1. Purpose

This policy sets out how All things SEN & More collects, stores, uses, and protects personal data while providing advocacy services for children, young people, and families with Special Educational Needs (SEN).

2. Scope

Applies to all advocates, employees, contractors, and any third parties who may have access to personal data through their work with our organisation. Covers all personal data relating to staff, service users, families, professionals, and partners.

3. Principles (UK GDPR)

We commit to processing personal data in line with the following principles:

• Lawfulness, fairness, transparency – data is collected and used openly and legally.

• Purpose limitation – data is used only for advocacy and related support.

• Data minimisation – only necessary information is collected.

• Accuracy – records are kept up to date.

• Storage limitation – data is retained only as long as necessary.

• Integrity and confidentiality – data is kept secure and confidential.

4. Types of Data Collected

Personal details: including but not limited to name, contact information, date of birth. SEN-related information: including but not limited to EHCP details, school reports, medical or psychological assessments and tribunal documentation.

Case notes and correspondence with educational providers, local authorities, health services and SEN tribunals.

5. Lawful Basis for Processing

We process data under the following lawful bases:

• Consent – when families agree to share information.

• Contract – where advocacy services are formally commissioned.

• Legal obligation – compliance with safeguarding or statutory duties.

• Legitimate interests – providing effective advocacy support.

6. Data Sharing

Information is shared only with consent, unless required by law (e.g., safeguarding concerns).

Third-party partners (schools, local authorities, health services) receive only relevant data.

No data is sold or shared for marketing purposes.

7. Data Security

Electronic records stored on encrypted devices and secure cloud systems.

Paper records kept in locked cabinets.

Access restricted to authorised staff only.

Regular staff training on confidentiality and GDPR compliance.

8. Retention & Disposal

Case files retained for four weeks after the discontinuation of services or the closure of the business.

Secure destruction of paper files and permanent deletion of electronic records after retention period.

9. Rights of Service Users

Families and individuals have the right to:

• Access their data.

• Request corrections.

• Request deletion (where lawful).

• Restrict or object to processing.

• Data portability (where applicable).

10. Data Breach Procedure

Any breach is reported immediately to management.

Serious breaches reported to the ICO within 72 hours.

Affected individuals are informed promptly.

11. Contact

For questions or concerns about this policy, contact:

Shannon Hill

Email: shannon@all-things-sen.com

Phone: 07301080899

Approved by: Shannon Hill

Date: 02/12/2025

Next Review: 02/12/2026