Principles of Data Protection

The Institute is required to adhere to the six principles of data protection as laid down in the GDPR, which state:

1. Personal Data shall only be Processed fairly, lawfully and in a transparent manner (Principles of Lawfulness, Fairness and Transparency);
   
   
2. Personal Data shall be obtained only for specified, explicit, lawful, and legitimate purposes, and shall not be further Processed in any manner incompatible with those purposes (Principle of Purpose Limitation);
   
   
3. Personal Data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are Processed (Principle of Data Minimisation);
   
   
4. Personal Data shall be accurate, and where necessary kept up to date (Principle of Accuracy);
   
   
5. Personal Data shall not be kept in a form which permits identification of a data subject for longer than is necessary for the purposes for which the Personal Data are Processed  (Principle of Data Storage Limitation);
   
   
6. Personal Data shall be processed in a secure manner, which includes having appropriate technical and organisational measures in place to:
   a. prevent and / or identify unauthorised or unlawful access to, or processing of, Personal Data; and
   b. prevent accidental loss or destruction of, or damage to, Personal Data (Principles of Integrity and Confidentiality)