Data Protection Policy
Data Protection & Confidentiality Commitments
Organisation: WIILMA
Date: 17/08/2025
Purpose
This document outlines WIILMA's commitments regarding data protection and confidentiality. Our organisation recognises the importance of safeguarding personal, sensitive, and confidential information of volunteers, staff, participants, and stakeholders, in compliance with the Data Protection Act 2018, General Data Protection Regulation (EU) 2016/679 (GDPR), and other relevant legislation.
Scope
These commitments apply to all volunteers, and anyone handling organisational information. This includes personal data, financial information, volunteer records, participant information, internal communications, and documentation relating to events and programs.
3. Principles of Data Protection We commit to the following key principles in line with GDPR Article 5 and Data Protection Act 2018:
Lawfulness, fairness, and transparency: Data will be processed lawfully, fairly, and in a transparent manner.
Purpose limitation: Data will only be collected for specified, explicit, and legitimate purposes.
Data minimisation: Only data necessary for specified purposes will be collected.
Accuracy: Data will be accurate, up-to-date, and corrected if inaccurate.
Storage limitation: Data will be retained only for as long as necessary.
Integrity and confidentiality: Data will be processed securely to prevent unauthorised access, disclosure, alteration, or destruction.
4. Confidentiality Commitments
All personal and sensitive information will be treated as strictly confidential.
Volunteers are required to sign confidentiality agreements where applicable.
Information will only be shared on a need-to-know basis for organisational purposes.
Any third parties processing data on behalf of the organisation must sign a data processing agreement.
5. Data Handling & Access
Access to personal or confidential data is restricted based on role and responsibility.
Secure storage measures, both digital and physical, are enforced, including password protection, encryption, and locked filing systems.
Volunteers receive mandatory training on data protection, confidentiality, and secure handling of records.
6. Legal Compliance
Our organisation ensures compliance with all applicable data protection laws, including GDPR Articles 6 (lawfulness of processing), 9 (special categories of data), and 32 (security of processing).
Confidential information handling adheres to UK law regarding safeguarding, privacy, and contractual obligations.
Any breach of data protection or confidentiality is treated as a serious matter and may result in disciplinary or legal action.
7. Data Sharing & Third Parties
Data is only shared when legally required, necessary for organisational activities, or with explicit consent.
Third-party agreements specify data protection obligations in line with GDPR and the Data Protection Act 2018.
All transfers of personal data outside the UK or EU follow the UK GDPR adequacy requirements or standard contractual clauses.
8. Breach Management
All suspected or actual data breaches must be reported immediately to the Data Protection Data Administrator.
Breaches are assessed for risk to individuals, documented, and resolved promptly.
Notification to the Data Protection Data Administrator is made within 72 hours if required, alongside communication to affected parties.
Corrective and preventative actions are implemented to mitigate recurrence.
9. Monitoring, Review & Accountability
Regular audits and reviews are conducted to ensure compliance with data protection and confidentiality commitments.
Policies are updated in line with legislative changes and organisational practice improvements.
Records of training, processing activities, breaches, and risk assessments are maintained to demonstrate accountability.
By adhering to these commitments, WILLMA ensures that all personal and confidential information is protected, fostering trust, legal compliance, and integrity in our operations and volunteer programs.