1. Policy Statement

Black London Advisory Service (BLAS) is committed to protecting the privacy, confidentiality, and security of personal information entrusted to us by clients, employees, volunteers, partners, and stakeholders.

As an organisation providing advice, advocacy, signposting, and community support services, BLAS recognises that it may process sensitive personal information relating to individuals seeking support with employment, immigration, entrepreneurship, welfare, and other personal matters.

BLAS will process personal data lawfully, fairly, transparently, and securely in accordance with:

• UK General Data Protection Regulation (UK GDPR)

• Data Protection Act 2018

• Privacy and Electronic Communications Regulations (PECR)

• Relevant information governance guidance

Protecting personal information is central to maintaining trust and delivering safe, professional services.

 

2. Purpose

The purpose of this policy is to:

• Explain how BLAS manages personal data.

• Ensure compliance with UK data protection legislation.

• Protect the rights and privacy of individuals.

• Establish responsibilities for staff, volunteers, and representatives.

• Prevent unauthorised access, misuse, loss, or disclosure of information.

• Provide procedures for handling data protection concerns.

​

3. Scope

This policy applies to:

• Board Directors and Trustees

• Employees

• Volunteers

• Advisors

• Consultants

• Contractors

• Interns

• Partner organisations processing BLAS information

It applies to all personal data processed by BLAS, including information held:

• Electronically

• Digitally

• On paper

• Through databases

• Through email systems

• Through cloud services

• Through client management systems

​

4. Data Protection Principles

BLAS follows the seven principles of UK GDPR.

1. Lawfulness, Fairness and Transparency

Personal data must be processed:

• Lawfully.

• Fairly.

• Transparently.

Individuals must understand how their information is used.

​

2. Purpose Limitation

BLAS will only collect and use information for specific, legitimate purposes.

Information will not be used for unrelated purposes without appropriate justification.

​

3. Data Minimisation

BLAS will only collect information that is:

• Necessary.

• Relevant.

• Appropriate for the service being provided.

We will avoid collecting unnecessary personal information.

​

4. Accuracy

BLAS will take reasonable steps to ensure personal information is accurate and updated.

Individuals may request corrections where information is incorrect.

​

5. Storage Limitation

Personal data will only be retained for as long as necessary.

Retention periods will consider:

• Legal requirements.

• Operational needs.

• Funding requirements.

• Best practice guidance.

​

6. Integrity and Confidentiality

BLAS will protect personal information through appropriate:

• Security measures.

• Access controls.

• Staff training.

• Confidentiality procedures.

​

7. Accountability

BLAS is responsible for demonstrating compliance with data protection requirements.

​

5. Definitions

Personal Data

Any information relating to an identifiable individual.

Examples include:

• Name

• Address

• Email address

• Telephone number

• Employment details

• Immigration information

• Financial information

​

Special Category Data

Sensitive information requiring additional protection, including:

• Health information

• Race or ethnic origin

• Religious beliefs

• Political opinions

• Sexual orientation

• Biometric information

​

Data Subject

The individual whose personal data is being processed.

​

Data Controller

The organisation responsible for deciding how personal data is used.

BLAS acts as a Data Controller for information collected through its services.

​

Data Processor

An organisation processing information on behalf of BLAS.

Examples:

• IT providers

• Cloud storage providers

• Database providers

​

6. Personal Data BLAS May Process

Depending on services provided, BLAS may process:

Client Information

Including:

• Name

• Contact details

• Date of birth

• Employment information

• Immigration circumstances

• Business information

• Housing circumstances

• Referral information

• Support needs

​

Staff and Volunteer Information

Including:

• Employment records

• Training records

• Payroll information

• References

• DBS information where applicable

​

Partner Information

Including:

• Contact details

• Organisation details

• Agreements

• Communications

​

7. Lawful Bases for Processing Data

BLAS will only process personal information where a lawful basis exists.

These may include:

Consent

Where an individual has clearly agreed to the use of their information.

Example:

Consent to receive updates or referrals.

​

Contract

Where processing is necessary to deliver agreed services.

​

Legal Obligation

Where BLAS must process information to comply with legal requirements.

​

Legitimate Interests

Where processing is necessary for BLAS's legitimate activities and does not unfairly impact individuals.

​

Vital Interests

Where processing is necessary to protect someone's life or safety.

Example:

Safeguarding emergencies.

​

8. Special Category Data

BLAS recognises that some clients may provide sensitive information.

Special category data will only be processed where:

• There is a lawful basis.

• Appropriate safeguards exist.

• Access is restricted.

• Information is handled confidentially.

Examples include:

• Disability information.

• Health information.

• Ethnic background.

• Immigration vulnerability information.

​

9. Client Confidentiality

BLAS respects client confidentiality.

Staff and volunteers must:

• Keep client information private.

• Only access information required for their role.

• Avoid discussing clients publicly.

• Use approved communication channels.

Information may only be shared where:

• The individual has consented.

• There is a legal requirement.

• There is a safeguarding concern.

• There is risk of serious harm.

​

10. Data Collection Procedures

When collecting personal information, BLAS will:

• Explain why information is required.

• Explain how information will be used.

• Provide privacy information.

• Collect only necessary information.

• Obtain consent where required.

​

11. Client Consent

Where consent is required, BLAS will ensure consent is:

• Freely given.

• Specific.

• Informed.

• Unambiguous.

• Recorded.

Individuals may withdraw consent at any time where consent is the lawful basis.

​

12. Data Security Measures

BLAS will implement appropriate security measures, including:

Digital Security

• Password protection.

• Multi-factor authentication where possible.

• Secure systems.

• Regular software updates.

• Restricted access permissions.

​

Physical Security

• Secure storage of paper records.

• Locked cabinets.

• Controlled office access.

• Secure disposal procedures.

​

13. Staff and Volunteer Responsibilities

Everyone working with BLAS must:

• Understand data protection responsibilities.

• Keep information confidential.

• Follow security procedures.

• Report concerns immediately.

• Complete relevant training.

Failure to protect information may result in disciplinary action.

​

14. Access Control

Access to personal information will be limited according to role requirements.

BLAS will apply:

• Need-to-know access.

• User permissions.

• Password protection.

• Secure account management.

Access rights will be reviewed regularly.

​

15. Data Sharing

BLAS may share information with:

• Partner organisations.

• Referral agencies.

• Legal representatives.

• Government agencies.

• Safeguarding authorities.

Information sharing will only occur where:

• There is a lawful basis.

• It is necessary.

• Appropriate safeguards exist.

​

16. Data Sharing Agreements

Where BLAS regularly shares information with another organisation, appropriate agreements will be established.

These may include:

• Data Sharing Agreements.

• Data Processing Agreements.

• Confidentiality Agreements.

​

17. Client Rights

Under UK GDPR, individuals have rights including:

Right to be Informed

Individuals have the right to understand how their data is used.

​

Right of Access

Individuals may request copies of their personal information.

​

Right to Rectification

Individuals may request corrections.

​

Right to Erasure

Individuals may request deletion where appropriate.

​

Right to Restrict Processing

Individuals may request limited use of their information.

​

Right to Data Portability

Individuals may request their information in a usable format.

​

Right to Object

Individuals may object to certain processing activities.

​

18. Subject Access Requests (SARs)

Individuals may request access to their personal information.

BLAS will:

• Verify identity.

• Respond within one month where applicable.

• Provide information clearly.

• Maintain records of requests.

Requests should be submitted to the Data Protection Lead.

​

19. Data Breaches

A data breach includes:

• Loss of personal information.

• Unauthorised access.

• Accidental disclosure.

• Theft.

• Cyber attack.

Examples:

• Sending information to the wrong person.

• Losing a laptop containing personal data.

• Unauthorised access to client records.

​

20. Data Breach Procedure

Where a breach occurs:

1. Report immediately to the Data Protection Lead.

2. Contain the breach.

3. Assess the risk.

4. Record the incident.

5. Notify the Information Commissioner's Office (ICO) where required.

6. Inform affected individuals where necessary.

​

21. Data Retention

BLAS will maintain a Data Retention Schedule.

Retention periods will consider:

• Legal obligations.

• Client service requirements.

• Funding requirements.

• Regulatory expectations.

Information will be securely deleted when no longer required.

​

22. Disposal of Information

Personal information must be securely disposed of through:

• Confidential shredding.

• Secure deletion.

• Approved disposal services.

​

23. Remote Working

Staff and volunteers working remotely must:

• Use approved systems.

• Protect devices.

• Avoid public Wi-Fi where possible.

• Prevent others accessing confidential information.

• Follow BLAS security procedures.

​

24. Email and Communication Security

Individuals must:

• Check recipients carefully.

• Avoid sending unnecessary personal information.

• Use secure methods for sensitive information.

• Avoid forwarding confidential information unnecessarily.

​

25. Training and Awareness

BLAS will provide training covering:

• GDPR responsibilities.

• Confidentiality.

• Cyber security.

• Data handling.

• Incident reporting.

Training will be refreshed periodically.

​

26. Monitoring and Compliance

BLAS will monitor compliance through:

• Data audits.

• Policy reviews.

• Training records.

• Incident reviews.

• Access reviews.

​

27. Data Protection Officer / Lead Responsibilities

The Data Protection Lead will:

• Monitor GDPR compliance.

• Provide advice.

• Manage data requests.

• Investigate incidents.

• Maintain documentation.

• Liaise with the ICO where required.

​

28. Complaints

Individuals may raise concerns about data handling through:

• BLAS Complaints Procedure.

• Data Protection Lead.

• Information Commissioner's Office (ICO).

 

29. Relevant Legislation

This policy reflects:

• UK General Data Protection Regulation (UK GDPR)

• Data Protection Act 2018

• Privacy and Electronic Communications Regulations (PECR)

• Freedom of Information Act 2000 (where applicable)

• Equality Act 2010

• Human Rights Act 1998

 

30. Related BLAS Policies

This policy should be read alongside:

• Constitution & Governance Framework

• Code of Conduct Policy

• Confidentiality Policy

• Cyber Security Policy

• Information Security Policy

• Safeguarding Policy

• Complaints Policy

• Whistleblowing Policy

• Records Retention Policy