HTML — PaddleOCR-VL (Baidu)

Information Security Policy

Organisation: Newquay Town Council

Document type: Information Security Policy

Version: 1

Newquay Council

Owner: Data Protection Officer / Data Protection & IT Manager

1. Purpose

This Information Security Policy sets out Newquay Town Council’s approach to protecting information and information systems from unauthorised access, use, disclosure, alteration, loss or destruction.

The policy establishes high-level principles and responsibilities for information security and supports the Council’s wider Data Governance Framework, ensuring compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other relevant legislation.

This policy replaces and supersedes the information security sections embedded within the previous Data Governance Policy.

2. Scope

This policy applies to:

All employees, councillors, temporary workers, contractors and volunteers;

All information processed by the Council, regardless of format (electronic, paper, verbal);

All Council-owned or Council-managed IT systems and networks;

Any personal devices or third-party systems authorised to access Council information.

3. Legal and regulatory context

Information security supports the UK GDPR principle of integrity and confidentiality, which requires personal data to be processed in a manner that ensures appropriate security.

This policy should be read alongside:

Data Governance Framework;

Page 2 Download HTML

Record of Processing Activities (Master Data Map);

Appropriate Policy Documents (APDs);

Data Protection Impact Assessment (DPIA) Procedure;

Data Breach Procedure;

Retention Schedule;

CCTV Code of Practice;

Bring Your Own Device (BYOD) Policy;

AI Acceptable Use Policy.

4. Information security principles

The Council's approach to information security is based on the following principles:

Confidentiality – information is accessible only to those authorised to access it;

Integrity – information is accurate, complete and protected from unauthorised modification;

Availability – information is available when required to support Council services;

Proportionality – security measures are risk-based and appropriate to the Council's size and functions;

Accountability – security responsibilities are clearly defined and understood.

5. Roles and responsibilities

5.1 The Council

The Council is responsible for:

Approving this policy and supporting its implementation;

Ensuring adequate resources are available to manage information security risks.

5.2 Chief Executive / Town Clerk

The Chief Executive / Town Clerk provides organisational leadership on information security and ensures that appropriate governance arrangements are in place.

5.3 Data Protection Officer / Data Protection & IT Manager

The Data Protection Officer / Data Protection & IT Manager is responsible for:

Overseeing information security governance;

Advising on security risks and controls;

Page 3 Download HTML

Supporting DPIAs and breach management;

Maintaining related policies and procedures;

Coordinating progress towards Cyber Essentials certification.

5.4 Directors, Managers and users

All staff, councillors and system users are responsible for:

Complying with this policy and related procedures;

Protecting information they handle;

Reporting suspected security incidents or weaknesses immediately.

6. Risk-based approach to security

The Council adopts a risk-based approach to information security.

Security controls are informed by:

The nature and sensitivity of the information;

The potential impact of loss, unauthorised access or disruption;

The likelihood of threats and vulnerabilities;

Findings from DPIAs and incident reviews.

7. Access control and authentication

Access to Council information and systems is:

Restricted to authorised users only;

Based on role and business need;

Reviewed periodically.

Users must:

Use unique credentials;

Protect authentication details;

Log out or lock systems when unattended.

Personal email accounts must not be used for Council business. All Council business must be conducted using approved Council systems and email accounts.

8. Device and system security

The Council implements appropriate technical and organisational measures to protect devices and systems, including:

Secure configuration of Council-managed devices;

Patch management and updates;

Page 4 Download HTML

Anti-malware protection;

Secure backup and recovery arrangements.

Use of personal devices is governed by the Council's BYOD Policy and is permitted only where authorised by the IT Service.

9. Data handling and classification

Information must be handled in accordance with its sensitivity and purpose.

Users must:

Store information securely;

Share information only where lawful and necessary;

Dispose of information securely in line with the Retention Schedule;

Avoid unnecessary duplication or local storage of sensitive information.

10. Incident and breach management

All suspected or actual information security incidents must be reported to the DPO immediately.

Security incidents involving personal data are managed in accordance with the Council's Data Breach Procedure, including assessment, containment, notification and learning.

11. Third-party and supplier security

Where third parties process Council information:

Appropriate contractual safeguards are required;

Suppliers must demonstrate suitable security measures;

Access is limited to what is necessary for service delivery.

12. Remote working and personal devices

Remote working and use of personal devices introduce additional security risks.

Such activity is permitted only in accordance with the Council's BYOD Policy and related guidance, which sets out security requirements, user responsibilities and permitted use.

Page 5 Download HTML

13. Training and awareness

The Council ensures that:

Staff and councillors receive appropriate information security awareness;

Roles with elevated access receive additional guidance;

Security responsibilities are reinforced through policy and procedure.

14. Compliance and review

Failure to comply with this policy may result in disciplinary or other appropriate action.

This Information Security Policy is reviewed at least annually, or sooner where there are material changes to technology, risk, legislation or Council operations.

Rebuilt HTML — PaddleOCR-VL (Baidu)