Adopted: 21 September 2026  |  Review Date: September 2027

This data security and bring your own device policy sets out the procedures we have put in place to maintain the security of personal data and other data within our organisation.

We are Perranzabuloe Parish Council a council in England.  Our contact details are Perranzabuloe Parish Council, Chyanhale, Ponsmere Valley, Perranporth, TR6 0DB, email: clerk@perranzabuloe-pc.gov.uk

We are a data controller for personal data as defined by all applicable data protection and privacy laws including, but not limited to, the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) (the “UK GDPR”), as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 as amended, and any successor legislation (the “Data Protection Legislation”).

This policy is binding on all employees, members and volunteers (“User” or “Users”) of Perranzabuloe Parish Council  (“The Organisation”) in order to protect Personal or other Data (“Personal Data” or “Data”) processed by the organisation.

It applies to all organised filing systems be they computer based, paper based or any other such method of organising information which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis (“Filing Systems”).

  1. Person Responsible
    1.2 The Parish Clerk is responsible for the ongoing compliance monitoring of this and other policies that are designed to achieve compliance with the Data Protection Legislation. (“the person responsible for data protection”).
    1.3 No user within the organisation shall deviate from this policy without written authorisation from the person responsible for data protection.
  2. Acceptable Use
    2.1 Data shall only be used within the organisation for the purposes of the organisation.
    2.2 Data shall not be shared with third parties or other data controllers without a data sharing agreement having been finalised and signed by the person responsible for data protection.
    2.3 Only data processors that have contracts with the organisation that have been authorised by the person responsible for data protection shall be used.
    2.4 Users processing data on behalf of the organisation are reminded of the need to keep proper records in accordance with this and other policies designed to maintain compliance with the data protection legislation and the freedom of information act.
  3. Passwords
    3.1 Users processing data on behalf of the organisation on systems that require passwords shall use a password that conforms to the following:
    3.1.1 Is sufficiently complex and is made up of at least three random unconnected words.
    3.1.2 Is not used for other logins be they personal or professional.
    3.1.3 Is not disclosed to anyone or written down.
    3.2 Passwords must not be shared amongst the organisation’s users. If a user has a legitimate need for data that they cannot access with their own password then the person responsible for data protection should be advised so that access levels may be changed if appropriate.
    3.3 Users should be aware that no one will ever ask a user for their password. Any request for a password to be disclosed should be reported to the person responsible for data protection immediately.
    3.4 Where multi factor authentication is available it shall be used.
    3.5 Multi factor authentication codes must not be disclosed to others or shared amongst the organisation’s users.
    3.6 Users should be aware that no one will ever ask a user for a multi-factor authentication code. Any request for a multi-factor authentication code to be disclosed should be reported to the person responsible for data protection immediately.
  4. Email
    4.1 The organisation does not allow users to process the organisation’s data using their own personal email accounts.
    4.2 The organisation does allow users to access email accounts provided by the organisation using their own personally owned computers, laptops, or other mobile devices but the organisation’s data must remain with the organisation’s cloud based email system and not be downloaded onto the device in question (if the information is accessible when the device in question is not connected to the internet then the data will have been downloaded on to the device).
  5. Social Media and Instant Messaging
    5.1 The organisation’s data shall not be uploaded, posted or otherwise transferred to social media (including but not limited to Facebook, Twitter, Instagram, TikTok, YouTube) without the authorisation of the person responsible for data protection.
    5.2 The organisation’s data shall not be uploaded, posted or otherwise transferred to instant messaging or collaboration services (including but not limited to Whatsapp, Teams, Skype, Facebook Messenger, Slack, Google Workspace) without the authorisation of the person responsible for data protection.
    5.3 Social media, instant messaging and collaboration services that are authorised for use in the organisation are listed in appendix A.
  6. Physical Security
    6.1 Servers shall be located in locked rooms.
    6.2 Computers shall not be left unattended without the screen being locked or the user logged out.
    6.3 Paper files shall be kept in locked filing cabinets or locked filing rooms.
    6.4 Documents no longer required shall be disposed of via secure means such as cross cut shredding or commercial document destruction.
    6.5 Where documents are disposed of by commercial document destruction they shall be disposed of securely and a certificate of destruction obtained.
    The full policy is available to view and download.