TWC IT Solutions:

Introduction

TWC IT Solutions regards the lawful and correct processing of personal and sensitive data as an integral part of its business.
TWC IT Solutions believes this is vital for maintaining the confidence of employees, customers, partners and other stakeholders about whom we process data, and ourselves.

Policy Statement

This Data Protection Policy explains how TWC IT Solutions will meet its legal obligations concerning confidentiality and data security standards.
The requirements within the policy are primarily based upon the EU General Data Protection Regulation (EU GDPR), which is the key piece of legislation covering data security and confidentiality of personal and sensitive personal data in the European Union.
TWC IT Solutions will implement adequate and appropriate physical and technical measures and organisational measures to ensure the security of all data contained in or handled by its systems.
The main focus of this policy is to provide guidance about the protection, sharing and disclosure of personal data, but it is important to stress that maintaining confidentiality and adhering to data protection legislation applies to anyone handling personal data or personal sensitive data on behalf of TWC IT Solutions.

Personal Data Definitions

All identifiable customer data.
All identifiable employee data.
All identifiable supplier data.
All other personal data processed by TWC IT Solutions.

Examples of personal identifiable data Lincoln’s Inn processes include:

Names, addresses, emails, phone numbers and other contact information.
Photographs, video and audio recordings.

Data Protection Principles

The Data Protection principles that lie at the heart of the EU GDPR give the Regulation its strength and purpose. To this end, TWC IT Solutions fully endorses and abides by the principles of data protection.
Personal data and sensitive personal data must not be used other than for the specific purpose required to deliver a product or service.
A record can be in computerised and/or in a physical format.
Backup data (i.e. archived data or disaster recovery records) also falls under the DPA; however, a search within them should only be conducted if specifically asked for by an individual as an official Subject Access Request.

Practical Implications

Understanding and complying with the Data Protection Principles is the key to understanding and complying with the TWC’s responsibilities as the data controller. Therefore, TWC will:

Ensure that there are lawful grounds for using the personal data.
Ensure that the use of the data is fair and meets one of the specified conditions.
Only use sensitive personal data where we have obtained the individual’s explicit consent (unless an exemption applies).
Only use sensitive personal data, if it is absolutely necessary.
Explain to individuals, at the time their personal data is collected, how that information will be used.
Only obtain and use personal data for those purposes which are known to the individual.
Ensure personal data is only used for the purpose it was given. If we need to use the data for other purposes, further consent will be obtained.
Only keep personal data that is relevant to Lincoln’s Inn.
Keep personal data accurate and up to date.
Only keep personal data for as long as is necessary.
Always adhere to our Subject Access Request Procedure and be receptive to any queries, requests or complaints made by individuals in connection with their personal data.
Ensure individuals are given the opportunity to ‘opt in’ to receiving mass communications.
Take appropriate technical and organisational security measures to safeguard personal data.

In addition, TWC will ensure that:

There is an employee appointed as the Security Information Risk Owner with specific responsibility for Data Protection. This is currently the Managing Director.
Everyone managing and handling personal data and sensitive personal data understands that they are legally responsible for following good data protection practice and has read and signed the Inn’s Data Protection Policy.
Everyone managing and handling personal data and sensitive personal data is appropriately supervised by their line manager.
Enquiries about handling personal data and sensitive personal data are dealt with promptly.
Methods of handling personal data and sensitive personal data are clearly described in polices and guidance.
A review and audit of data protection arrangements is undertaken annually. This will take place each year in May.
Methods of handling personal data and sensitive personal data are regularly assessed and evaluated by the Security Information Risk Owner and relevant members of the Executive team.
Performance with personal data and sensitive personal data handling is regularly assessed and evaluated by the Security Information Risk Owner and relevant members of the Executive team.

Roles and Responsibilities

Maintaining confidentiality and adhering to data protection legislation applies to everyone at TWC. All employees and contractors have a responsibility to:

Observe all guidance and codes of conduct in relation to obtaining, using and disclosing personal data and sensitive personal data.
Obtain and process personal data and sensitive personal data only for specified purposes.
Only access personal data and sensitive personal data that is specifically required to carry out their activity or work.
Record data correctly in both manual and electronic records.
Ensure any personal data and sensitive personal data is held is kept secure.
Ensure that personal data and sensitive personal data is not disclosed in any form to any unauthorised third party.
Ensure personal data and sensitive personal data is sent securely.

Breach of Policy

In the event that an employee fails to comply with this policy, the matter may be considered as misconduct and dealt with in accordance with TWC’s Policy.
Any individuals or organisations with whom TWC’s data has been shared may be personally liable for any breach of the EU GDPR.

Dealing with a Data Breach

If a data breach is suspected, the person who identified the breach should immediately:

Notify the Managing Director.
Document the Data Incident.

Following notification of a breach, the Managing Director will take the following action as a matter of urgency:

Implement a recovery plan, which will include damage limitation.
Assess the risks associated with the breach.
Inform the appropriate people and organisations that the breach has occurred.
Review TWC’s response and update information security.