To provide our candidates with a first class exam service we collect and use the personal information of staff, candidates, and other individuals, who are referred to within this policy as ‘data subjects’. The aim of this policy is to protect the fundamental rights and freedoms of these data subjects.

The Data Protection Act 2018 controls how personal information is used by organisations, and is the UK’s implementation of the General Data Protection Regulation (GDPR). All staff involved with the collection, processing and disclosure of personal information are individually responsible for adhering to data protection legislation, together with the procedures outlined in this policy.

‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is someone who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual;

All staff using personal data must make sure the information is:

• used fairly, lawfully and transparently
• used for specified, explicit purposes
• used in a way that is adequate, relevant and limited to only what is necessary
• accurate and, where necessary, up-to-date
• kept for no longer than is necessary
• handled in a way that ensures appropriate security, including protection against unlawful or unauthorised processing, access, loss, destruction or damage.

There is stronger legal protection for more sensitive information, such as:

• race
• ethnic background
• political opinions
• religious beliefs
• trade union membership
• genetics
• biometrics (where used for identification)
• health
• sex life or orientation

Under the Data Protection Act 2018, data subjects have the right to find out what information organisations store, collect and process about them. This includes the right to:

• be informed about how their data is being used
• access their personal data
• have incorrect data updated
• have data erased
• stop or restrict the processing of their data
• data portability (allowing you to get and reuse your data for different services)
• object to how their data is processed in certain circumstances.

The role of DPO is defined by law, and GDPR states that; ‘Data subjects may contact the data protection officer with regard to all issues related to processing of their personal data and to the exercise of their rights under this Regulation.’

GDPR provides guidance on the role of a DPO. It advises that the data protection officer has to:

1. inform and advise the data controller and the employees who carry out processing of their obligations
2. monitor compliance with the Regulation, including assigning of responsibilities, raising awareness and staff training 
3. provide advice where requested as regards the data protection impact assessment
4. cooperate and act as the contact point for the Information Commissioner’s Office (ICO)

Data subjects have rights to access to personal information held or processed by LPTC. Further information on how a data subject may access their personal data can be found emailing us at compliance@londonptcollege.ac.uk

• Data must not be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. 
• We use a number of different legal bases for processing personal information.
• Where no other legal basis exists for processing an individual’s personal data we will seek their consent. Any request for consent must be presented in a way that is clearly distinguishable from other matters, in an intelligible and easily accessible form, using clear and plain language.

An individual has the right to withdraw his or her consent at any time, and it must be as easy to withdraw consent as to give it in the first place.

Children must be afforded particular protection when their personal information is being processed as they may be less aware of the risks involved.

Children have the same rights as adults over their personal data. These include the rights to access their personal data; request rectification; object to processing; and have their personal data erased.

Where we rely on consent to process a child’s personal data we must ensure the child understands what they are consenting to. When seeking consent we must recognise that there may be a perceived imbalance of power between the person requesting the consent and the child and we must ensure any imbalance is not exploited, even if this is unintended. To ensure candidates’ rights are protected, ordinarily;

• For candidates under the age of 16 years we will seek both the student and parents’ consent to process a student’s personal data, and may not treat this as true consent unless both agree.
• For candidates between the age of 16 and 18 years, we will seek our candidates’ consent to process their personal data.

The ICO provides further information on protecting the rights of children which may be found on their website.

Safe storage and safe sharing of personal information

Clear desks

All staff are required to ensure that all confidential or restricted information in hardcopy or electronic form is kept secure, in particular;

• Computer workstations must be ‘locked’ when a workspace is unsupervised.
• Any Confidential or Restricted information must be removed from desks and locked in a drawer or filing cabinet when the desk is unoccupied and at the end of the work day.
• Filing cabinets containing Restricted or Sensitive information must be kept closed and locked when not in use or when not supervised.

The following activities involve the processing of special categories of personal information and additional guidance is provided to support this.

• Medical records
• Safeguarding
• Special educational needs and disability (SEND)

Exam results

The Information Commissioner has issued specific guidance on the publication of exam results. Students may request information about their exam performance, including:

• marks;
• comments written by the examiner; and
• Minutes of any examination appeals panels

As a Private Exam centre, we will only provide exam results direct to our candidates in all cases.  We will not provide exam results to any other person, including parents, without explicit prior consent from the candidate except where the candidate is under 18 years and under the care of a Local Authority/Social Services.