times act in a manner consistent with the obligations of a Data Controller as defined under the provisions of data protection legislation ensuring privacy is a key consideration in its operations, that any compulsory registrations and payments to regulatory bodies are up to date, and that data subjects’ rights under the legislation are respected.
Where Ayurva Academy is processing personal data on behalf of another Data Controller, the Academy will at all times process the data according to the instructions and contractual obligations agreed with that Data Controller and in any case in compliance with Data Processor obligations under data protection legislation.
2.1 Key data protection terms
The following definitions are summarised from UK data protection legislation:
Personal Data means any information about a living individual who can be identified from that data or from that data and other available data. That identifiable individual will be known as a ‘data subject’. This includes, inter alia, information held in paper or digital format, video and audio recordings, and photographic images.
Processing is the undertaking of any operation involving personal data (including to collect, access, maintain, handle, copy, pseudonymise, anonymise, analyse, disclose, or delete) as well as simply storing or hosting personal data.
The Office Manager is the individual which alone (or jointly with others) decides the purpose for the processing and how such processing will take place.
2.2 Data subject rights
Ayurva Academy shall respect the rights of individuals as applicable and as defined in data protection legislation including the right:
- to be informed of processing
- of access to their personal data)
- to rectification of inaccurate personal data
- to erasure
- to restrict processing
- to data portability
- to object to processing including objection to direct marketing
- relating to automated decision-making including profiling
Further information about these rights, where they may apply and how they may be asserted are available from the Office Manager.
Ayurva Academy shall inform students, applicants, staff, and other data subjects of how it collects and uses their personal data, with whom their data will be shared, and other relevant information in line with privacy notice requirements. These notices will be communicated to data subjects upon collection of their personal data and upon variation where appropriate and notices will be made available either via the course tutor or the office manager.
Ayurva Academy shall respect the privacy rights of individuals in relation to electronic communications where direct marketing is undertaken in compliance with the Privacy and Electronic Regulations (PECR).
2.3 Processing personal data
Ayurva Academy shall process personal data in accordance with the lawful grounds specified in the UK GDPR as relevant and the Data Protection Principles.
In summary, the data protection principles state that personal data shall be:
- Lawfully, fairly, and transparently processed;
- Processed for specified purposes;
- Adequate, relevant, and not excessive;
- Accurate and up to date;
- Not kept longer than necessary;
- Appropriately secured and protected from unauthorised access, loss, or disclosure.
Ayurva Academy will have due regard to the accountability principle and its obligation to demonstrate compliance with the data protection principles.
2.4 International transfers
Ayurva Academy will not transfer personal data to third countries or international organisations based outside of the UK unless adequately protected and in line with the general principle for transfers as per the UK GDPR. For the purposes of international transfers, adequate protection means that the destination country has either been identified by the UK as having adequate data protection laws, there are binding corporate rules in place with the third-party organisation, appropriate standard contractual clauses have been appended to the contract, or there is an appropriate derogation within the DPA that applies for specific situations.
2.5 Third-party processors
Where third-party organisations are engaged to process personal data on behalf of Ayurva Academy, this shall be undertaken with due regard to the legal and contractual obligations placed on the Academy as Data Controller and the third-party organisations as Data Processor as per the UK GDPR.
3. Roles and responsibilities
3.1 Ayurva Academy as a corporate body is the Data Controller. Unless otherwise stated, roles and responsibilities are as set out in relevant policies and procedures.
3.2 The senior officer responsible for the Academy’s compliance with data protection legislation is the Office Manager. In addition to their responsibilities the Office Manager will be responsible for:
- nominating a designated Data Protection Officer for Ayurva Academy in line with its obligations as a Data Controller and public authority
- considering whether a serious personal data breach should be reported to the Information Commissioner’s Office giving due regard to the advice of the Data Protection Officer;
- where an assessment identifies it appropriate to do so, acting as an escalation point for authorisation of proposed Academy activity where personal data is to be processed in such a way that a risk assessment identifies it as a major risk
3.3 The Data Protection Officer is responsible for:
- advising on and monitoring compliance with data protection legislation and Academy obligations at a company level including awareness raising, training and audits
- co-operating with and being the primary contact point for the Information Commissioner’s Office
- advising on Data Protection Impact Assessments and identified risks and controls
- overseeing the facilitation of data subjects’ rights
- assessing and advising on reported information security incidents and any associated investigations
- for developing specific policy and supporting guidance on data protection issues for members of the University
- reporting annually on matters related to data protection compliance to the Governance Committee
3.4 In addition to their responsibilities in the Risk Assessment Policy, The Senior Management Team are responsible for acting as an escalation point for authorisation of a proposed Academy activity where personal data is to be processed in such a way that a risk assessment identifies it as a significant risk (as defined within the Risk Management Framework).
3.5 In addition to their responsibilities in the Risk Management Policy, the Senior Management Team are responsible for acting as an escalation point for authorisation of a proposed Academy activity where personal data is to be processed in such a way that a risk assessment identifies it as a moderate risk (as defined within the Risk Management Framework) and for notifying the Senior Management Team.
3.6 Each School, and lecture team shall be responsible for:
- establishing their own protocols for processing personal data with support from the Office Manager where required.
- monitoring their own compliance with Ayurva Academy policy on data protection with support from the Office Manager where required.
- ensuring at least one individual from each School team is nominated to assist the Office Manager in facilitating data subject rights including collating data as required in response to subject access requests
3.7 All individuals shall:
- process personal data where authorised by Ayurva Academy in line with this policy and with the data protection principles as outlined above, ensuring there is a lawful basis in place
- ensure that any personal data shared or otherwise disclosed to third party organisations is done so securely and in line with the Information Handling procedures, ensuring that legally compliant data processing agreements are in place with data processors where procuring or renewing services
- report personal data losses, unauthorised disclosures or access, and breaches of this policy, to the Office manager as soon as they are discovered and assist them in addressing the incident as per the Risk Management procedure
- successfully complete the mandatory annual audit and any other non-mandatory data protection training as required by the Office Manager or where role-based training has been identified
- complete Risk Assessments where required to do so
- maintain personal data in line with good records management practice as set out in Ayurva Academy policies and procedures, ensuring that information is readily accessible to comply with data subject rights and assist promptly with any requests
- provide information to support the Academy’s Record of Processing Activities and Information Asset Register where appropriate
- upon ceasing as a member of Ayurva Academy, ensure that any personal data they are custodian for is transferred to a new custodian to ensure ongoing availability
- seek advice from their line manager and/or the Office Manager where they are unsure as to appropriate security measures or data protection measures
3.7.1 All individuals shall not:
- knowingly or recklessly expose or otherwise make available personal data to unauthorised access, alteration, disclosure, or loss
- disclose personal data or otherwise make it available (including verbal disclosures) to a third party either by action or inaction where it is known that the third party is not entitled to receive that data
- access personal data records for private interest and/or gain, even where access to the record system itself has been granted to the same member for business purposes
Any infringement of data protection legislation may expose Ayurva Academy and/or the individual to legal action, claims for substantial damages and fines from the Information Commissioner’s Office. Unauthorised processing of personal data is a potential disciplinary matter which may be considered under the relevant disciplinary code, and serious breaches may constitute ‘good cause’ for dismissal and/or constitute a criminal offence.
4. Monitoring and review
4.1 The policy will be reviewed annually as part of the service development schedule. Monitoring of compliance with this policy is undertaken through Annual Audit assessment.
4.2 The Senior Management Team shall receive an annual report from the Office Manager to include summaries of compliance with data subject rights, statistics on information security incidents, completion of mandatory information security training, and an overview of Ayurva Academy data protection risk management.