Page 222 - Demo

keep for a certain length of time, but as long as you can justify it, you can keep the records for as long as you want to.
A data breach policy just needs to set out the procedure if there is any kind
of breach of the data protection legislation. It needs to specify to whom any breach needs to be reported and what happens next. When putting this in place, you need to bear in mind that if you have to report the breach to the ICO, it has to be done within 72 hours, so initial action will need to be taken quickly.
Right to be forgotten
There is a new right under GDPR to ask to be forgotten by an organisation that holds your details. There are exceptions to this, such as where you hold records for historic or archive purposes, but it is worth being aware that the right exists, should you ever be asked to “forget” someone, and make sure that you have systems in place to be able to delete extraneous information if asked.
WHAT ABOUT THE FUNDRAISING REGULATOR AND FUNDRAISING PREFERENCE SERVICE?
If you are fundraising from the public, you need to be aware of the Fundraising Regulator’s Code of Practice, and follow this as closely as possible when carrying out your fundraising. In particular, you need to be sure that you have the necessary consent to contact individuals about fundraising, bearing in mind the requirements of the GDPR and the Code of Practice.
The Fundraising Preference Service is a mechanism for individuals to request that a charity stop all communications with them. If an individual wishes to stop hearing from your institute, the regulator will let you know and you must then take steps to ensure that you no longer contact that individual.
DOES THE FREEDOM OF INFORMATION ACT 2000 APPLY TO US?
No, the Freedom of Information Act 2000 is about promoting open government and therefore the obligations under that legislation only apply to public authorities. However, if you are carrying out services on behalf of a public authority (for example providing care services to local authorities)
218 Chapter 11