{{org_field_logo}}

{{org_field_name}}

---

N34. Computer Security

{{org_field_name}} regards the integrity of its computer system as central to the success of {{org_field_name}} Its policy is to take any measures it considers necessary to ensure that all aspects of the system are fully protected. This policy aims to comply with the requirements of both the General Data Protection Regulation (GDPR) and the Data Protection Act (DPA) 2018.

Procedure

1. Overall computer security is the responsibility of the data security officer reporting to the managing director. Line managers are responsible for security within their own departments.
2. Job applicants will be questioned on their computer experience. The implications of their software knowledge will be discussed with the data security officer before a job offer is made. All references will be checked.
3. On induction employees will be given copies of the computer security policy and will receive written instructions on security procedures and {{org_field_name}}’s responsibilities under the DPA and the GDPR.
4. The credentials of all temporary, freelance and consultancy staff should be checked in as much detail as possible before they are allowed access to the computer system. Managers are responsible for ensuring that all such workers receive the information referred to in point 3.
5. Computer training at every level will emphasise the importance of security. Staff will receive a detailed statement on the implications of the DPA, the GDPR and the Computer Misuse Act 1990.
6. Supervisors are responsible for ensuring that basic procedures are followed. Procedures may be bypassed only with the combined consent of the line manager, the data security officer and, where appropriate, the data protection officer (DPO). A written record of such decisions must be kept.
7. Employees of all grades are permitted access only to those parts of the computer system which they need to enter in order to carry out their normal duties. Levels of access will be decided by line managers in conjunction with the data security officer who will ensure that levels of access are consistent throughout {{org_field_name}}
8. Employees may access the internet but access to certain sites will be blocked. It will be a disciplinary offence to try to bypass such restrictions.
9. All incoming emails will be monitored and scanned for viruses before being released to the recipient.
10. Employees with access to personal data are in a particularly sensitive position and must bear in mind at all times the provisions of the DPA and the GDPR with regard to security. This is especially the case where the information relates to children.
11. Passwords must be used at all times and changed regularly. Employees should not select obvious passwords but should ensure that they are of at least eight characters including numbers, letters, upper and lower case and at least one symbol. All passwords must be kept confidential. Employees must not give their passwords to other members of staff or to any person outside {{org_field_name}} Password-protected sites should be closed when finished with and computers switched off. Computers should not be left open and unattended.
12. When an employee leaves {{org_field_name}} or moves to a different department all passwords in that department will be changed. When an employee is given a temporary password to a higher level of access than he or she normally uses, that password must be cancelled after the individual ceases to need it.
13. Supervisors are responsible for stipulating requirement for back-up operations in their own departments. Regular back up must be carried out in accordance with departmental instructions.
14. All {{org_field_name}}’s software must be formally authorised by the data security officer. Regular checks will be made for viruses by the IT department.
15. No external software may be used without authorisation by both the data security officer and the employee’s line manager.
16. No private work or computer game playing is permitted.
17. The safekeeping of CDs and DVDs sent from external sources is the responsibility of the person to whom it was sent. All such CDs and DVDs must be checked for viruses by the IT department before use. CDs and DVDs generated internally must be kept in a secure place. Employees should be reminded that the Information Commissioner’s Office (ICO) has imposed heavy fines on organisations after the loss of CDs and DVDs containing sensitive personal data.

Misuse of computers is a serious disciplinary offence. The following are examples of misuse:

a. fraud and theft
b. system sabotage
c. introduction of viruses, etc
d. using unauthorised software
e. obtaining unauthorised access
f. using the system for private work or game playing
g. breaches of the DPA and the GDPR
h. sending abusive, rude or defamatory messages or statements about people or organisations, or posting such messages or statements on any websites or via email
i. attempting to access prohibited sites on the internet
j. hacking
k. breach of {{org_field_name}}’s security procedures.
This list is not exhaustive. Depending on the circumstances of each case, misuse of the computer system may be considered gross misconduct. Please refer to the disciplinary rules and procedures. Misuse amounting to criminal conduct may be reported to the police.

19. Management, in consultation with specialist auditors, may institute confidential control techniques and safeguards. Financial systems are subject to special reconciliation processes.
20. A committee of senior managers will meet regularly to review computer security.
21. All breaches of computer security must be referred to the relevant director or to the managing director. Where a criminal offence may have been committed, the board will decide whether to involve the police. Serious breaches must be reported to the ICO within 72 hours. If the breach is likely to result in a high risk of adversely affecting individuals’ rights and freedoms, those individuals must be informed by a senior member of staff without undue delay.
22. Any member of staff who suspects that a fellow employee (of whatever seniority) is abusing the computer system may speak in confidence to the HR manager.
23. This policy does not form part of the contract of employment and any or all of its terms may be amended from time to time.

---

Copyright ©2024 {{org_field_name}}. All rights reserved

Reviewed on: {{last_update_date}}