Personal and special category data, UK GDPR and ICO
This system holds personal and special category data about children, young people, adults we support and staff. Under the UK GDPR and the Data Protection Act 2018 you may only open a record where you have a lawful basis and a genuine work reason. Every view, change, download and export is logged and auditable, and misuse is a disciplinary matter that may be reported to the Information Commissioner's Office.
- Only open the records you need for your role and your shift.
- Never share logins, screenshots or exports outside an agreed, secure channel.
- Report any suspected data breach to your manager and the Data Protection lead immediately, the ICO deadline is 72 hours.
- Records are retained and destroyed under the organisation's retention schedule; do not keep local copies.