Information Security Policy

Organisation: Newquay Town Council

Document type: Information Security Policy

Version: 1

Newquay Council

Owner: Data Protection Officer / Data Protection & IT Manager

1. Purpose

This Information Security Policy sets out Newquay Town Council’s approach to protecting information and information systems from unauthorised access, use, disclosure, alteration, loss or destruction.

The policy establishes high-level principles and responsibilities for information security and supports the Council’s wider Data Governance Framework, ensuring compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other relevant legislation.

This policy replaces and supersedes the information security sections embedded within the previous Data Governance Policy.

2. Scope

This policy applies to:

• All employees, councillors, temporary workers, contractors and volunteers;
• All information processed by the Council, regardless of format (electronic, paper, verbal);
• All Council-owned or Council-managed IT systems and networks;
• Any personal devices or third-party systems authorised to access Council information.

3. Legal and regulatory context

Information security supports the UK GDPR principle of integrity and confidentiality, which requires personal data to be processed in a manner that ensures appropriate security.

This policy should be read alongside:

• Data Governance Framework;