[ORGANISATION NAME] processes personal data in accordance with the seven data protection principles of the UK GDPR. Personal data must be: (1) processed lawfully, fairly, and in a transparent manner; (2) collected for specified, explicit, and legitimate purposes (purpose limitation); (3) adequate, relevant, and limited to what is necessary (data minimisation); (4) accurate and kept up to date; (5) retained for no longer than necessary (storage limitation); (6) processed securely (integrity and confidentiality); and (7) the data controller must be able to demonstrate compliance (accountability).

[ORGANISATION NAME] relies on the following lawful bases for processing personal data: for service delivery — performance of a contract or task in the public interest; for employment purposes — legal obligation and legitimate interests; for safeguarding — vital interests and legal obligation; for health and social care records — processing necessary for social care purposes under Schedule 1 DPA 2018.

All individuals whose data we process have the following rights: the right to be informed; the right of access (Subject Access Request — must be responded to within 1 calendar month); the right to rectification; the right to erasure ('right to be forgotten'); the right to restrict processing; the right to data portability; the right to object; and rights relating to automated decision making and profiling.