​

1. Data Protection Principles

1.1 Luton Community Watch (“the Charity”) is committed to processing personal data in accordance with its obligations under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018. 1.2 In accordance with Article 5 UK GDPR, all personal data processed by the Charity shall be:

​

• Lawfulness, fairness and transparency - processed lawfully, fairly and in a transparent manner.

• Purpose limitation - collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes.

• Data minimisation - adequate, relevant and limited to what is necessary.

• Accuracy - accurate and kept up to date, with inaccurate data rectified or erased without delay.

• Storage limitation - retained only for as long as necessary for the purposes for which it is processed, unless retained for archiving, research or statistical purposes subject to appropriate safeguards.

• Integrity and confidentiality - processed securely, protecting against unauthorised or unlawful processing and against accidental loss, destruction or damage.

 

2. General Provisions

2.1 This policy applies to all personal data processed by the Charity, regardless of format or storage medium. 2.2 The Responsible Person appointed by the Steering Group shall oversee compliance with this policy. 2.3 This policy shall be reviewed at least annually or sooner if required by changes in law or organisational practice. 2.4 The Charity shall maintain registration with the Information Commissioner’s Office (ICO) as a data controller where required.

 

3. Lawful, Fair and Transparent Processing

3.1 The Charity shall maintain a Register of Systems documenting all processing activities. 3.2 The Register of Systems shall be reviewed at least annually. 3.3 Individuals have the right to access their personal data. Any such requests shall be handled promptly and in accordance with statutory time limits.

 

4. Lawful Bases for Processing

4.1 All personal data processed by the Charity must rely on one or more lawful bases:

• consent

• contract

• legal obligation

• vital interests

• public task

• legitimate interests

 

4.2 The lawful basis relied upon shall be recorded in the Register of Systems. 4.3 Where consent is used, the Charity shall retain evidence of valid opt‑in consent. 4.4 Where communications rely on consent, individuals shall be provided with a clear and accessible means to withdraw consent, and systems shall ensure such withdrawals are promptly actioned.

 

5. Data Minimisation

5.1 The Charity shall ensure that personal data collected is adequate, relevant and limited to what is necessary for the stated purpose. 5.2 Information such as DBS checks and contact details may be required for membership, safeguarding or operational purposes.

 

6. Accuracy

6.1 The Charity shall take reasonable steps to ensure that personal data is accurate and up to date. 6.2 Where accuracy is necessary for the lawful basis relied upon, appropriate procedures shall be in place to maintain up‑to‑date records.

 

7. Archiving and Retention

7.1 The Charity shall implement an Archiving and Retention Policy for each category of personal data. 7.2 Retention schedules shall specify what data must be retained, for how long, and the justification for retention. 7.3 Retention schedules and archiving procedures shall be reviewed annually.

 

8. Security

8.1 The Charity shall ensure that personal data is stored securely using appropriate technical and organisational measures. 8.2 Access to personal data shall be restricted to individuals who require access for legitimate purposes. 8.3 Personal data shall be deleted or destroyed securely and irreversibly when no longer required. 8.4 Appropriate backup and disaster‑recovery arrangements shall be maintained.

 

9. Data Breaches

9.1 In the event of a personal data breach, the Charity shall promptly assess the risk to individuals’ rights and freedoms. 9.2 Where required, the Charity shall report the breach to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. 9.3 Records of all breaches, whether reportable or not, shall be maintained.