Purpose

This privacy notice tells you what to expect when the Legal Services Board (LSB) including its independent arm, the Legal Services Consumer Panel (LSCP) (legalservicesconsumerpanel.org.uk) collects personal information (‘personal data’) about you. We explain the activities we undertake and how we may use the personal data we collect in carrying out these activities.  We also provide information about your rights – including access to your personal data; and how to contact us if you have any questions.

Information on how we use personal data in the different areas of the LSB work is available below.

Data retention

The LSB will only retain your personal data for as long as necessary for a lawful purpose. The period of retention will vary depending on the nature of our engagement with you.

Our record retention schedule sets out how long we hold information, unless expressly specified otherwise in this privacy notice.

Your rights

Under data protection law, you have rights as an individual which you can exercise in relation to the personal data we hold about you.  You have the right to:

  • request access to, deletion or correction of, information about you
  • object to the way in which we use information about you
  • request a transfer of your personal data to another organisation and
  • complain to the Information Commissioner’s Office if you are unhappy about the way we use your personal data.

Access to personal data about you

You can find out if we hold any personal data about you by making a ‘subject access request’. To make a subject access request, or if you require any assistance in completing your request, please contact:

Board Secretary
Legal Services Board
3rd Floor The Rookery
2 Dyott Street
London WC1A 1DE
boardsecretary@legalservicesboard.org.uk
Telephone: 020 7271 0070

Contact us or make a complaint

If you have any other questions about our privacy notice, please email us at boardsecretary@legalservicesboard.org.uk or write to us at the above address.  You can also contact our Data Protection Officer.

Data Protection Officer (DPO)

The LSB, as a public authority, is required to appoint a DPO to oversee compliance with this privacy notice and inform and advise us on our data protection obligations. The LSB’s DPO is Holly Perry: holly.perry@legalservicesboard.org.uk.

If you wish to make a complaint about how the LSB has handled your personal data, your complaint will be dealt with under our complaints process.

Information Commissioner

You can also make a complaint to the Information Commissioner, who is an independent regulator:

Information Commissioner’s Office
Casework and Advice Division
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

www.ico.org.uk

Information on how to make a complaint is available on the complaints section of the Information Commissioner’s Office’s website.

Telephone help line: 08456 306060 or 01625 545745. Please note you may be charged for calls to these numbers.

 

Changes to this privacy notice

We regularly review our privacy notice. If changes are made, we will place an updated version on this page and, if required, notify those who are affected by the changes.  Where changes have been made, the ‘last updated’ date at the bottom of this page will also change.  Any changes to this privacy notice will apply to you and your data immediately.

Visitors to our website

We use Google Analytics to collect information about how people use this site. We do this to make sure it is meeting its users’ needs and to understand how we could do it better.

Google Analytics stores information about what pages you visit, how long you are on the site, how you got here and what you click on. We do not collect or store your personal information (e.g. your name or address) so this information cannot be used to identify who you are. We do not allow Google to use or share our analytics data.

Use of cookies by the LSB

You can read more about how we use cookies on our Cookies page.

Your rights

You have a number of rights relating to your personal data.

Contact us enquiries

This content on contact us only applies to the LSB, and not its independent arm, the LSCP.

We use personal data to help us respond when you write or call us.  For further information on how to make an enquiry, please see our enquiries web page

What information does the LSB collect and how will we use it?

We will collect your name, email address and other contact information provided within your correspondence.  We will use your personal data to consider your enquiries and provide a response.

How does the LSB collect your information? Where is it stored and is it secure?

We receive your personal data when you contact us.  When you make an enquiry by email, we file a copy of the email, together with our replies and subsequent correspondence, within a designated folder in our electronic database.  Any enquiries which are made to us by telephone are noted in writing and stored in the same way as emails. Hard copy documents are scanned to our database and the originals are destroyed.

Who has access to your personal data?

We share your personal data internally with colleagues at the LSB and we have internal policies in place to ensure that your personal data is handled carefully.  We may also share your personal data with third parties in the circumstances below.

Vendors, consultants, and other service providers

We may share your personal data with third party data processors who contract with us to undertake work on our behalf and require access to your information for that work.  This would include access to our databases for IT maintenance work. Third party providers only process your personal data under our instructions and are subject to a duty of confidentiality.  They will not share your personal data with any organisation apart from us. They will hold it securely and retain it for the period we instruct.

Compliance with laws and in the exercise of our regulatory functions and objectives

As the oversight regulator for legal services, we may from time to time be legally obliged to share your personal data with law enforcement agencies or other organisations. We might also share your personal data with other regulatory bodies and public authorities , in order to further their, or our, objectives.  In any scenario we will satisfy ourselves that we have a lawful basis on which to share personal data, and document our decision making. If we consider that your enquiry should be referred to another individual or organisation, we will assist you by providing you with the information you need to contact them yourself.  We compile and publish statistics showing information like the number of enquiries we receive, but not in a form which identifies anyone.

Transfer of personal data outside the EEA

Your data is highly unlikely to be transferred to countries outside the European Economic Area (EEA), however where this may occur, the LSB will specify the purpose for the transfer and the legal basis on which your data will be processed. Where necessary the LSB will seek your consent to transfer your data outside the EEA.  At all times, your data will only be transferred outside the EEA on the basis of adequate assurances received from those receiving your data.  This may take the form of a declaration of adequacy, binding corporate rules or other safeguards.

For how long does the LSB keep data?

We will keep personal data contained in our database in line with our record retention schedule. This means that, once we consider that we have dealt with your enquiry in full we will delete your information from our database. However, if your enquiry includes a complaint about an approved regulator, we will retain your information for a longer period. If we notice a common issue within the enquiries we retain, we may undertake a specific review of that issue and take further action with the approved regulator if required.  We will notify you if further action is necessary and we will seek your consent for your personal data to be shared with the approved regulator. If you do not want your information to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint about an approved regulator on an anonymous basis. We will never hold your information for more than 6 years.

What is the lawful basis for processing personal data?

We process personal data in the performance of a task in the public interest where the reason for collecting your data is relevant to our regulatory functions and/or performance of our regulatory functions and responsibilities.

Regulatory work

The LSB has a number of regulatory and oversight powers and responsibilities in relation to the provision of legal services by authorised persons.  We frequently communicate with approved regulators and their regulatory bodies on this work, which includes:

What information does the LSB collect?

We typically collect your name, address, and contact details, including your email address or postal address, telephone number, employment status and records of the discussions and interactions we have with you, including but not limited to any personal data you volunteer by way of evidence or example in your response to a consultation or other call for evidence.

Video and audio recordings

We will occasionally make video or audio recordings of meetings, calls and other events, however we will only do so if we are able to rely on a lawful basis under the GDPR (see below).  Information about the software platform we will use to record the meeting will be provided to you before the meeting takes place.  We will also confirm the lawful basis we will rely on, and tell you how we will handle your personal data throughout.

Audio and video recordings of you will not be captured unless you activate your video and/or microphone functions, however your name will be visible onscreen.

How does the LSB collect your data?

We normally collect your personal data directly from you, from the organisation you represent or from a third party acting on your behalf.

Why does the LSB process your personal data?

We use this personal data to ensure we are able to discharge our regulatory functions and responsibilities.

Who has access to your personal data?

We will only process your personal data when it is lawful to do so. Your information will be shared internally within the LSB and with third parties in the circumstance set out below.

Vendors, consultants, and other service providers

We share your personal data with third party data processors who contract with us to undertake work on our behalf and require access to your information for that work.  This would include access to our databases for IT maintenance and remedial work. Third party providers only process your personal data under our instructions and are subject to a duty of confidentiality.  They will not share your personal data with any organisation apart from us. They will hold it securely and retain it for the period we instruct.

Consultations and other calls for evidence

The LSB consults the public as part of its open policy making process, which forms part of its regulatory functions under the Legal Services Act 2007. We publish our consultations on our website.  You can respond by following the instructions on each of our consultations or calls for evidence (now collectively referred to as consultations in this notice).

We will only handle personal data that is voluntarily submitted by you within your response.  The way in which your personal data is handled varies depending on how you submit your response, but all information submitted to us will be treated in accordance with data protection principles.

Purpose

We collect your personal data as part of the consultation process:

  • so that we can contact you regarding your response or related matters
  • for statistical data, for example the types of individuals and groups participating

Why we need it

We collect your name and email or postal address so that:

  • we know you are a real person or that you genuinely represent a named organisation
  • we can respond to your comments

We also collect data in order to gather information about the types of individuals and groups that participate in our consultations.

What we do with your data

Unless the consultation document states otherwise, we will publish your consultation responses, provided that we can do so without publishing personal data. We may also summarise or refer to your information in our published response document.

In the event that your response contains the personal data of a third party, we will not process it further without obtaining evidence that such data is lawfully shared with the LSB.

We will share your data if we are required to do so by law, for example by court order, or to prevent fraud or other crime.  All information contained in your response, including personal data, may also be subject to publication or disclosure if requested under the Freedom of Information Act 2000 or other similar legislation.

If you do not wish for your personal data to be disclosed following a Freedom of Information request, you should limit or remove it completely from your response.  If you want the information in your response to be kept confidential, you should also explain why as part of your response, although the LSB cannot guarantee that it will be able to adhere to your request.

Compliance with laws and in the exercise of our regulatory functions and objectives

As the oversight regulator for legal services, where necessary we may share your personal data with other regulators and public authorities. We may also be legally obliged to share your personal data with law enforcement agencies. We will always satisfy ourselves that we have a lawful basis on which to share personal data, and document our decision making before doing so.

Transfer of personal data outside the EEA

Your data is highly unlikely to be transferred to countries outside the European Economic Area (EEA), however where this may occur, the LSB will specify the purpose for the transfer and the legal basis on which your data will be processed. This may, for example occur when remote meetings are recorded and stored in locations outside the EEA (see above on “Video and audio recordings”).  Where necessary the LSB will seek your consent to transfer your data outside the EEA.  At all times, your data will only be transferred outside the EEA on the basis of adequate assurances received from those receiving your data.  This may take the form of a declaration of adequacy, binding corporate rules or other safeguards.

How does the LSB protect data?  Where is your personal data stored and is it secure?

We store consultation and call for evidence responses and correspondence, within a designated folder in our electronic database.  We also store contact information within our electronic database, which is provided by a third-party data processor.  Where the third-party processes personal data on our behalf, they do so in accordance with agreed terms which reflect the legal obligations of both the LSB and the third party under current data protection laws.  The third party who processes your personal data is accordingly under a duty of confidentiality and is obliged to implement appropriate technical measures to ensure the security of your data.

What is the lawful basis for processing personal data?

Where the reason for collecting your data is linked to our regulatory functions and/or performance of our regulatory functions and responsibilities (including when we carry out our consultations), we will process personal data if it is necessary in the performance of a task in the public interest.  If you are a service provider, it will also be necessary to process your personal data in performance of our contractual obligations.  As set out above for, “Video and audio recordings”, you will be notified separately of the lawful basis we will rely on if we wish to record a meeting with you.

We have published further information about the personal data we process.

Special Category Personal Data:

We do not routinely process special category personal data for the purposes of our regulatory work.  Should a very exceptional circumstance arise where we intend to collect such data, we will only so do in accordance with the data protection principles, and we will separately communicate the lawful bases we will rely on.  If special category personal data is sent to us voluntarily (i.e. as part of a response to a consultation), we will not retain or further process this data unless we believe such data is required for the consultation and we have either explicit consent, or we are provided with evidence to demonstrate that the special category personal data was made manifestly public by the data subject.

For how long does the LSB keep your personal data?

The LSB will only retain your personal data for as long as necessary, however the period of retention will vary depending on the nature of our engagement with you. More information on the retention periods followed by the LSB is available in our record retention schedule.

Your rights

You have a number of rights relating to your personal data.

Public registers

The LSB has statutory duties to publish and maintain two public registers relating to licensing authorities: a list of disqualified persons (section 100 LSA) and a list of persons subject to objections and conditions  (paragraph 51, Schedule 13 LSA).

List of disqualified persons

The LSB publishes and maintains a list of persons disqualified by a licensing authority from holding roles within or working for any licensed body providing a reserved legal activity.

List of persons subject to objections and conditions

The LSB publishes and maintains a list of persons to whom a licensing authority has:

  • objected to holding a restricted interest in a licensed body, or
  • imposed conditions on their holding of a restricted interest in a licensed body.

What personal data does the LSB publish?

The LSB will publish the name and date of birth of persons on the List of disqualified persons or List of persons subject to objections and conditions, notified to the LSB by the relevant approved regulator or licensing authority in accordance with the LSA.

Why does the LSB publish personal data?

The LSB has a duty under the LSA to publish a list of disqualified persons and to make the list of persons subject to objections and conditions available to every licensing authority. It is in the public and consumer interests for information about persons who are disqualified or restricted from involvement in the provision of legal services to be made available

What is the lawful basis for processing personal data?

Processing this personal data is necessary for the performance of a task carried out in the public interest, and in the exercise of the LSB statutory functions.

What happens to this information when it expires or the circumstances of the person listed change?

Once a record on any of the lists has expired or is no longer valid for whatever reason, it will be permanently deleted and securely disposed of from all records kept by the LSB.

Further information and access to the lists is available via our website.

Your rights

You have a number of rights relating to your personal data.

Research

We conduct research to assist us fulfil our regulatory functions. Research helps us to understand how the legal services market is functioning, its consumers, and identify areas of concern to inform our work as an oversight regulator.

What information does the LSB collect?

We collate and analyse a wide variety of research and survey responses, including personal data such as names and contact information and some pseudonymised or anonymised special category personal data.

How does the LSB collect research based personal data?

In most cases research will be carried out on our behalf by a third party who will pseudonymise the personal data before it is shared with the LSB.  We will only engage with third parties who can provide assurances that they have in place appropriate safeguards that enable them to collect personal data in full compliance with data protection laws.

Where we do collect personal data either directly from data subjects or from a third party (such as an approved regulator), we will pseudonymise that data at the point of collection and notify data subjects if required to do so.  We will only depart from this approach if it is considered necessary for the purposes of the research being carried out, and where such processing can be done lawfully. We will never handle special category personal data unless it has been pseudonymised or anonymised first.

If necessary or advisable in accordance with data protection laws we will additionally carry out a data protection impact assessment (DPIA) and record the safeguards in place to ensure that the data is held securely.  The types of personal data that the LSB might retain and the period during which that data is held will depend on the nature of the research but we will never hold the data for longer than necessary.

Who has access to your personal data, where is it stored and is it secure?

We will only disclose research based personal data where it is lawful to do so. The information will be shared internally within the LSB and stored in our electronic database using restricted access folders.  We will never share research based personal data outside the LSB.  We will only share and publish reports which are generated from the research results.  Such results will always be presented anonymously.

What is the lawful basis for processing personal data?

The processing of personal data in research undertaken by the LSB is necessary for the performance of a task in the public interest and in the exercise of our statutory functions. If you are a service provider, we will rely on performance of contractual obligations.  If we process special category personal data, the lawful basis will be expressly set out within a bespoke DPIA and, if required, data subjects will be notified separately.

For how long does the LSB keep research data?

The LSB will only retain research based personal data until the final research report is complete or, where a basis for comparison with future research is required, until the research results are no longer useful.  Further information is contained within the LSB’s record retention schedule.

Your rights

You have a number of rights relating to your personal data.

Stakeholder engagement

As part of our stakeholder activities we collect personal data from you when you attend an LSB event, request information, subscribe to LSB press releases or updates, provide a consultation response, or participate in our research activities.

We hold the names and contact details of individuals acting in their capacity as representatives of their organisations during their professional engagement with us. This includes those we engage with in calls for evidence, consultation papers and other dialogue with regulators, public and industry bodies, educational institutions, firms, authorised persons and non-commercial bodies.

What information does the LSB collect?

We typically collect names, addresses and contact details, including email or postal addresses, telephone numbers, and records of the discussions and interactions we have with you, including but not limited to any personal data you volunteer by way of evidence or example in your response to a consultation or other call for evidence.  On occasion, we also collect information on individuals’ qualifications, skills, experience and employment history and status, where we are considering engaging with you on matters relating to your areas of expertise.

Video and audio recordings

We will occasionally record meetings, calls and other events, however we will only do so if we are able to rely on a lawful basis under the GDPR (see below).  We may ask you to provide your consent if another lawful basis is unavailable.  Further bespoke information about the software platform we will use to record the meeting will be provided to you before the meeting takes place.  We will also confirm the lawful basis we will rely on and tell you how we will handle your personal data throughout.

Audio and video recordings of you will not be captured unless you activate your video and/or microphone functions, however your name will be visible onscreen.

How does the LSB collect your data?

We normally collect your personal data directly from you, although if we do not, we will obtain this information from your colleagues or other third parties (if appropriate) or publicly available resources.

Why does the LSB process your personal data?

We retain contact information from a wide variety of stakeholders so that we may engage with them to inform the development of our policies and strategies, research and other projects. Such engagement helps us to build stronger relationships with stakeholders.

We also use the email addresses provided to us when you sign up to receive our newsletters and we will sometimes use the contact details of those we have a relationship with, in their capacity as representatives of their organisation, to invite them to LSB events.

Who has access to your personal data?

We will only process your personal data when it is lawful to do so. Your information will be shared internally within the LSB and with third parties in the circumstance set out below.

Vendors, consultants, and other service providers

We share your personal data with third party data processors who contract with us to undertake work on our behalf and require access to your information for that work.  This would include access to our databases for IT maintenance and remedial work. Third party providers only process your personal data under our instructions and are subject to a duty of confidentiality.  They will not share your personal data with any organisation apart from us. They will hold it securely and retain it for the period we instruct.

Consultations and other calls for evidence

The LSB consults the public as part of its open policy making process, which forms part of its regulatory functions under the Legal Services Act 2007. We publish our consultations on [web address].  You can respond by following the instructions on each of our consultations or calls for evidence (now collectively referred to as consultations in this notice).

We will only handle personal data that is voluntarily submitted by you within your response.  The way in which your personal data is handled varies depending on how you submit your response, but all information submitted to us will be treated in accordance with data protection principles.

Purpose

We collect your personal data as part of the consultation process:

  • so that we can contact you regarding your response or related matters
  • for statistical data, for example the types of individuals and groups participating

Why we need it

We collect your name and email or postal address so that:

  • we know you are a real person or that you genuinely represent a named organisation
  • we can respond to your comments

We also collect data in order to gather information about the types of individuals and groups that participate in our consultations.

What we do with your data

Unless the consultation document states otherwise, we will publish your consultation responses, provided that we can do so without publishing personal data. We may also summarise or refer to your information in our published response document.

In the event that your response contains the personal data of a third party, we will not process it further without obtaining evidence that such data is lawfully shared with the LSB.

We will share your data if we are required to do so by law, for example by court order, or to prevent fraud or other crime.  All information contained in your response, including personal data, may also be subject to publication or disclosure if requested under the Freedom of Information Act 2000.

If you do not wish for your personal data to be disclosed following a Freedom of Information request, you should limit or remove it completely from your response.  If you want the information in your response to be kept confidential, you should also explain why as part of your response, although the LSB cannot guarantee that it will be able to adhere to your request.

Compliance with laws and in the exercise of our regulatory functions and objectives

As the oversight regulator for legal services, where necessary we may share your personal data with other regulators and public authorities. We may also be legally obliged to share your personal data with law enforcement agencies. We will always satisfy ourselves that we have a lawful basis on which to share personal data, and document our decision making before doing so.

Transfer of personal data outside the EEA

Your data is highly unlikely to be transferred to countries outside the European Economic Area (EEA), however where this may occur, the LSB will specify the purpose for the transfer and the legal basis on which your data will be processed. This may, for example occur when remote meetings are recorded and stored in locations outside the EEA (see above on “Video and audio recordings”).  Where necessary the LSB will seek your consent to transfer your data outside the EEA.  At all times, your data will only be transferred outside the EEA on the basis of adequate assurances received from those receiving your data.  This may take the form of a declaration of adequacy, binding corporate rules or other safeguards.

How does the LSB protect data?  Where is your personal data stored and is it secure?

We store consultation and call for evidence responses and correspondence, within a designated folder in our electronic database.  We also use customer relationship management (CRM) database technology, provided by a third part data processor, to store stakeholder contact information. Where the third-party processes personal data on our behalf, they do so in accordance with agreed terms which reflect the legal obligations of both the LSB and the third party under current data protection laws.  The third party who processes your personal data is accordingly under a duty of confidentiality and is obliged to implement appropriate technical measures to ensure the security of your data.

What is the lawful basis for processing personal data?

Where the reason for collecting your data is linked to our regulatory functions and/or performance of our regulatory functions and responsibilities (including when we carry out our consultations) we will process personal data if it is necessary in the performance of a task in the public interest.  Where no such link is established, we will rely on our and/or your legitimate interest to engage with you to share information about our work and events.  If you are a service provider, it will also be necessary to process your personal data in performance of our contractual obligations.  As set out above for, “Video and audio recordings”, you will be notified separately of the lawful basis we will rely on if we wish to record a meeting with you.

Special Category Personal Data

We do not routinely process special category personal data for the purposes of our stakeholder engagement.  Should a very exceptional circumstance arise where we intend to collect such data, we will only so do in accordance with the data protection principles, and we will separately communicate the lawful bases we will rely on.  If special category personal data is sent to us voluntarily (i.e. as part of a response to a consultation), we will not retain or further process this data unless we believe such data is required for the consultation and we have either explicit consent, or we are provided with evidence to demonstrate that the special category personal data was made manifestly public by the data subject.

For how long does the LSB keep personal data?

The LSB will only retain your personal data for as long as necessary, however the period of retention will vary depending on the nature of our engagement with you. Further information on the various retention periods that the LSB adheres to are contained with the LSB’s record retention schedule

Your rights

You have a number of rights relating to your personal data.

Recruitment

As part of any recruitment process, we collect and process personal data relating to job applicants. We are committed to being transparent about how we collect and use that data to meet our data protection obligations.

What information does the LSB collect?

The LSB collects a range of information about you. This includes:

  • your name, address and contact details, including email address and telephone number
  • details of your qualifications, skills, experience and employment history
  • information about your current level of remuneration, including benefit entitlements
  • whether or not you have a disability for which the LSB needs to make reasonable adjustments during the recruitment process
  • information about your entitlement to work in the UK and
  • equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief.

The LSB may collect this information in a variety of ways. For example, data might be contained in application forms, CVs or resumes, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment such as written tests or presentations.

We will also collect personal data about you from third parties, such as references supplied by former employers if you are successful in your application for employment with us.

Data will be stored in a range of different places, including on your application record, in HR management systems and on other IT systems (including email).

Why does the LSB process personal data?

We process your personal data at your request prior to entering a contract with you.

In some cases, we need to process data to ensure that we are complying with our legal obligations. For example, we required to check a successful applicant’s eligibility to work in the UK before employment starts.

We have a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows us to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide to whom to offer a job. We may also need to process data from job applicants to respond to and defend against legal claims.

We may process information about whether or not applicants are disabled to make reasonable adjustments for candidates who have a disability. We do this to meet our obligations and exercise specific rights in relation to employment.

Where we process other special categories of data, such as information about ethnic origin, sexual orientation, health or religion or belief, we do so for equality and diversity monitoring purposes.

Who has access to your personal data?

Your information may be shared internally for the purposes of the recruitment exercise. This includes the HR manager, interviewers involved in the recruitment process, managers in the business area with a vacancy and IT staff if access to the data is necessary for the performance of their roles.

We will not share your data with third parties, unless your application for employment is successful and we make you an offer of employment. We may then share your data with former employers to obtain references for you, and any other third parties who may need to receive notification of your employment.

We will not transfer your data outside the European Economic Area.

How does the LSB protect data?

We take the security of your personal data seriously. We have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the proper performance of their duties. We have data protection and other information security policies which are available to staff within our database.

How long does the LSB keep your personal data?

If your application for employment is unsuccessful, we will hold your data on file for one year after the end of the relevant recruitment process. At the end of that period, your data will be deleted or destroyed.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment by our HR team. The periods for which your data will be held are set out in our record retention schedule.

Your rights

You have a number of rights relating to your personal data.

Employees

The LSB collects and processes your personal data so that it can manage the employment relationship. We are committed to being transparent about how we collect and use that data to meet our data protection obligations.

What information does the LSB collect?

The LSB collects and processes a range of information about you. This includes:

  • your name, address and contact details, including email address and telephone number, date of birth and gender
  • the terms and conditions of your employment
  • details of your qualifications, skills, experience and employment history, including start and end dates, with previous employers and with the LSB
  • information about your remuneration, including any benefits such as pensions or insurance cover
  • details of your bank account and national insurance number
  • information about your marital status, next of kin, dependants and emergency contacts
  • information about your nationality and entitlement to work in the UK
  • information about your criminal record
  • details of your schedule (days of work and working hours) and attendance at work
  • details of periods of leave taken by you, including holiday, sickness absence, family leave and sabbaticals, and the reasons for the leave
  • details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence
  • assessments of your performance, including objectives, appraisals, performance reviews, peer reviews, performance improvement plans and related correspondence
  • information about medical or health conditions, including whether or not you have a disability for which the LSB needs to make reasonable adjustments and
  • equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief.
  • video and audio recordings of you during remote meetings, calls and other events. We will always provide you with further, bespoke information before the meeting takes place. This information will include details about the software platform we will use to record the meeting, the lawful basis we will rely on to record, and how we will handle your personal data throughout.  Audio and video recordings of you will not be captured unless you activate your video and/or microphone functions, however your name will be visible onscreen.

How does the LSB collect your data?

We may collect your personal data in a variety of ways. For example, data might be collected through application forms, online meetings, calls or other such events, CVs or resumes; obtained from your passport or other identity documents such as your driving licence; from forms completed by you at the start of or during employment (such as your annual LSB choices form); from correspondence with you; or through interviews, meetings or other assessments.

In some cases, we may collect personal data about you from third parties, such as references supplied by former employers, information from employment background check providers, information from credit reference agencies and information from criminal records checks permitted by law.

Why does the LSB process your personal data?

We need to process data to enter into an employment contract with you and to meet our obligations under your employment contract. For example, we process your data to provide you with an employment contract, to pay you in accordance with your employment contract and to administer your LSB choices, (which includes your pension and other benefits) and life assurance entitlements.

In some cases, we process personal data to ensure that we are complying with our legal obligations. For example, we are required to check an employee’s entitlement to work in the UK, to deduct tax, to comply with health and safety laws and to enable employees to take periods of leave to which they are entitled.

In other cases, we have a legitimate interest in processing personal data before, during and after the end of the employment relationship. Processing employee data allows us to:

  • run internal role changes and promotion processes
  • maintain accurate and up-to-date employment records and contact details (including details of who to contact in the event of an emergency), and records of employee contractual and statutory rights
  • operate and keep a record of disciplinary and grievance processes, to ensure acceptable conduct within the workplace
  • operate and keep a record of employee performance and related processes, to plan for career development, and for succession planning and workforce management purposes
  • operate and keep a record of absence and absence management procedures, to allow effective workforce management and ensure that employees are receiving the pay or other benefits to which they are entitled
  • obtain occupational health advice, to ensure that it complies with duties in relation to individuals with disabilities, meet its obligations under health and safety law, and ensure that employees are receiving the pay or other benefits to which they are entitled
  • operate and keep a record of other types of leave (including maternity, paternity, adoption, parental and shared parental leave), to allow effective workforce management, to ensure that the LSB complies with duties in relation to leave entitlement, and to ensure that employees are receiving the pay or other benefits to which they are entitled
  • operate and keep an important record of issues raised and decisions taken relating to our regulatory functions and other work by recording certain of our online meetings, calls and other events for the benefit of the wider organisation.
  • ensure effective general HR and business administration
  • provide references on request for current or former employees
  • respond to and defend against legal claims; and
  • maintain and promote equality in the workplace.

Some special categories of personal data, such as information about health or medical conditions, is processed to carry out employment law obligations (such as those in relation to employees with disabilities).

Where we process other special categories of personal data, such as information about ethnic origin, sexual orientation, health or religion or belief, this is done for the purposes of equality and diversity monitoring. Data that we use for these purposes is anonymised or is collected with the consent of employees, which can be withdrawn at any time. Employees are entirely free to decide whether or not to provide such data and there are no consequences of failing to do so.

Who has access to data?

We know how important it is to protect your privacy and to comply with data protection laws. We will safeguard your personal data and will only disclose it where it is lawful to do so.

Your information will be shared internally with the LSB’s HR manager, your line manager, the Senior Leadership Team and IT staff if access to the data is necessary for performance of their roles.  Your information may also, where necessary, be shared with other colleagues at the LSB, including but not limited to your peers and the Board.

We share your data with third parties in order to obtain pre-employment references from other employers, obtain employment background checks from third-party providers and obtain necessary criminal records checks from the Disclosure and Barring Service.

We also share your data with third parties that process data on our behalf, in connection with payroll, the provision of benefits including but not limited to pensions and life assurance and the provision of occupational health services.  We will also share your data with our Remuneration and Nominations Committee, which comprises of both independent members and LSB Board members.  We may also share your data with our auditors in accordance with carrying out their duties.

Transfer of personal data outside the EEA

Your data is highly unlikely to be transferred to countries outside the European Economic Area (EEA), however where this may occur, the LSB will specify the purpose for the transfer and the legal basis on which your data will be processed. This may, for example occur when remote meetings are recorded and stored in locations outside the EEA (see above on “Video and audio recordings”).  At all times, your data will only be transferred outside the EEA on the basis of adequate assurances received from those receiving your data.  This may take the form of a declaration of adequacy, binding corporate rules or other safeguards.

Collecting your data lawfully

The LSB will normally rely on one or more of a number of legal bases for collecting and processing your personal data.  Further information on the legal bases that the LSB relies on for matters where it regularly collects your personal data (including but not limited to the matters referred to under, “Why Does the LSB process your personal data?” above), can be found within the following link:

HR register of personal data

Seeking your consent

In certain circumstances the LSB may decide that it may only process your personal data if you give consent.  This will normally only occur where your personal data cannot be processed in reliance of another legal basis.  In these limited circumstances you will be provided with additional information to ensure that any consent you give is free, specific, informed and unambiguous.  You may withdraw your consent at any time.

How does the LSB protect data?  Where is your personal data stored and is it secure?

Your data will be stored securely in a range of different places, including your manager’s and your own personal folders within our electronic information database and within the LSB’s electronic HR folders.  On a short-term basis, correspondence containing your personal data will also be stored in the LSB’s email system.

We take the security of your data seriously. The LSB has internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties. We have data protection and other information security policies which are available to staff within our database.   Where we engage third parties to process personal data on our behalf, we do so in accordance with agreed terms which reflect the legal obligations of both the LSB and those third parties under current data protection laws.  Third parties who process your personal data are accordingly under a duty of confidentiality and are obliged to implement appropriate technical measures to ensure the security of your data.

For how long does the LSB keep data?

We will only retain your personal data for as long as necessary, however the period of retention will vary depending on the types of data held and the purposes for which it is retained.  Further information on the various retention periods that the LSB adheres to are detailed in our record retention schedule.

What if you do not provide personal data?

You have some obligations under your employment contract to provide the LSB with data. In particular, you are required to report absences from work and you may be required to provide information about disciplinary or other matters under the implied duty of good faith. You may also have to provide the LSB with data in order to exercise your statutory rights, such as in relation to statutory leave entitlements. Failing to provide the data may mean that you are unable to exercise your statutory rights.

Certain information, such as contact details, your right to work in the UK and payment details have to be provided to enable the LSB to enter a contract of employment with you. If you do not provide other information, this will hinder the LSB’s ability to administer the rights and obligations arising as a result of the employment relationship efficiently.

Your rights

You have a number of rights relating to your personal data.

Last updated April 2023