Data Protection Policy

Policy Statement

AESN Care is committed to protecting personal information and handling it lawfully, fairly, transparently and securely. Data protection is particularly important in adult social care because AESN Care may process sensitive information needed to understand people's needs, provide safe support and work with families, professionals and commissioning organisations.

1. Introduction

This policy sets out AESN Care's internal approach to the responsible handling of personal data. It should be read with the Privacy Policy, which explains information processing from the perspective of people whose data AESN Care handles.

2. Purpose

The purpose is to protect confidentiality, support lawful information sharing, reduce data risks, respect individual rights and ensure staff understand their responsibilities.

3. Scope

This policy applies to employees, managers, contractors and other authorised persons handling information for AESN Care. It covers electronic and paper records, communications, care records and information received from or shared with relevant third parties.

4. Policy Objectives

• Process personal data lawfully and transparently.
• Collect only information that is necessary and relevant.
• Keep information accurate and appropriately up to date.
• Protect data against loss, misuse, unauthorised access or disclosure.
• Respect data subject rights.
• Share information only where there is a lawful and appropriate basis.
• Retain information only for as long as required.

5. Definitions

Personal data identifies or can identify a living person. Special category data includes information such as health data that receives additional legal protection. A data breach is a security incident affecting confidentiality, integrity or availability of personal data.

6. Legal and Regulatory Framework

This policy is based on the UK GDPR and Data Protection Act 2018, together with applicable guidance from the Information Commissioner's Office and relevant care-sector confidentiality requirements.

7. Roles and Responsibilities

• AESN Care Management is responsible for appropriate governance and oversight.
• Managers must ensure staff follow information-handling procedures.
• Staff must use information only for legitimate work purposes and protect confidentiality.
• Everyone must report suspected data breaches or inappropriate disclosure promptly.

8. Policy Requirements / Principles

• Lawfulness, fairness and transparency.
• Purpose limitation.
• Data minimisation.
• Accuracy.
• Storage limitation.
• Integrity and confidentiality.
• Accountability.
• Additional care when processing health and other special category information.

9. Procedures

Collection and use

Information should be collected for clear and legitimate purposes connected with care, employment, administration, safeguarding, legal obligations or other appropriate functions.

Access

Access should be limited to people who need the information for their role. Staff must not browse records without a legitimate purpose.

Sharing

Information may be shared with health and social care professionals, local authorities, families or representatives, commissioners, emergency services or other organisations where there is a lawful and appropriate basis. Safeguarding information may need to be shared without consent where permitted or required by law.

Breaches

Lost devices, misdirected information, unauthorised access or accidental disclosure must be reported promptly so risk can be assessed and appropriate action taken.

10. Reporting and Escalation

Suspected breaches must be escalated to AESN Care Management promptly. Safeguarding concerns must also be managed under safeguarding procedures. Where required, regulatory or supervisory reporting will be considered.

11. Records and Documentation

AESN Care will maintain appropriate records of processing, permissions, incidents, requests and decisions where required. Specific retention periods are not stated in this policy because they depend on the record type and applicable requirements.

12. Training and Competence

Relevant staff will receive data protection and confidentiality training appropriate to their duties, including secure communication, records handling, passwords, device security and incident reporting.

13. Monitoring and Compliance

Compliance may be monitored through audits, incident review, access controls, training records, complaints and management checks.

14. Breaches / Non-Compliance

Failure to comply may create risks to people we support and may result in management or disciplinary action. Serious breaches will be assessed for appropriate external reporting.

15. Equality, Diversity and Human Rights

Data protection arrangements must support dignity, autonomy, equality, communication needs and access to advocacy. Privacy should not be used to prevent lawful safeguarding or care-related information sharing.

16. Confidentiality and Data Protection

Confidentiality is a professional responsibility. Staff must not discuss people's information in public or with unauthorised persons and should use secure methods for storing and transmitting information.

17. Related Policies and Procedures

• Privacy Policy
• Cookie Policy
• Safeguarding Policy
• Whistleblowing Policy
• Health & Safety Policy
• Quality Assurance Policy

18. Review and Continuous Improvement

Data incidents, complaints, audits, changes in law and technology will inform improvements to data protection controls and staff guidance.

19. Policy Review

This policy will be reviewed periodically and when relevant legal, regulatory, technological or operational changes occur.

Related Policies

• Privacy Policy
• Cookie Policy
• Safeguarding Policy
• Whistleblowing Policy

Review Arrangements

This policy will be reviewed by AESN Care Management at appropriate intervals and sooner where there is a significant change in legislation, regulation, service delivery, risk, guidance, learning from incidents or complaints, or organisational arrangements. Review findings and resulting actions will be documented.

Approval

Approved by: AESN Care Management