EDDP, Electronic Data Disposal Policy

Data Protection law defines ‘personal data’ as any information relating to an identified or identifiable natural person (‘data subject’). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental economic, cultural or social identity of that natural person.

It is necessary to have such a policy to ensure that methods of data disposal meet the requirements of the Data Protection Act.

Additional care must be taken when disposing of sensitive personal data.

The policy is to be used where there is a risk that personal data that is no longer required could become accessible to a third-party if it is not disposed with appropriate care in record types (medical, financial, disciplinary etc.): it is only concerned with methods used for disposing of data. The retention schedule which deals with how long information should be held for can be found in The Records Management Policy.

In this policy must be detailed the steps for data disposal we were involved in preparing a valuable data disposal according to the scope and the type of organization and the type of stored personal data.