top of page
image-removebg-preview_edited_edited.png

Procedures for Handling Personal Data

Introduction

Turning Point Leeds (TPL) is committed to ensuring the lawful, fair, and secure handling of personal data in line with the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018. This policy provides clear procedures and guidelines for the collection, use, storage, and sharing of personal data, safeguarding the rights and privacy of all individuals connected with TPL.

​

1. Data Collection

  • Purpose specification: Personal data will only be collected for specified, explicit, and legitimate purposes. Pupils, parents/carers, staff, and host schools will be informed of the purposes for which data is collected at the point of collection.

  • Lawful basis: Data will only be collected and processed where a lawful basis exists (e.g., consent, contractual necessity, legal obligation, public task, or legitimate interest).

  • Data minimisation: Only personal data that is adequate, relevant, and limited to what is necessary will be collected.

​

2. Data Processing

  • Accuracy: Personal data must be accurate and kept up to date. Inaccurate or incomplete data will be rectified or erased without delay.

  • Storage limitation: Data will be retained only for as long as is necessary in line with statutory requirements and TPL’s retention schedule.

  • Security: Technical and organisational measures (e.g., password protection, secure servers, locked filing systems) will be implemented to protect against unauthorised or unlawful processing, loss, or damage.

​

3. Data Subject Rights

All individuals whose data is processed by TPL (data subjects) have the following rights:

  • Access: To request access to their personal data.

  • Rectification: To request correction of inaccurate or incomplete data.

  • Erasure: To request erasure of their data in certain circumstances (“right to be forgotten”).

  • Restriction: To request restriction of processing where appropriate.

  • Data portability: To receive data in a portable format and transfer it to another controller.

  • Objection: To object to certain processing activities, including direct marketing.

All requests must be made in writing to the Data Protection Officer (DPO) and will normally be responded to within one month.

​

4. Data Breach Management

  • Detection and reporting: All staff must report any suspected personal data breach to the DPO immediately.

  • Notification: Where a breach is likely to result in a high risk to the rights and freedoms of individuals, the ICO and affected individuals will be notified within statutory timescales.

  • Restorative response: Where appropriate, TPL will take restorative action to rebuild confidence and address concerns transparently.

​

5. International Data Transfers

TPL does not routinely transfer personal data outside the UK or EEA. Where international transfers are necessary, appropriate safeguards (such as standard contractual clauses) will be put in place to ensure compliance.

​

6. Privacy by Design and DPIAs

  • Privacy by Design: Data protection is embedded into all TPL processes, systems, and projects from the outset.

  • Data Protection Impact Assessments (DPIAs): DPIAs will be conducted for high-risk processing activities to identify and mitigate risks to individuals’ rights and freedoms.

​

7. Training and Awareness

  • All staff, volunteers, and contractors will receive GDPR and data protection training as part of induction.

  • Annual refresher training will be provided, with additional training where legislation or best practice changes.

​

8. Compliance Monitoring and Review

  • Regular audits will be carried out to monitor compliance with GDPR and this policy.

  • Data handling practices will be reviewed annually and updated where required.

  • Feedback from staff, pupils, parents/carers, and host schools will be considered in developing improvements.

​

Conclusion

TPL is committed to handling personal data lawfully, fairly, and transparently. By following these procedures, we ensure compliance with GDPR, protect the privacy of individuals, and maintain trust across our community and with host schools.

​

Written: August 2025
Next Review: August 2026

bottom of page