Data Protection Compliance Audit Policy

JavaScript is not enabled

Without JavaScript enabled forms will not work.

1. Statement of Policy

The Data Protection Compliance Audit policy enables Dyfed-Powys Police to establish good practices around the use and handling of information, promote a culture of awareness and improvement, to understand their responsibilities and accountability, and comply with relevant legislation including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act (DPA) 2018.

Its aim is to provide officers, staff and volunteers with a framework that ensures appropriate use of personal data and provide assurance that the Force acts responsibly to protect the personal data it processes.

This policy, and associated process documentation, highlights the importance of data protection compliance auditing and outlines how this should be undertaken.

The purpose of this policy is to provide relevant Dyfed-Powys Police police officers, staff and volunteers with the necessary understanding of the Force data protection compliance audit process and their responsibilities within it. It will assist the Chief Constable, in their role as Data Controller, to gain assurance that all data processed through Force systems is compliant with data protection principles.

Information is a powerful tool and a vital asset, regarding both law enforcement processing and the management of services and resources across the Force.

It is of paramount importance that officers, staff and volunteers have access to the information they need to undertake their duties safely and effectively, but also that confidential and sensitive information remains secure. This applies to information relating to the organisation, its officers, staff and volunteers and the public. It is also vital that appropriate policies, procedures and processes provide a solid foundation for data protection compliance across the entire Force.

Applies (but not limited) to: All categories of Dyfed-Powys Police officers and staff, whether full-time, part-time, permanent, fixed term, temporary (including agency staff, associates and contractors), seconded staff and volunteers. Police Officers, staff and volunteers accessing and using Force assets and property must have due regard to the contents of this policy.

2. Policy Scope

Dyfed-Powys Police has a statutory obligation to process personal data in accordance with the provisions of the UK GDPR in respect of non-law enforcement processing and the DPA 2018 in respect of law enforcement processing.

This policy will ensure Force compliance with the Code of Practice on Information Management, relevant UK data protection legislation, the College of Policing Authorised Professional Practice (APP) Information Management which provides clear standards and guidance, national audit requirements and recommendations made by the National Police Chiefs Council (NPCC) and the Information Commissioner’s Office (ICO). The College of Policing APP on Compliance Audit and the Code of Practice on police information and records management – July 2023.

This policy applies to any systems or processes, be that paper or electronic, that involve the processing of personal data. These could be subject to a data protection compliance audit at any time.

All officers, staff and volunteers are required to understand their responsibilities under UK data protection legislation, with specific staff groups requiring more detailed knowledge around the Force data protection compliance audit process. Data protection is the responsibility of ALL officers, staff and volunteers and this policy must be adhered to.

If this policy is not adhered to and/or the data protection compliance audit process is not completed at the appropriate time, potential risks to the Force include, but are not limited to:

Inability to secure and maintain individuals’ trust and confidence in the Force
Damage to the Force reputation
Failure to comply with relevant legislation, including demonstrating compliance with accountability obligations
The potential breach of UK data protection legislation, resulting in potential action being taken against the Force by the ICO, for being unable to meet its information rights obligations
Inaccurate information being held which could have an impact on operational and business requirements
Financial loss to the Force

3. Powers and Policy/Legal Requirements

Dyfed-Powys Police has a legal obligation to comply with UK data protection legislation. Dyfed-Powys Police will also refer to the College of Policing, APP - Information Management – Data Protection.

Relevant legislation includes:

The Data Protection Act 2018
The UK General Data Protection Regulation (UK GDPR)
Computer Misuse Act 1990
Crime and Disorder Act 1998
Criminal Justice and Immigration Act 2008
Human Rights Act 1998
Regulation of Investigatory Powers Act 2000
Protection of Freedoms Act 2012

Data protection compliance auditing of the processing of personal data, by the Force, is governed by the DPA 2018 and the associated UK GDPR. All officer, staff and volunteers are required to understand their responsibilities under this legislation.

This policy should also be read in conjunction with the following related policies, protocols, practices and/or service agreements:

Data Protection Compliance Audit Process Document
Data Protection Policy
Data Protection Guidance Document
Data Protection Breach Policy
Information Security Policy
Information Sharing Policy
Data Protection Impact Assessment (DPIA) Policy
Records Management Policy
College of Policing APP Information Management Guidance
The College of Policing APP on Compliance Audit
The Code of Practice on police information and records management – July 2023.
The National Police Chiefs Council (NPCC) Data Protection Manual of Guidance
The Information Commissioner’s Office’s Code of Practice and Guidance

4. Options and Contingencies

Chief Constable

The Chief Constable of Dyfed-Powys Police is the Data Controller and as such has overall responsibility for the lawful processing of all personal data processed by the Force. They also have overall accountability for procedural documents and have ultimate responsibility for compliance of this policy and data protection across the entire Force. Regular audits of personal data processing ensure that the Chief Constable is fully informed of the current status of personal data across the Force.

Senior Information Risk Owner (SIRO)

The Deputy Chief Constable (DCC) of Dyfed-Powys Police is the appointed Senior Information Risk Owner (SIRO). They are responsible for:

Overall accountability for information risk across the Force, including the review of compliance audit reports as necessary to:
Understanding the impact of information risks on the Force’s risk register, and how those risks may be minimised and managed
and, where necessary updating the
Information Assurance Board in relation to audit results.

Data Protection Officer (DPO)

The Head of Information Management of Dyfed-Powys Police is the appointed Data Protection Officer (DPO). They are responsible for:

Protecting the confidentiality of personal data across the Force
Representing and championing data protection issues and requirements, including that of the Force data protection compliance audit process
Ensuring that the Force satisfies the highest practical standards for handling personal data
Enabling suitable information sharing with other bodies
Ensuring that data protection issues are appropriately reflected in Force policies, procedures, processes and strategies for officers, staff and volunteers
Assisting the Force in demonstrating compliance with UK data protection legislation as part of the enhanced focus on accountability
Acting as a point of contact for officers, staff and volunteers, data subjects and the ICO
Informing and advising on data protection obligations Force wide, and
Reviewing data protection compliance audit reports and providing relevant feedback.

Information Asset Owner(s) (IAO)

Information Asset Owners (IAO) are senior officers and staff who are the nominated owners of one or more identified information assets. They are responsible for:

Monitoring and understanding what information – paper and electronic – is being held and how it is maintained; knowing and approving who has access to it and why
Providing full cooperation and support to the Force data protection compliance audit process
Ensuring all relevant recommendations, from the Force data protection compliance audit process, are implemented within the specified timescales
Seeking to use information fully within the law
Identifying and addressing risks to the information, and
Encouraging a culture that values, protects and uses information for the public good.

Data Protection Advisor

The Data Protection Advisor is responsible for:

Maintaining awareness of data protection issues across the Force
Encouraging a culture that values, protects and uses information for the public good
Reviewing and updating the Data Protection Compliance Audit policy when appropriate, in line with legislation
Reviewing and updating all procedures and processes relating to this policy where appropriate
Leading the Force data protection compliance audit process
Ensuring all line managers are aware of their responsibilities and accountability regarding data protection and the requirements of this policy
Ensuring all officers, staff and volunteers are provided with the appropriate and necessary training to further their understanding of the principles of data protection and their application, and
Informing and advising on data protection obligations Force wide.

Senior Manager – Governance and Change

The Senior Manager Governance and Change is responsible for:

Reviewing data protection compliance audit reports and providing relevant feedback.

Information Security Officer

The Information Security Officer is responsible for:

Reviewing data protection compliance audit reports and providing relevant feedback.

Records and Data Quality Supervisor

The Records and Data Quality Supervisor is responsible for:

Ensuring that the Force Information Asset Register (IAR) is updated to reflect any and all relevant information included within the data protection compliance audit reports.

Data Protection Compliance Officer

The Data Protection Compliance Officer is responsible for:

Conducting data protection compliance audits, and
Ensuring all recommendations made, as a result of this process, are satisfied through regular contact with the IAO.

Officers, Staff and Volunteers

All Officers, staff and volunteers are required to understand their responsibilities under UK data protection legislation, and to know to contact the Information Management and Compliance Department with any data protection related queries. They will receive instruction, direction and updates regarding the policy from:

Line managers
Dyfed-Powys Police DPO
Dyfed-Powys Police Intranet, and
Policy and procedure manuals and documentation.

They need to be aware that data protection compliance auditing takes place.

Information Assurance Board

The role of the Information Assurance Board is:

To maintain strategic oversight, and support the management of, all activities related to the use, processing, retention, and transmission of information or data under the control of Dyfed-Powys Police and the structures, systems and processes used for those purposes in accordance with the College of Policing APP on Information Management
Provide governance support and direction to the Information Management and Compliance Department in line with the Force vision to ‘Safeguard our Communities Together’, and
Work in line with the other groups and boards in delivering the mission, vision and values of the Force, the Chief Constable’s vision and the delivery plan in support of the Police and Crime Plan.

Code of Ethics

In line with the ethical policing principles, this Policy seeks to address the following:-

Public service – “working in the public interest, fostering public trust and confidence, and taking pride in providing an excellent service to the public”.
Courage – “making, communicating and being accountable for decisions, and standing against anything that could bring our profession into disrepute”
Respect and empathy – “encouraging, listening to and understanding the views of others, and seeking to recognise and respond to the physical, mental and emotional challenges that we and other people may face.”

The ethical policing principles will be used to help the Force make and reflect on professional decision making regarding data protection breaches.

5. Take action and review

This policy is owned by the Information Management and Compliance Department. The review process will be conducted by the Data Protection Advisor on a biennial basis to ensure the continued effectiveness of the policy, and taking into account any changes to legislation, national guidance, ICO guidance etc.

The effectiveness of the policy will be monitored on a regular basis over and above the two-year review period and any major concerns will be escalated as appropriate.

Effectiveness of the policy will be measured through auditing the access to the document and associated process documentation. The aim being to check the awareness of the data protection compliance audit process and ensuring compliance with UK data protection legislation. Also, measuring the number of queries directed at the Department in regard to the data protection compliance audit process and the policy will allow its effectiveness to be measured.

In the case of any queries regarding this policy, it’s content, or associated process documentation - individuals should contact:

Dyfed-Powys Police Data Protection Advisor
Email: [email protected]

(please mark email FAO Data Protection Advisor)

Post: Data Protection Advisor, Dyfed-Powys Police, PO BOX 99, Llangunnor, Carmarthenshire, SA31 2PF

Appropriate promotion of this policy will take place, which can include awareness raising when training inputs and presentations are provided to officers, staff and volunteers across the Force. The policy will be made available on the Force intranet and internet sites. Publication via the internet will ensure that it is available for public view.

Any issues of concern or risk in respect to compliance with UK data protection legislation across the Force will be escalated to the Force Data Protection Officer, Force SIRO and Information Assurance Board, dependent on severity.

Information regarding any other potential data protection issues across the Force, will be processed in line with the Force Data Protection Policy. Such reporting, and subsequent investigation, may highlight issues with this policy and associated guidance, which could result in a necessary review. If this is the case, relevant action will be taken. The Data Protection Advisor will work closely with representatives from the relevant departments to address the issues and ensure that any lessons learned will be fully reported and cascaded as necessary.

CODE OF ETHICS CERTIFICATE OF COMPLIANCE

This policy has been drafted in accordance with the Code of Ethics and has been reviewed on the basis of its content and the supporting evidence and it is deemed compliant with that Code and the principles underpinning it.

HUMAN RIGHTS ACT CERTIFICATE OF COMPLIANCE

This policy has been drafted in accordance with the Human Rights Act and has been reviewed on the basis of its content and the supporting evidence and it is deemed compliant with that Act and the principles underpinning it.

EQUALITY IMPACT ASSESSMENT

Section 4 of the Equality Act 2010 sets out the protected characteristics that qualify for protection under the Act as follows: Age; Disability; Gender Reassignment; Marriage and Civil Partnership; Pregnancy and Maternity; Race; Religion or Belief; Sex; Sexual Orientation.

The public sector equality duty places a proactive legal requirement on public bodies to have regard, in the exercise of their functions, to the need to:

eliminate discrimination, harassment, victimisation, and any other conduct that is unlawful under the Act;
advance equality of opportunity between persons who share a relevant protected characteristic and persons who do not share it;
foster good relations between persons who share a relevant protected characteristic and persons who do not share it.

The equality duty applies to all protected characteristics with the exception of Marriage and Civil Partnership, to which only the duty to have regard to the need to eliminate discrimination applies.

Carrying out an equality impact assessment involves systematically assessing the likely or actual effects of policies on people in respect of all the protected characteristics set out above. An equality impact assessment should be carried out on any policy that is relevant to the public sector equality duty.

EQUALITY IMPACT ASSESSMENT COMPLETED: September 2024

Cookies