GDPR, Data Protection and Confidentiality Policy
| Policy Number: 35 | Version: 2.1 | Issue Date: Feb 2026 |
| Location | Cintra People; Policies Hub; NMT Website | ||
| Policy Number | 35 | Version | 2.0 |
| First Implemented | Sep-20 | Last Issued | Sep-20 |
| Last Reviewed | Feb-26 | Review Cycle | Annual |
| Owner | Operations Manager | ||
| Approver(s) | · Learning Services Manager
· Safeguarding Manager · Senior Management Team · Board |
||
| Distribution | Internal and External | ||
Revision History
| Version | Approved | Section | Change Summary |
| 2.0 | Feb 2026 | All | Combined Data Protection and Confidentiality Policies; amended policy name to “GDPR Data Protection and Confidentiality”. |
| Updated to new document format. | |||
| All sections reviewed and updated for current relevancy in line with business growth. | |||
| Removed any processes or procedures from the policy – separate process guide created. | |||
| 2.1 | Feb-26 | 5.0 | 5.0.1 Reference to 6.3 amended to 4.5.5
5.0.2 Reference to 1.4 amended to 2.2 |
Versioning
- Major Versions (1.0, 2.0, 3.0 etc.) represent change(s) requiring formal release, e.g., Employee:
- Training / Education
- Email Communication
- In-Person Briefing
- Acknowledgement via Cintra People
- Minor Versions (1.1, 1.2, 1.3 etc.) represent changes not requiring formal release, e.g.:
- Spelling or grammatical change
- Formatting change
- Update of contact information
2.0 Roles and Responsibilities. 8
2.1 Organisational Responsibility. 8
2.2 Role of the Data Controller 8
2.3 Responsibilities of NMT Employees. 8
3.0 Data Collection and Processing.. 9
3.2 Types of Personal Data Collected.. 9
3.5 Data Security Measures. 11
3.7 Data Retention and Disposal 12
3.8 Third-Party Processors. 12
4.0 Use of Audio and Visual Data. 12
4.1 Enrolment Identification. 12
4.2 Image and Audio Data as Evidence of Learning.. 12
4.3 External Organisation Image and Audio Data Capture. 13
4.4 Audio and Visual Data for Marketing Purposes. 13
4.5 Agreement to Use of Audio and Visual Data for Marketing Purposes. 13
4.6 Agreement Requirements for Visual and Audio Data Use. 14
4.7 Safeguarding Consideration. 14
6.1 Conditions of Sharing Personal Data. 15
6.2 Transparency and Accountability. 16
7.1 Definition of Confidentiality. 16
7.2 Learner Confidenitality. 16
7.3 Employees and Volunteers. 17
Implementation and Communication. 18
Appendix A – The Personal Data Carership Code. 19
Appendix B – Document Retention and Storage Guidance. 20
B.2 Qualification Assessment Information. 20
1.0 Purpose
1.0.1 This policy sets out New Meaning Training’s (NMT) commitment to protecting personal data and maintaining confidentiality. It ensures that all individuals handling personal information understand their responsibilities and adhere to established data protection procedures. NMT acknowledges the necessity of collecting and retaining certain information about its learners, employees, clients, partners, and sponsors to effectively conduct its operations, achieve organisational objectives, and comply with legal requirements. Confidentiality is fundamental to fostering trust within the organisation. NMT is committed to respecting and always safeguarding personal information, except where disclosure is required to address safeguarding concerns.
1.0.2 NMT is committed to ensuring any personal data will be dealt with in line with The Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR). To comply with the law, personal information will be collected and used fairly, stored safely and shared in a manner that respects individuals’ privacy rights, maintains its accuracy, and protects it from unauthorised access, misuse or loss.
1.0.3 The Data Protection Act 2018 principles detail the factors to be considered when handling personal data. In line with the Data Protection Act 2018 principles, NMT will ensure that personal data will:
- be obtained fairly and lawfully and shall not be processed unless certain conditions are met.
- be obtained for a specific and lawful purpose.
- be adequate, relevant but not excessive.
- be accurate and kept up to date.
- not be held longer than necessary.
- be processed in accordance with the rights of data subjects.
- be subject to appropriate security measures.
- not to be transferred outside the European Economic Area (EEA).
1.0.4 The Personal Data Carership Code (Appendix A) outlines good data governance on which best practice is based.
1.1 Scope
1.1.1 This policy applies to the following key groups:
- All learners enrolled in NMT programmes are covered by this policy and all related policies listed under section 2 Related Policies. NMT’s practices regarding data use are outlined in the Enrolment Agreement, which is read and signed by the Learner during the enrolment process.
- All employees at NMT including full-time, part-time, temporary employees, volunteers, and contractors, must comply with safeguarding responsibilities, training, and reporting requirements.
- All visitors to NMT premises.
- Parents/Carers: NMT’s practices regarding data use are outlined in the Enrolment Agreement, which is read and signed by the Parent/Carer during the enrolment process.
1.2 Related Policies
1.2.1 Related policies include:
- Safeguarding and Prevent Policy
- CCTV Policy
- Document Retention and Storage Policy
- Safe Recruitment Policy
1.3 Terms and Definitions
| Term | Definition |
| Personal Data | Any information relating to an identified or identifiable individual. |
| Processing | Any action performed on personal data (e.g., collection, storage, use deletion) including obtaining, using, holding, amending, disclosing, destroying and deleting personal data. This includes some paper based personal data as well as that kept on computer. |
| Data Subject | The individual to whom the data belongs. |
| Data Controller | New Meaning Training (represented by the Operations Director). |
| Confidential Information | Sensitive information shared in trust, particularly by learners. |
| Agreement | Permission in relation to use of personal data. |
2.0 Roles and Responsibilities
2.1 Organisational Responsibility
2.1.1 In accordance with the Personal Data Carership Code, overall responsibility for the management and protection of personal data lies with the organisation’s governing body. For New Meaning Training (NMT), this is the Board of Directors.
2.2 Role of the Data Controller
2.2.1 The Data Controller within NMT as specified in the notification to the Information Commissioner is David Lett, Operations Director.
2.2.2 The needs NMT has for processing personal data are recorded on the public register maintained by the Information Commissioner. NMT notifies and renews its notification on an annual basis as the law requires. If there are any interim changes, these will be notified to the Information Commissioner within 28 days.
2.2.3 The Board delegates operational responsibility to the Data Controller, who is accountable for:
- Understanding and communicating the organisation’s obligations under the Data Protection Act 2018 and UK GDPR.
- Identifying potential risks or areas of non-compliance.
- Developing and maintaining clear, effective data protection procedures.
- Ensuring timely notification and annual renewal of registration with the Information Commissioner’s Office (ICO), including updates for any relevant changes.
2.3 Responsibilities of NMT Employees
2.3.1 All employees who handle personal data must understand and comply with this policy and the principles of data protection. They are expected to:
- Collect personal data fairly, lawfully, and transparently.
- Clearly explain the purpose for data collection at the point of collection.
- Limit data collection and use to what is necessary for the intended purpose.
- Ensure data is accurate and kept up to date.
- Regularly review data retention periods and securely dispose of data no longer required.
- Store personal data securely to prevent unauthorised access or loss.
- Support individuals in exercising their rights under data protection legislation.
2.4 Policy Compliance
2.4.1 Failure to comply with this policy may result in formal disciplinary action, up to and including dismissal, depending on the severity of the breach.
3.0 Data Collection and Processing
3.1 Data Collection
3.1.1 Before personal information is collected, NMT will consider:
- the sensitivity of the information.
- how it will be stored.
3.1.2 NMT will inform individuals whose information is gathered about the following:
- how the information is stored.
- why it is being collected.
- who will have access to it.
3.2 Types of Personal Data Collected
3.2.1 In delivering education services and related activities, NMT may collect, record and process the following categories of personal data:
- Personal Identification Data
- Name, date of birth, gender
- Contact information (address, phone number, email)
- Photographic identifiers
- Education and Academic Records
- Enrolment and registration details
- Attendance records
- Assessment and exam results
- Learning progress and achievements
- Special educational needs or learning support information including Education Health Care Plans (EHCPs) and supporting documentation
- Health and Wellbeing Data
- Medical, health, disability or additional support information relevant to learning or safeguarding
- Allergies or dietary requirements
- Safeguarding and Behavioural Information
- Disciplinary records
- Child protection or safeguarding information
- Reports of incidents or accidents
- Financial and Administrative Data
- Fee payments, invoices, and funding information
- Bank details for refunds or payments (where necessary)
- Employment data for employees or work placements
- Communications and Engagement Data
- Emails, letters, or other correspondence with employees, learners, parents/carers or external professionals
- Attendance at events or extracurricular activities
- Audio/Visual Data
- Photographs, video/audio recordings, and CCTV footage. See section 4.0.
- Online and IT Data
- Login credentials and authentication details
- Usage of online learning platforms and resources
- IP addresses or device identifiers for network security
3.3 Data Accuracy
3.3.1 NMT will take the following measures to ensure that personal information is kept accurate:
- by sending reminders asking individuals to review and update their personal information, if necessary.
- by asking individuals to confirm that NMT may continue to hold their information.
3.4 Data Use
3.4.1 Personal sensitive information will not be used other than for the exact purpose for which permission was given.
3.4.2 NMT processes personal data under the following lawful bases, as defined by Article 6 of UK GDPR:
- Agreement: The individual has clearly indicated they agree to the terms under which NMT will process their data.
- Contract: Processing is necessary for a contract with the individual.
- Legal obligation: Processing is necessary for a contract with the individual.
- Vital interests: Processing is necessary to protect someone’s life.
- Public task: Processing is necessary to perform a task in the public interest.
- Legitimate interests: Processing is necessary for the organisation’s legitimate interests, provided it does not override individual rights.
3.5 Data Security Measures
3.5.1 NMT will ensure personal data is kept secure against unauthorised or unlawful loss or disclosure through the following measures:
- All paper based personal data will be stored in a locked cabinet.
- All sensitive electronic personal data is stored securely, accessible only with NMT-issued credentials. Access to sensitive information is restricted to individuals with a valid Disclosure and Barring Service (DBS) Multi-factor authentication provides an additional layer of security for all users.
- All sensitive information and documents will be sent via a secure, encrypted email service.
3.5.2 Any unauthorised disclosure of personal data to a third party may result in disciplinary action and could lead to formal dismissal, whether by an employee, volunteer or trustee.
3.6 Data Breach
3.6.1 NMT takes information security seriously, but in today’s environment, security breaches can occur, potentially leading to the unauthorised loss, access, deletion or alteration of personal data.
3.6.2 The three main types of personal data breaches are:
- Confidentiality breach – unauthorised or accidental disclosure of, or access to, personal data (e.g. hacking, accessing restricted systems, lost devices containing data, social engineering, misdirected letters or emails, or disclosing data to the wrong person.)
- Availability breach – accidental or unauthorised loss of access to, or destruction of, personal data (e.g. lost devices, denial of service attacks, ransomware, accidental deletion, system failures, or loss of encryption keys).
- Integrity breach – unauthorised or accidental alteration of personal data.
3.6.3 In the event of a data breach, NMT will take all necessary steps to contain the breach, assess its impact, and mitigate any risk to individuals. Appropriate notifications will be made in line with legal and regulatory requirements, and measures will be implemented to prevent recurrence. NMT is committed to responding promptly and responsibly to protect the rights and interests of those affected.
3.7 Data Retention and Disposal
3.7.1 Personal data will be retained for no longer than necessary to fulfil the purpose for which it was collected. Retention periods for learner records are detailed in the Document Retention and Storage Guide (Appendix B).
3.7.2 When personal data is no longer required for operational, legal, or regulatory purposes, NMT will ensure it is securely destroyed using appropriate methods, such as shredding for paper records and permanent deletion for electronic data. All destruction processes will be carried out in a way that prevents unauthorised access, retrieval, or misuse.
3.8 Third-Party Processors
3.8.1 Where NMT engages third-party processors (e.g. cloud storage providers, awarding bodies, IT services), data processing agreements are put in place to ensure compliance with data protection laws. These processors must:
- Act only on NMT’s documents instructions.
- Implement appropriate technical and organisational measures to protect personal data.
- Not subcontract any processing without NMT’s prior approval.
- Not transfer data outside the UK/EEA without adequate safeguards.
3.8.2 NMT will conduct due diligence on all data processors and monitor their compliance with agreed terms.
4.0 Use of Audio and Visual Data
4.1 Enrolment Identification
4.1.1 A photograph of each Learner will be taken at the time of enrolment. This photograph is used strictly for identification and administrative purposes.
4.2 Image and Audio Data as Evidence of Learning
4.2.1 As part of its commitment to maintaining high standards in education and training, NMT takes photographs, videos, and audio recordings of Learners while they are engaged in activities related to their education programme. These materials are used for quality assurance purposes and to provide evidence of Learner progress.
4.2.2 All photographs, videos, and recordings are considered essential to the delivery and monitoring of the programme. Learners cannot opt out of this process, as it forms a core part of internal operations, quality assurance, and safeguarding.
4.2.3 These materials will not be published or shared externally without specific written agreement.
4.3 External Organisation Image and Audio Data Capture
4.3.1 From time to time, NMT may engage external companies to capture or document activities, or to work with Learners on projects related to their education pathway. In such instances, NMT will carry out appropriate due diligence to ensure all necessary data protection, safeguarding, and confidentiality protocols are being followed.
4.3.2 All external parties will be required to operate under a written agreement outlining their responsibilities, including compliance with data protection legislation, secure handling of any personal data, and restrictions on the use or sharing of materials captured. NMT will maintain oversight of any data processing or media production activities to ensure they align with organisational policies and lawful processing bases.
4.4 Audio and Visual Data for Marketing Purposes
4.4.1 As part of its commitment to celebrating achievement and promoting its educational services, NMT may capture photographs, videos audio recordings and stories featuring Learners, Employees and the NMT community. These materials may be used for marketing and promotional purposes, including sharing success stories, highlighting Learner achievements, and showcasing NMT’s contribution to the wider community.
4.4.2 At NMT events, attendees will be informed when photography or video is taking place. Safeguarding oversight is required.
4.4.2 Permissions for the use of photographs, videos, audio recordings, and stories will be obtained as outlined in Section 4.5. NMT will ensure that appropriate agreement is sought prior to using any identifiable personal data for marketing or promotional purposes, and that individuals are informed of their right to withdraw permission at any time.
4.5 Agreement to Use of Audio and Visual Data for Marketing Purposes
4.5.1 NMT operates an opt-in model for the identifiable use of learner and employee images (such as foreground images, named contributions, and direct quotes) in publicity and marketing materials. Such use requires the individual’s explicit agreement.
4.5.2 Photographs or videos that include groups of people, or where individuals appear incidentally, may be used without obtaining separate permission from each person. In such cases, NMT relies on its legitimate interests as outlines in the enrolment agreement.
4.5.3 Before any image or recording is used, it will be reviewed to ensure it is appropriate and compliant with safeguarding and privacy standards. If an individual appears who should not be shown, the image will be edited or blurred or excluded as necessary.
4.5.4 Legacy materials (captured before prior to the implementation of this policy) may continue to be used under the previous opt-out approach, provided they are reviewed for suitability before any reuse. These materials must not be used again if an agreement is withdrawn.
4.5.5 Agreement may be withdrawn at any time by emailing data@newmeaning.training
4.5.6 Third-party use (e.g. funders, employers or referral partners) of materials requires explicit approval from NMT and must comply with safeguarding and data protection requirements.
4.6 Agreement Requirements for Visual and Audio Data Use
4.6.1 NMT recognises that individuals aged 16 and over are generally able to provide their own permission for the use of identifiable images, videos, or audio recordings, unless specific capacity or safeguarding concerns have been identified.
4.6.2 For learners under the age of 16, in cases where capacity is uncertain, or for learners of any age who hold an Education, Health and Care Plan (EHCP) written permission must also be obtained from a parent or carer before any identifiable material is used.
4.7 Safeguarding Consideration
4.7.1 Regardless of any signed agreement, NMT reserves the right to override permission if the Designated Safeguarding Lead determines that publication could pose a risk to the safety or wellbeing of any individual.
5.0 Data Subject rights
5.0.1 Anyone whose personal information is processed by NMT has the right to:
- Know what information we hold and how it is processed.
- Be informed about the how their data is used.
- Understand how to access their personal data.
- Submit a Subject Access Request (SAR) to obtain their data.
- Object to data processing or withdraw permission where applicable.
- Individuals may withdraw their agreement for the use of their data in marketing / media at any time (see section 4.5.5).
- Request correction or deletion of inaccurate or unnecessary data.
- Request data portability where applicable.
- Restrict processing in certain conditions.
- Be informed of NMT’s compliance with the Data Protection Act 2018 and UK GDPR.
5.0.2 Individuals also have the right to:
- Prevent processing of their personal data in specific circumstances.
- Correct, rectify, block, or erase data that is inaccurate or unlawfully processed.
5.0.3 Under the Data Protection Act 2018 and UK GDPR, individuals have the right to access personal data held about them. Requests should be made in writing to the Data Controller. SARs can also be submitted verbally or via social media, but written requests are preferred for clarity (refer to section 2.2).
5.0.4 In most cases, NMT will not charge a fee for processing a SAR. However, a reasonable fee may be charged if the request is manifestly unfounded, excessive, or repetitive. Before access is granted, the following information is required:
- Full name and contact details of the requester.
- Their relationship with NMT (e.g., employee, trustee, volunteer, service user).
- Proof of identity (e.g., passport, birth certificate).
5.0.5 NMT aims to respond to Subject Access Requests (SARs) promptly and in accordance with applicable data protection legislation. Where requests are complex or involve multiple elements, the response period may be extended in line with statutory provisions.
5.0.6 If an individuals is not satisfied with how NMT has handled their personal data or responded to a request, they have the right to lodge a complaint with the Information Commissioner’s Office (ICCO): www.ico.org.uk.
6.0 Disclosing Data
6.1 Conditions of Sharing Personal Data
6.1.1 Personal data will only be shared under the following lawful and justifiable circumstances:
- With Agreement: Where explicit, informed permission has been provided by the data subject, either in writing or through a secure digital method.
- Legal Obligation: When required to comply with a legal duty, such as a court order or statutory request from authorised bodies (e.g., law enforcement or safeguarding authorities).
- Vital Interests: Where it is necessary to protect someone’s life or prevent serious harm.
- Legitimate Interest: Where there is a clear and lawful organisational or third-party interest, provided this does not override the rights and freedoms of the individual.
6.2 Transparency and Accountability
6.2.1 All disclosures of personal data will be documented in a secure log. Where lawful and appropriate, the data subject will be informed of the disclosure.
7.0 Confidentiality
7.1 Definition of Confidentiality
7.7.1 Confidentiality is the duty to safeguard personal, sensitive, or proprietary information from access or disclosure by unauthorised individuals or organisations. It ensures that such information is accessed, shared, or used only when necessary, appropriate, and legally permitted.
7.7.2 This obligation applies across all formats (verbal, written, and electronic) and must be upheld throughout the duration of a professional relationship and beyond its conclusion.
7.7.3 Maintaining confidentiality is essential to building trust, protecting privacy, and ensuring compliance with relevant laws, policies, and contractual agreements.
7.2 Learner Confidenitality
7.2.1 NMT is committed to creating a safe and supportive environment where learners feel confident sharing personal information with staff. All employees are expected to handle such information with sensitivity and discretion.
7.2.2 Learners can expect that any information they share with an employee will be treated as confidential. However, confidentiality may be lawfully breached in the following circumstances:
- Safeguarding Concerns – if an employee believes that the learner, or another individual, is at risk of harm or in danger, they are obligated to share the information with appropriate safeguarding agencies. Wherever possible, the learner will be informed of this decision and encouraged to support the referral.
- Terrorism Disclosures – if a learner discloses involvement in, or intent to engage in, acts of terrorism, the employee is legally required to report this information to the relevant authorities under the Prevent Duty.
7.3 Employees and Volunteers
7.3.1 All employees and volunteers at NMT are expected to uphold the organisation’s commitment to confidentiality. This includes the responsibility to:
- Store records, files, and documents securely to prevent unauthorised access.
- Refrain from discussing any information shared by a learner in confidence, unless there is a safeguarding concern or the learner has given explicit permission.
- Clearly inform a learner when information cannot remain confidential (e.g. in cases involving safeguarding).
- Encourage learners to speak with trusted individuals (such as parents, carers, or professionals) when it is believed to be in their best interest.
7.3.2 Employees and volunteers at NMT can expect the organisation to:
- Provide appropriate and secure systems for storing confidential documents.
- Ensure that their own personal information (e.g. medical or emergency contact details) is stored securely, kept confidential, and accessed only by authorised personnel when necessary for their role.
- Safely dispose of personal information when an individual ceases their role with the organisation.
- Take appropriate disciplinary action if the Data Protection and Confidentiality Policy is breached, except where disclosure is required by safeguarding obligations or a court order.
7.4 Parents/Carers
7.4.1 Parents/Carers of learners attending NMT can expect that the information they provide (e.g. medical information, contact information) will:
- Be stored securely and treated as confidential, used solely for the purpose it was provided—primarily to support the health, safety, and wellbeing of the learner).
- Be used to ensure parents and carers receive relevant communications, such as newsletters, updates, and course-related information.
- Never be sold or shared for commercial purposes.
- Not be disclosed to other organisations without prior, informed permission.
Implementation and Communication
- NMT will make this policy available to all via:
- Cintra People
- POLICIES HUB SharePoint
- NMT Website
- NMT will inform all Employees / alert all Employees of changes to this policy via:
- All Employee email.
- Cintra People communication.
- Weekly all Employee update communication.
- NMT will ensure that:
- Employees managing and handling personal information is trained to do so.
- Anyone wanting to make enquiries about handling personal information, whether an employee, volunteer or service user, knows what to do.
- Any disclosure of personal data will be in line with NMT’s procedures.
- Queries about handling personal information will be dealt with swiftly and politely.
- Training and awareness raising about the Data Protection Act 2018 and how it is followed at NMT will take the following forms:
- On induction: all employees receive mandatory GDPR and confidentiality training. The data protection and confidentiality policy is provided to all new employees, and they are asked to sign that they have read it.
- General training/awareness raising: once every 2 years all employees are asked to re-read the policy.
- Regular audits and policy reviews: to ensure compliance.
Appendix A – The Personal Data Carership Code
The Personal Data Carership Code suggests five key principles of good data governance on which best practice is based. The organisation will seek to abide by this code in relation to all the personal data it processes.
| Term | Definition |
| Accountability | Those handling personal data follow publicised data principles to help gain public trust and safeguard personal data. |
| Visibility | Data subjects should have access to the information about themselves that an organisation holds. This includes the right to have incorrect personal data corrected and to know who has had access to this data. |
| Consent (referred to by NMT as “agreement”) | The collection and use of personal data must be fair and lawful and in accordance with the DPA’s eight data protection principles. Personal data should only be used for the purposes agreed by the data subject. If personal data is to be shared with a third party or used for another purpose, the data subject’s permission should be explicitly obtained. |
| Access | Everyone should have the right to know the roles and groups of people within an organisation who have access to their personal data and who has used this data. |
| Stewardship | Those collecting personal data have a duty of care to protect this data throughout the date life span. |
Appendix B – Document Retention and Storage Guidance
B.1 Enrolment Information
Information that must be kept for seven years:
- Learner name and date of birth
- Learner address and telephone number
- NOCN learner number and/or ULN
- Regulator reference and title of the qualifications the learner was registered on
- Date of the qualification achievement
- Grade of the qualification (if applicable)
- Reasonable Adjustment and Special Consideration forms, along with their supporting evidence
B.2 Qualification Assessment Information
Information that must be kept for a minimum of three years:
- Functional Skills Maths and English:
-
- Initial assessments
- Sample (mock) exam papers (all levels)
- Entry level exam papers and mark schemes
- SLC assessment papers, recordings and supporting evidence (power points etc.).
- Main Course Qualifications
-
- Construction – unit workbooks and photographic evidence
- Skills for Employment Training and Personal Development – all unit workbooks and photographic evidence.
- All IQA records