Data Protection Policy

1. Purpose

1.1 Purpose

The purpose of the Data Protection Policy is to set out what the Bank needs to do as a minimum to comply with data protection legislation.

Personal data is defined as “Information identifying a Data Subject or information relating to a Data Subject that BBB can identify (directly or indirectly) from that data alone or in combination with other identifiers BBB possess or can reasonably access. Personal Data includes Special Categories of Personal Data and Pseudonymised Personal Data, but excludes anonymous data or data that has had the identity of an individual permanently removed. Personal data can be factual (for example, a name, email address, location or date of birth) or an opinion about that person’s actions or behaviour”.

This Policy forms part of the Risk Management Framework and should be read in consultation with the associated standards and procedures that help set out what is expected of colleagues when handling personal data. The full list of definitions used in this Policy is available at Section 7.

1.2 Legal & Regulatory Obligations

The applicable laws include the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.

In addition to meeting its legal obligations, the BBB as an Arm’s Length Body (ALB) is required to meet the Government Functional Standards where applicable. Obligations relating to Government Functional Standard (GFS005) – Digital, Data and Technology and GFS007 – Security activity elements are contained and prescribed through this policy and associated standards.

1.3 Alignment to Risk Appetite

This Policy sits under the Level One Risk category, Operational and Resilience Risk.

It aligns to the Level Two Risk Category, Information Management, which is defined as ‘The risk of failing to treat information as a strategic asset, appropriately manage and maintain the organisation’s information across its lifecycle to support its necessary use, resilience, integrity and availability.’

BBB’s Risk Appetite Data Management is Medium.

The correct handling of personal data is vital to achieving BBB’s strategic objectives while complying with its legal and regulatory obligations.

2. Scope

This Policy applies to all BBB entities, operations and subsidiaries, and Colleagues. It also applies in part to third parties that are contracted to process personal data for or on our behalf, in particular where the third party is a data processor, or we have instructed a third party to carry out direct marketing on our behalf.

It does not form part of any employees’ contract of employment, and we may amend it at any time.
This Policy applies to all BBB Personal Data we process regardless of where the data is stored, its age, format, or whether it relates to past or present employees, workers, customers, clients or supplier contacts, shareholders, website users or any other Data Subject.

3. Requirements

3.1 Data Protection Principles

The data protection principles are key to data protection law and determine that Personal Data shall be:

1. Processed fairly, transparently and lawfully
2. Processed only for specified and not incompatible purposes
3. Adequate, relevant and necessary for the purpose
4. Accurate and, where necessary, kept up-to-date
5. Not kept longer than necessary for the purpose
6. Kept secure by technical/organisational means

The seventh principle requires the Controller [BBB] shall be responsible for, and be able to demonstrate compliance with, the above principles.

3.2 Accountability

To comply with the data protection principles, we

1. Register the British Business Bank plc as a Data Controller (and any other of its entities that act as a Data Controller) with the Information Commissioner’s Office for inclusion on the Register of fee payers (registration No. ZA084015)
2. Appoint a Data Protection Officer and register their name, contact details and address with the Information Commissioner’s Office
3. Maintain a Record of Processing Activities to identify the business activities that process Personal Data as required by law (GDPR Article 30) and know what lawful basis applies to the data processing.
4. Minimise the Personal Data we collect and challenge ourselves at the beginning of and during our business activities to ensure the Personal Data attributes are relevant, necessary and appropriate.
5. Ensure the Personal Data we process is managed, so that it is accurate, meaningful and complete. 
6. Adopt privacy by design principles to avoid or remove excessive Personal Data from our processing using, where possible, aggregated, anonymised, or pseudonymised data or in the case of testing and training, fictitious data.
7. Provide Data Subjects with a privacy statement or privacy notice when we collect their Personal Data to make clear what Personal Data we need and why and all the required information as set by law. Where a short privacy statement is used, it must include reference to the relevant privacy notice and how it can be accessed. Privacy notices and statements to be reviewed at least once a year to ensure they are accurate and up to date. 
8. Tell Data Subjects if we process their Personal Data that we have obtained from a third party and to do so within one month of us receiving the information unless one of the following exceptions apply: the Data Subjects already know, it would be a disproportionate effort, or disclosure is restricted by another law or regulation. 
9. Evidence the consent decisions from Data Subjects for the processing of their Personal Data to confirm what the Data Subjects consented to and when, that it was a real choice, easy to understand, freely given and an affirmative action (not vague, packaged, conditional, or an opt out). Consent can be withdrawn at any time and such decisions must be recorded. 
10. Maintain a suppression list of the names and contact details of any Data Subjects or business that has confirmed they do not wish to receive any direct marketing or any other communications about our market research, consultation or events. Such requests must be actioned promptly and in effect within one month.

11. Action requests from Data Subjects (or their representatives) exercising their data protection rights to:

    • withdraw their consent;
    • access the Personal Data we hold about them;
    • be informed as to why we hold their Personal Data and what we do with it;
    • have their Personal Data corrected, erased, restricted, transferred to another controller; or
    • ask for a manual review of an automated decision that has a significant effect on them.

    Such requests must be actioned promptly and completed within one month

12. Complete a Data Protection Impact Assessment Screening Questionnaire as part of all business change, scheduled projects or business activities that involve new or significant changes to the way Personal Data is intended to be processed.
13. Complete Data Privacy Impact Assessments for processing that has been identified as having high inherent risks to the privacy rights and freedoms of individuals to ensure the risks can be managed to an acceptable level or a decision made as to the appropriateness of the proposed processing. 
14. Share Personal Data where it is lawful and appropriate to do so. We aim to adhere to the Information Commissioner’s recommendations and ensure all regular sharing with third parties is covered under a written agreement or contract and keep a record of all ad hoc sharing so we know what personal data has been shared, when, why and with whom. If you receive a request to share or disclose Personal Data, please forward the request to the Data Protection Office at [email protected], so it can be logged, tracked and advice given before the sharing takes place.
15. Register the restricted transfers of Personal Data to third countries and to carry out the appropriate data transfer risk assessments. Restricted transfers apply to the transfer of personal data to countries that do not have a data protection adequacy agreement with the UK, but also includes situations where a third party can access BBB data from countries that don’t have the UK adequacy agreement. 
16. Ensure contracts with third party suppliers and delivery partners are compliant with data protection and security requirements with appropriate due diligence, data processing clauses and agreements, risk assessments and audits to protect the Personal Data throughout the contract period and make appropriate provisions for the return, retention or disposal at the end of the contract. 
17. Ensure appropriate organisational and technical measures are in place, within the Bank and its third party contractors and delivery partners, to protect the Bank from Personal Data breaches that may result in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data, and help ensure the ongoing confidentiality, integrity, availability and resilience of the processing systems and services as well as the ability to restore Personal Data in a timely manner. 
18. Retain Personal Data for only as long as we need to and delete or destroy Personal Data in a timely and secure manner in line with the Bank’s Record Retention Schedule and / or the Record of Processing Activities.
19. Mandate all Employees (and authorised users) complete the Bank’s data protection and information security training within one month of their start date and again as part of the annual training programme. The training content will be reviewed every year and updated accordingly.
20. Report personal data breaches via the Bank’s Incident Portal to help determine if the Data Protection Officer must notify the Information Commissioner within the statutory timescale of 72 hours and / or the affected data subjects. 
21. Manage complaints about the handling of Personal Data in line with the Bank’s Complaints Handling procedure.

3.3 Record keeping

Data protection accountability relies on good record keeping, so that the Bank can evidence or reflect on its actions and decisions and demonstrate compliance with the law.

4. Roles and Responsibilities 

4.1 All Colleagues

Data Protection is everyone’s responsibility. All colleagues are required to adhere to this policy to help comply with data protection law and to enable the Bank to meet its data protection obligations. 

4.2 Data Owners 

The Data Owner role is defined in the Data Management Policy and for the purpose of this Policy are responsible for the Personal Data within their respective business areas and ensuring its integrity, confidentiality and availability and overall protection.

4.3 Data Stewards 

The Data Steward role is defined in the Data Management Policy and act on behalf of the Data Owners, and for the purpose of this Policy will take an active role in protecting Personal Data by contributing to the creation and maintenance of key records such as the Records of Processing Activity, Data Protection Impact Assessments, Data Sharing Agreements, and Privacy Notices. 

4.4 Risk Champions 

Risk Champions review the Business Area risks via the Risk Control Self-Assessment (RCSA) process to help identify and manage information risks, including data protection risks, to an acceptable level on behalf of the Data Owner. 

4.5 Board Risk Committee (BRC)

The BRC is the approval body for this Policy and is responsible for its review and approval on a bi-annual basis or whenever major changes are submitted.

4.6 Executive Committee

The BRC has delegated responsibility to the Executive Committee to provide management oversight regarding the implementation of this Policy and to recommend necessary changes.

4.7 Chief Operating Officer 

The Chief Operating Officer is the Policy owner and custodian for the development and endorsement of this Policy.

4.8 Data Protection Officer (DPO)

The Bank is required to appoint a DPO to help the Bank fulfil its data protection obligations by: 

• Informing and advising on our data protection obligations
• Monitoring our compliance with data protection laws
• Raising awareness and providing data protection training
• Advising on Data Protection Impact Assessments (DPIA)
• Liaising with the Information Commissioner’s Office in relation to customer complaints 
• Reporting any breaches of data protection law and regulations to the ICO
• Ensuring data protection risks are managed appropriately.

The DPO is not liable for the Bank’s compliance with its data protection obligations; the Bank remains accountable for complying with data protection obligations regardless of whether the DPO is an employee or a contracted third party. 

The DPO is supported by a Data Protection Office which includes support from BBB colleagues as appropriate.

5. Non-Compliance

This Policy sets out what we expect from you to ensure BBB complies with applicable laws and regulations.

The Bank’s failure to comply with data protection law, either deliberately or accidentally, can have significant consequences to the data subjects whose data has been processed and to the organisations that processed the Personal Data. Data subjects have the right to receive compensation (GDPR Article 82) and the UK’s Supervisory Authority (Information Commissioner’s Office) has enforcement powers that include issuing monetary fines up to £17.5 million or 4% of an organisation’s annual turnover (GDPR Article 83) for infringements of certain provisions in the law, see Appendix A for details.

Compliance is mandatory and any breach may lead to disciplinary action, which could result in dismissal, and in some cases, individuals can be prosecuted, see Appendix B.

Operational Control and the Data Protection Officer will monitor compliance with this policy. 

6. Aligned Standards and Procedures

Personal Data is processed in a large number of business activities and therefore features in the majority of business processes, policies, standards and procedures. The list below covers the main documents that will help colleagues comply with this Policy:

• Data Protection Impact Assessments Standard
• Data Protection Rights Standard
• Personal Data Sharing Standard
• Direct Marketing and PECR Standard (TBC)
• Data Management Policy (and accompanying standards) 
• Supplier Management Policy, Procurement and Contracting Standards 
• Records Management Policy (and accompanying Standard) 
• Records Retention Schedule 
• Risk Incident Review Reporting Procedure 
• Disclosing Personal Data to Third Parties Procedure 
• Information Classification and Handling Standard 
• Pseudonymisation and Anonymisation Standard 
• Information Security Policy 
• IT Acceptable Use Policy

7. Policy Controls 

The Policy controls are visible here: Data Protection Policy Controls - Power BI

8. Definition of Terms