1. General Principles
1.1 Confidential information can include sensitive, personal, financial or private data. It includes anything that contains the means to identify a person, such as: name, address, post code, date of birth and bank details. It includes information about health, beliefs, commission or alleged commission of offences and other sensitive personal information as defined by the Data Protection Act. It also includes information about the charity or the organisations we work with, such as business plans, financial information, contracts and procurement information.
1.2. The James Foundation recognises that its Trustees and volunteers gain such information about individuals and organisations during the course of their work or charitable activities. In most cases such information will not be specifically stated as being confidential and we must all exercise common sense and discretion in identifying wether this information should be communicated to others – the overriding principle is that information should only be shared on a need-to-know basis.
1.3. Information given in confidence must not be disclosed without consent unless there is a justifiable reason, for example, a requirement of law is an overriding public interest to do so.
1.4 If in doubt, volunteers can seek advice from a Trustee about confidentiality and/or sharing information. Trustees can seek advice from the Treasurer.
1.5. Talking about the private life of a Trustee, volunteer, donor or service user is to be avoided at all times, unless the person in question has instigated the conversation.
1.6. Trustees and volunteers will avoid discussing confidential information about individuals or organisations when in social settings.
1.7. Trustees and volunteers will not disclose to anyone, other than the engaged by The James Foundation that need to know, any information considered confidential, without the knowledge or consent of the individual (or an officer, in the case of an organisation)
1.8. Where there is statutory duty on The James foundation to disclose information, the person or people involved will usually be informed that disclosure has been, or will be made, unless this would put at risk the safety of any individual or jeopardise a potential criminal investigation. Details about disclosure or information and who has been informed will always be kept on record and stored securely with restricted access.
1.9. Confidential information will be stored securely. It will not bereft on view and will be locked away when not in use. Electronic information will be stored on password or biometrical protected devices.
2. Why confidential information is held
2.1. Most confidential information held by The James Foundation relates to the Trustees, volunteers, donors or service users or the organisation we work with.
2.2. Confidential information is held to enable The James Foundation to operate effectively and to fulfil our statutory duties.
3. Access to confidential information
3.1. Information is confidential to The James Foundation as an organisation and may only be passed to Trustees, volunteer, donors or supplier organisations on a need-to-know basest ensure the best quality service for users.
3.2. Where information is sensitive, it should be clearly labelled ‘Confidential’
3.3 Individuals may have sight of The James Foundation records held in their name. The request must be in writing to the Data Protection Officer giving 14 days notice and be signed ny the individual.
3.4. When working on or coping confidential documents, you should ensure other people do not see them. This also applies to information on commuter screens.
4. Storing information
4.1. General, non-confidential information can be kept in unlocked filing cabinets and in computer folders accessible by al The James Foundation Trustees and selected volunteers.
4.2. Confidential information on the Trustees, volunteers and other individuals working with or for The James Foundation will be kept in lockable filling cabinet and will be accessible to the relevant Trustee(s)
4.3. Files and filing cabinet drawers bearing confidential information should be labelled ‘Confidential’
4.4. In an emergency situation, any Trustee may authorise access to files by other people.
5. Duty to disclose information
5.1 There is a legal duty to disclose information including
5.1.1 child and vulnerable adult abuse, or suspected abuse, will be reported to the relevant statutory services;
5.1.2 Criminal activity, or suspected criminal activity, will be disclosed to the police.
5.2. In addition, where it is believed that a person is at risk of harming themselves or others, this must be reported to the appropriate authorities in line with our safeguarding procedure.
5.3. Users should be informed of the disclosures unless this would put at risk the safety of any individual or jeopardise a potential criminal investigation. Details about disclosure of information and who has been informed will always be kept on record and stores securely with access restricted to the Chair and other relevant Trustee(s)
6. Disclosures
6.1. The James Foundation complies fully with the DBS code of practice regarding the correct handling, use, storage, retention and disposal of Disclosures and Disclosures information.
6.2. Disclosures information is always kept separately from all other records in secure storage with access limited to those who are entitled to see it as sort of their duties. It is a criminal offence to pass this information to anyone who is not entitled to receive it.
6.3. Documents will be kept for a year and then destroyed by secure means. Photocopies will not be kept. However, The James Foundation will keep a record of the date of issue of Disclosure, the name of the subject, the type of Disclosure requested, the position for which the Disclosure was requested, the unique reference number of the Disclosure and the details of the recruitment decision taken.
7. Data Protection Act
7.1. Information about individuals, or that can identify a living individual, ether on computer or on paper, falls within the scope of the Data Protection Act and must comply with the data protection principles. These are that personal data must:
- Be obtained and processed fairly and lawfully;
- Be held only for specified lawful purposes;
- Be adequate, relevant and not excessive;
- Be accurate and where necessary kept up to date;
- Not be kept longer than necessary;
- Be used only for the purpose(s) for which it was collected;
- Be processed in accordance with the rights of the data act subject under the Act;
- Have appropriate technical and organisational measures in place to Gard against loss, destruction, or damage;
- Not to be transferred to countries outside the European Economic Area without an adequate level of protection in place.
7.2. The James Foundation publishes privacy notices in respect of: Trustees and volunteers; donors; beneficiaries. These can be found under our compliance policy.
8. Breach of confidentiality
8.1 All security incidents, including the misuse of confidential information, must be reported to the Chair, so that steps can be taken to rectify the problem and ensure that the same problem does not occur again. This includes (but not limited to)
8.1.1. unauthorised access to person-identifiable information where a person does not have a genuine need to know;
8.1.2. incidents of unprotected information (physical or verbal) accessed in a public area, theft and loss of information.
8.2. The Data Protection Officer will be notified and will undertake a data breach risk assessment and will take the necessary action to report the breach and/or mitigate any resultant risk in line with Information Commissioners Office guidelines.
Policy to be reviewed in April 2027
