The following actions are undertaken to ensure that WTCG complies with the accountability principle of the GDPR:
The legal basis for processing personal data is clear and unambiguous
All staff involved in handling personal data understand their responsibilities for following good data protection practice
Training in data protection has been provided to all staff
Where applicable, Rules regarding consent are followed
Routes are available to data subjects wishing to exercise their rights regarding personal data and such enquiries are handled effectively
Regular reviews of procedures involving personal data are carried out
Privacy by design is adopted for all new or changed systems and processes. The following documentation of processing activities is recorded:
Organization name and relevant details
Purposes of the personal data processing
Categories of individuals and personal data processed
Categories of personal data recipients
Agreements and mechanisms for transfers of personal data to non-EU countries including details of controls in place
Personal data retention schedules
Relevant technical and organisational controls in place
These actions will be reviewed biannually as part of the management review process of the information security management system.
We aspire to operate as a paperless business. We do however receive some paper records from third parties and these may contain personal data. All paper documentation is shredded and disposed of.
Subject to the data retention policy set out in table 2 below, we have a thorough and complete approach to deleting data from all data sources including but not limited to database tables, temporary files, log files and any other locations where personal data may exist.