Data Protection Policy

General Principles

The IMA is the Data Controller. Margaret Banks is the person responsible for day to day operations and compliance
All data is processed in accordance with the requirements of the 1998 Data Protection Act .
Only relevant data is collected
Data is held in a confidential and secure manner.
Members are made aware of the IMA Confidentiality Policy

Sharing of Data

IMA Membership Data is shared with appropriate partners, however only necessary and relevant information is shared.
The IMA seeks written confirmation from the partners that the Data is maintained in a manner compliant with the 1998 Data Protection Act.

Data Processors

See Roles & Terms below.
All Data Processors will be required to sign a formal agreement in respect of the use and security of IMA data.

Retention of Records

Membership Records of individuals are kept for a period of 6 years following the individual ceasing to be a member of the IMA.
Training records are kept for the period necessary to comply with the requirements of the Law Society, plus one year.
Conference records are kept for a period of 6 years following the event.
Photographs taken at IMA events will be kept available for use in publicity materials for a period of 2 years

All paper based records will be disposed of by shredding

Photographs

When photographs are taken at IMA events, participants will be asked to give consent to the reproduction of their image in future publicity materials. Such images may be used for a period of up to 2 years

Training

All IMA staff, freelance workers Trustees and Council members receive a briefing about the Data Protection Act. A briefing session for Trustees and Council members will be included on the agenda of the first full Committee meeting following the AGM.

Staff and freelance workers will receive a briefing as part of their induction programme.

Staff Records

All staff working for the Institute should sign a consent form for the holding of sensitive data, this document should form part of the pack of materials issued to successful job applicants. Access to staff records will be restricted to: The Chair of the Board of Trustees and staff member nominated by the Chair

Roles and terms

The Act has created a number of new roles and terms:
The term 'Information Commissioner' replaced the term 'Data Protection Commissioner' in January 2001.
The term 'Notification' has replaced 'Registration', although the process is largely similar.

The term 'Data Subject' is used in the Act to denote the client, person or individual about whom data is maintained.
The term 'Data Controller' is used to denote the entity with overall responsibility for data collected. In the case of an incorporated organisation this will be the name of the limited company (Institute of Money Advisers),. An unincorporated body will use the organisation’s name. The data controller is not a specific person but is the organisation as a whole.
The term 'Data Processor' is used to denote any person (other than any employee of the Data Controller) who processes the data on behalf of the Data Controller. The Data Controller, the employing organisation, retains full responsibility for the actions of the Data Processor.