Processing of criminal conviction data policy

7. The policy document will be retained for the length of the processing of Criminal Conviction Data plus six months

The council will review the policy on an annual basis, as per Information Commissioner's Office (ICO) guidance.

The council will make the policy available to the ICO upon request and without charge.

8 Record of Processing

The council maintains a Record of Processing Activities including an Information Asset Register (IAR). The information included in the ROPA includes

Which processing condition of Schedule 1, Parts 1 to 3 are relied upon,

How the processing satisfies Article 6 of GDPR, and

The retention periods for data.

IAOs and Information Asset Managers are provided with access to the IAR by the  Information Governance Service. Information Asset Owners are accountable for ensuring that the Information Asset Register is kept accurate and up to date.

9 Data Subject Rights

Refer to the Information Rights Policy for details regarding individual's rights and access to their information. The Information Rights Policy and further supporting procedures can be found on the council's website.

10 Agents, partners organisations and contractors

If a contractor, partner organisation or agent of the council is appointed or engaged to collect, hold, process or deal with Criminal Conviction Data on behalf of the council, or if they will do so as part of the services they provide to the council, the lead council officer for that service must ensure that appropriate contractual clauses for security and data protection requirements are in place. Personal data must be processed in accordance with the principles of data protection law and this policy.

11 Further information

For further information or specific guidance please visit the IG pages on the Intranet or contact InformationGovernance@wiltshire.gov.uk (opens new window).