Data Protection and Confidentiality Policy
At Sensory360, we recognise that we hold sensitive and confidential information about children and their families, and the staff we work with. This information is used for contact purposes. We store all records in a locked cabinet or on the office computer, with files that are password-protected in line with data protection principles. At Sensory360, we are also registered with the Information Commissioner's Office (ICO) means that an organisation (including a company, a sole trader, or a charity) that processes personal information has paid the mandatory data protection fee, unless an exemption applies. This is a legal requirement under the Data Protection Act 2018.
Any information shared with the staff team is done on a ‘need to know’ basis and treated in confidence. This policy works alongside the GDPR privacy notice to ensure compliance under General Data Protection Regulation (Regulation (EU) 2016/679 (GDPR)) and Data Protection Act 2018.
Legal requirements
· We follow the legal requirements set out in the Statutory Guidance and accompanying regulations about the information we must hold about a child/individual and their families, and the staff allocated.
· We follow the requirements of the Data Protection Act 2018 and the Freedom of Information Act 2000 about the storage of data and access to it.
Procedures
We intend to respect the privacy of the families, and we do so by:
- Storing confidential records in a locked filing cabinet or on the office computer with files that are password-protected
- Ensuring staff, student, and volunteer inductions include an awareness of the importance of the need to protect the privacy of the individual, as well as the legal requirements that exist to ensure that information is handled in a way that ensures confidentiality. This includes ensuring that information about the child and family is not shared outside of the company, other than with relevant professionals who need to know that information. It is not shared with friends and family or part of any social discussions outside of the setting. If a breach of any confidentiality provisions, this may result in disciplinary action and, in serious cases, dismissal. All professionals involved are advised of our Data protection and confidentiality policy and required to respect it.
- Ensuring that all staff are aware that information about families is confidential and only for use within the organisation, and to support the individual’s best interests, with parental permission
- Ensuring that the individual has access to files and records of their case, but not to those of any other cases, other than where relevant professionals, such as the police or local authority children’s social care team, decide this is not in the child’s best interest.
- Ensuring all staff are aware that this information is confidential and only for use within the company. If any of this information is requested for whatever reason, the service user’s permission will always be sought, other than in the safeguarding circumstances above.
- Ensuring staff are aware of and follow our social networking policy in relation to confidentiality.
- Ensuring issues concerning the employment of staff remain confidential to the people directly involved with making personnel decisions.
- Ensuring any concerns or evidence relating to an individual’s personal safety are kept in a secure, confidential file and are shared with as few people as possible on a ‘need-to-know’ basis. If, however, an individual is considered at risk, our Safeguarding Children and Child Protection policy will override confidentiality if an individual under 18 years old is involved. All the undertakings above are subject to the paramount commitment of the company, which is to the safety and well-being of the individual.
General Data Protection Regulation (Regulation (EU) 2016/679 (GDPR) compliance
To meet our requirements under GDPR, we will also undertake the following:
- We will ensure our terms and conditions, privacy, and consent notices are easily accessed and made available in accurate and easy-to-understand language
- We will use personal data to ensure the safe, operational, and regulatory requirements of running our company. We will only make contact in relation to the safe, operational, and regulatory requirements of running Sensory360. We will not share or use personal data for other purposes. Further details can be found in the GDPR privacy notice.
- Everyone in our company understands that people have the right to access their records or have their records amended or deleted (subject to other laws and regulations).
- We will ensure staff have due regard to the relevant data protection principles, which allow them to share (and withhold) personal information, as provided for in the Data Protection Act 2018 and the GDPR. This includes:
- Being confident of the processing conditions which allow them to store and share information for safeguarding purposes, including information which is sensitive and personal, and should be treated as ‘special category personal data’
- Understanding that ‘safeguarding of children and individuals at risk’ is a processing condition that allows practitioners to share special category personal data. This includes allowing practitioners to share information without consent where there is a good reason to do so, and the sharing of information will enhance the safeguarding of an individual promptly, but it is not possible to gain consent, it cannot be reasonably expected that a practitioner gain consent, or if to gain consent would place a child at risk.
Staff and volunteer information
- All information and records relating to staff and volunteers will be kept confidential in a locked cabinet.
- Individual staff may request to see their own personal file at any time.
This policy was adopted on
Signed on behalf of Sensory360
Date for review
11.11.2025
S.Pringle
11.11.2026