1. Definitions
Charity means the United Kingdom Literacy Association (UKLA), a registered Charitable Incorporated Organisation (CIO).
UK GDPR means the General Data Protection Regulation as it forms part of the law of the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019.
Data Protection Act 2018 means the primary legislation which, together with the UK GDPR, governs the processing of personal data in the UK.
Responsible Person means the Director or other designated individual who oversees UKLA’s compliance with this policy.
Register of Systems means a record of all systems, processes, and contexts in which personal data is processed by UKLA.
Sheep Membership Portal means the online system used by UKLA to manage membership information, renewals, and communications.
2. Data Protection Principles
UKLA is committed to processing data in accordance with its responsibilities under the UK GDPR and the Data Protection Act 2018.
Article 5 of the UK GDPR requires that personal data shall be:
1. processed lawfully, fairly and in a transparent manner in relation to individuals;
2. collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
3. adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
4. accurate and, where necessary, kept up to date;
5. kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; and
6. processed in a manner that ensures appropriate security of personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
3. General Provisions
This policy applies to all personal data processed by UKLA.
The Responsible Person shall take responsibility for UKLA’s ongoing compliance with this policy.
This policy shall be reviewed at least annually or when significant changes occur to UKLA’s data processing activities.
UKLA, as a not-for-profit organisation, is exempt from registration with the Information Commissioner’s Office (ICO) but remains subject to all relevant data protection obligations.
UKLA uses approved third-party processors, including the Sheep Membership Portal, under written Data Processing Agreements that ensure compliance with the UK GDPR.
4. Lawful, Fair and Transparent Processing
UKLA shall maintain a Register of Systems detailing all data processing activities, including the lawful basis, purpose, and retention period for each.
The Register of Systems shall be reviewed at least annually.
Individuals have the right to access their personal data. Any such requests shall be responded to within one calendar month in accordance with the UK GDPR.
5. Lawful Bases for Processing
All data processed by UKLA must be done on one of the following lawful bases: consent, contract, legal obligation, vital interests, public task, or legitimate interests.
The appropriate lawful basis shall be recorded in the Register of Systems.
Where consent is relied upon, evidence of opt-in consent shall be retained with the personal data.
Individuals have the right to withdraw consent at any time, and systems are in place to ensure such withdrawal is respected promptly.
6. Data Minimisation
UKLA shall ensure that personal data are adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.
For the effective running of the association, UKLA may share data with approved subprocessors, including those used for membership management, communications, and payment processing.
7. Accuracy
UKLA shall take all reasonable steps to ensure personal data is accurate and, where necessary, kept up to date.
Any inaccuracies identified shall be corrected or erased without delay.
8. Archiving and Retention
To ensure that personal data is kept for no longer than necessary, UKLA shall maintain a data retention schedule as part of its Register of Systems.
Each system will specify: the types of data processed; the lawful basis for processing; the retention period; and the justification for retention.
Sheep Membership Portal: Personal data held within the Sheep membership portal will be retained for two years after a member’s account becomes inactive or after membership lapses, unless a longer period is required for legal or regulatory purposes. After this period, personal data will be securely deleted or anonymised.
All retention periods will be reviewed annually to ensure ongoing compliance and necessity.
9. Security
UKLA shall ensure that all personal data is stored securely using up-to-date software and appropriate organisational measures.
Access to personal data shall be restricted to authorised personnel only.
All third-party processors, including the Sheep Membership Portal, must maintain strong security standards such as encryption, access controls, and regular system audits.
When personal data is deleted, it shall be irrecoverably erased.
Appropriate backup and disaster recovery solutions shall be maintained.
10. Data Breach Notification
In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data, UKLA shall promptly:
– assess the risk to individuals’ rights and freedoms; and
– report the breach to the ICO within 72 hours if required.
Records of all breaches, whether reportable or not, shall be kept.
11. Policy Review and Updates
This policy shall be reviewed annually or whenever significant changes occur to UKLA’s data processing practices, systems, or legal obligations.
Last reviewed: Nov 2025.
Next scheduled review: Nov, 2026
12. Contact Information
For questions or concerns regarding this policy or the processing of personal data, please contact:
Responsible Person (Data Protection Lead): Meg Goulter
United Kingdom Literacy Association (UKLA)
Email: director@ukla.org