Attached Psychology’s Data Protection Policy
-
Introduction
Attached Psychology is committed to protecting the privacy and security of personal data and information entrusted to us by the families with whom we work. This Data Protection Policy outlines the measures Attached Psychology takes to ensure the confidentiality, integrity, and availability of personal data and information in our care.
-
Scope
This policy applies to all personal data and information processed by Attached Psychology, including data and information processed on behalf of families. It covers all aspects of information security and data protection, including data collection, storage, processing, transmission, and disposal.
-
Compliance with Data Protection and Privacy Laws
Attached Psychology complies with all applicable data protection and privacy laws and regulations, including the General Data Protection Regulation (EU-GDPR), the Data Protection Act 2018, and any other applicable laws or regulations in the countries where we operate.
-
Collection and Use of Personal Data and Information
Attached Psychology collects and uses personal data and information only for the purposes for which it was collected and in accordance with applicable laws and regulations. Attached Psychology collects personal data and information from families, their professional and personal networks, and other sources only when necessary and with the consent of the individuals concerned.
-
Data and Information Security
Attached Psychology implements appropriate technical and organisational measures to ensure the confidentiality, integrity, and availability of personal data and information in our care. Attached Psychology implements measures such as encryption, access controls, firewalls, and monitoring to protect against unauthorised access, disclosure, or use of personal data and information.
-
Data and Information Retention and Disposal
Attached Psychology retains personal data and information only for as long as necessary to fulfil the purposes for which it was collected or as required by applicable laws and regulations. Attached Psychology securely disposes of personal data and information when it is no longer needed, in accordance with data and information retention and disposal guidance and legislation.
-
Data Subject Rights
Attached Psychology respects the rights of data subjects under applicable data protection laws and regulations, including the right to access, rectify, erase, restrict processing, object to processing, and data portability. Attached Psychology provides data subjects with mechanisms to exercise these rights and respond to their requests in a timely and appropriate manner.
-
Third-Party Service Providers
Attached Psychology engages third-party service providers only when necessary and in accordance with applicable laws and regulations. Attached Psychology ensures that these service providers comply with the same data protection and information security standards, and enter into appropriate contracts to ensure the protection of personal data and information.
-
Training and Education
Attached Psychology provides education to all members on the importance of data protection, information security, and the requirements of this policy as part of the onboarding process. This covers the handling and storage of personal data and information, data subject rights, and the identification of potential security threats. All members are personally and professionally responsible for maintaining appropriate levels of data protection training commensurate with their roles. All members are expected to abide by the Data Protection training at all times. All members are prohibited from processing personal data outside the strict requirements of their job role.
-
Environment and data security
All members of Attached Psychology are personally responsible for ensuring that they conduct their role within a secure working environment, with personal date being stored and processed in a safe and secure way. Any data that is required to be transported out of a working environment will be done with a secure method of transportation, such as an encrypted USB.
-
Enforcement and Consequences of Breach
Attached Psychology is committed to ensuring the safety of personal information. However even with robust systems and careful oversight, personal data breaches can occasionally occur. Any breach of this policy will be taken seriously and may result in disciplinary action, up to and including termination of contractual obligations. Attached Psychology reserves the right to take legal action to protect personal data and information, and to seek damages for any harm caused by a breach of data protection or information security. The General Data Protection Regulation (GDPR) brought into UK law by The Data Protection Act (2018) incorporates a requirement for a personal data breach to be notified to the supervisory authority (Information Commissioner’s Office - ICO) and to the affected individuals, depending on the specific circumstances. This procedure applies to everyone working for or on behalf of Attached Psychology, in any capacity. All suspected breaches should be reported, in writing, to the Director of Attached Psychology, Dr Jessica Cardy, who is responsible for investigating suspected Data Protection breaches and liaising with the relevant authorities. A determination will be made within 72 hours whether the breach is deemed ‘notifiable’ to the ICO; and whether it is deemed as resulting in a high risk to the rights and freedoms of individuals. Dr Jessica Cardy is the nominated Data Protection Lead, who is responsible for overseeing Attached Psychology’s compliance with this policy.
-
Review and Update
This policy will be reviewed and updated on a regular basis to ensure that it continues to meet Attached Psychology’s needs and complies with any changes in applicable laws and regulations.
Key Contact Information:
Director: Dr Jessica Cardy, Email: hello@attachedpsychology.co.uk
Policy and Procedure created: March 2026
Next review date: March 2027