policy owner: Amy Jaines, information governance manager (DPO)
published: May 2018
last reviewed: March 2026
version number: V3.2
change history:
May 2018 - V1.0 published
March 2019 - V1.0 annual review, no significant change
March 2020 - V1.0 annual review, no significant change
March 2021 – V2.0, annual review, updated to reflect legislative changes brought by the UK’s withdrawal from the EU.
March 2022 - V2.0, annual review, no significant change
March 2023 - V2.0, annual review, no significant change
March 2024 - V2.0, annual review, no significant change
March 2025 - V3.0, annual review, full policy re-writes to present content in more accessible and plain language, reducing the use of technical terminology
October 2025 - V3.1 amended timescale for responding to data protection related complaints from 15 working days to one calendar month
March 2026 – V3.2, annual review, amended to include definition of a data protection complaint and to set out revised process for handling data protection complaints to meet the new statutory duty provided by the Data (Use and Access) Act 2025.
