Guidance

Privacy Notice for UKSV Learning and Development

Published 15 February 2024

Your data

Purpose

Within the Learning and Development (L&D) team, we process your personal data to enable us to ensure the right people are in the right place when it comes to training, whether that be at the beginning of your career here at UKSV or throughout. For this to be successful, we may require your name and Cabinet Office email address, any required workplace adjustments, your role, pillar, grade and staff number as well as information about your line manager. For new starters, we will also require contact information such as personal email addresses and telephone numbers to ensure we are in contact with you in the run up to your course and allow us to contact you if anything changes. We may share some information around your performance during the course with your line manager to make sure the appropriate support is available to you whilst in your role. We will also keep a record of your attendance for required learning to ensure everyone at UKSV has the most recent and relevant security training.

Our specific purposes for processing your data are:

• providing induction training for new UKSV employees
• providing Single Vetting Process and Vetting Clearance Officer Training Courses
• managing the Training Request Process
• providing Training on Google Workspace
• supporting Continuous Professional Development
• providing Required Learning (mandatory training), and
• to make any required reasonable adjustments for trainees

The Data

We may process the following personal data for all purposes:

• Name
• Pronouns
• Preferred name
• Pillar
• Grade
• Job role
• Cabinet Office email address
• Line Manager’s name
• Line Manager’s email

For induction training, and Single Vetting Process and Vetting Clearance Officer Training we collect your personal email address, personal contact number, staff number, and contractor status.

When considering requests for workplace adjustments we collect your health data.

Legal Basis of Processing

The legal basis for processing your personal data is:

It is necessary for the performance of a contract to which you are  a party. In this case that contract is your terms of employment, and our obligation as an employer to provide appropriate training for our employees.

For health/disability data to make reasonable adjustments under our public sector equality duty:

• It is necessary for the purposes of performing or exercising our obligations or rights as the controller, or your obligations or rights, under employment law, social security law or the law relating to social protection (para 1, sch. 1, Data Protection Act 2018).

Recipients

As your personal data will be stored on our IT infrastructure it will also be shared with our data processors who provide email, document management and storage services. We may also share necessary data with venues where face to face training is provided.

The data we possess, for security and continuation purposes, is stored within the Learning and Development team’s drive, meaning that all members of the team will have access to the information as well as UKSV’s Information Management and Security team. We may also share information with project managers if undertaking a specific training, organised by another area of the business.

For individuals new to the organisation, or taking on a new role, we may be required to share information with managers within the organisation to ensure everything is ready for you when you enter your new role.

We always strive to follow the “need to know” protocol and will not share your data further than necessary.

Retention

For individuals new to the organisation, your name, cabinet office email address and required learning attendance will be kept by the Learning and Development team for 12 months to ensure your attendance is monitored and the dates for renewal are passed onto your line manager. Any workplace adjustments and personal contact information such as your phone number and personal email address will be removed after you have attended the course this information is required for.

Any information regarding your performance will be removed six months after your initial start date when enrolling on one of our courses. This has been set as it is the standard probationary period for members of staff within UKSV.

If you have submitted a training request form and have undergone external training which has been funded by the Learning and Development team, your name, Cabinet Office email address and the course you attended will be kept by the Learning and Development team for 24 months following the course in accordance with the agreement signed when attending the training. All other information held will be deleted following the attendance of the course.

Automated Decision Making

At the present moment, the Learning and Development team has no automated decision-making processes in place. Any update to this will be reflected in an updated privacy notice.

Where Personal Data has not Been Obtained From you

Your personal data was received by us from either yourself, your line manager or the recruitment and delivery planning team who are part of the onboarding process.

Your rights

You have the right to request information about how your personal data are processed, and to request a copy of that personal data.

You have the right to request that any inaccuracies in your personal data are rectified without delay.

You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.

You have the right to request that your personal data are erased if there is no longer a justification for them to be processed.

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.

You have the right to object to the processing of your personal data where it is processed for direct marketing purposes.

You have the right to request a copy of any personal data you have provided, and for this to be provided in a structured, commonly used and machine-readable format.

International transfers

As your personal data is stored on our Corporate IT infrastructure, and shared with our data processors, it may be transferred and stored securely outside the UK. Where that is the case it will be subject to equivalent legal protection through an adequacy decision, reliance on Standard Contractual Clauses, or reliance on a UK International Data Transfer Agreement.

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator.  The Information Commissioner can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

or 0303 123 1113, or icocasework@ico.org.uk. Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Contact details

The data controller for your personal data is the Cabinet Office. The contact details for the data controller are:

Cabinet Office
70 Whitehall
London
SW1A 2AS

or 0207 276 1234

The contact details for the data controller’s Data Protection Officer are: dpo@cabinetoffice.gov.uk

The Data Protection Officer provides independent advice and monitoring of Cabinet Office’s use of personal information.

If you would like to submit a Subject Access Request to find out what personal information the Learning and Development team holds about you, how we are using it and who we are sharing it with, please contact the UKSV Data Protection team at uksv-data.protection@cabinetoffice.gov.uk