• Record of Processing Activities (Master Data Map);
• Appropriate Policy Documents (APDs);
• Data Protection Impact Assessment (DPIA) Procedure;
• Data Breach Procedure;
• Retention Schedule;
• CCTV Code of Practice;
• Bring Your Own Device (BYOD) Policy;
• AI Acceptable Use Policy.

4. Information security principles

The Council's approach to information security is based on the following principles:

• Confidentiality – information is accessible only to those authorised to access it;
• Integrity – information is accurate, complete and protected from unauthorised modification;
• Availability – information is available when required to support Council services;
• Proportionality – security measures are risk-based and appropriate to the Council's size and functions;
• Accountability – security responsibilities are clearly defined and understood.

5. Roles and responsibilities

5.1 The Council

The Council is responsible for:

• Approving this policy and supporting its implementation;
• Ensuring adequate resources are available to manage information security risks.

5.2 Chief Executive / Town Clerk

The Chief Executive / Town Clerk provides organisational leadership on information security and ensures that appropriate governance arrangements are in place.

5.3 Data Protection Officer / Data Protection & IT Manager

The Data Protection Officer / Data Protection & IT Manager is responsible for:

• Overseeing information security governance;
• Advising on security risks and controls;