Data Protection and Privacy Policy

Data covered

Punjabi Samvad handles personal data about programme participants, children and parents, staff, volunteers, donors, partners and people who contact the organisation.

Rules for handling data

• State the purpose before or when collecting data.
• Collect only the data needed for that purpose.
• Use data for the stated purpose or another lawful purpose.
• Limit access to authorised roles.
• Correct relevant errors when a person raises them.
• Retain data for a legal, contractual or programme need, then delete or anonymise it.
• Use safeguards suited to the sensitivity and risk.

High-risk information

Teams apply tighter access and sharing controls to children's data, health and mental-health information, HIV-related information, identity documents, complaints and safeguarding records. Staff must not place sensitive case details in public reports or personal messaging groups.

Children

Punjabi Samvad obtains parent or guardian authorisation and the child's assent where appropriate. It does not use children's data for targeted advertising or behavioural monitoring and does not process it in a way likely to harm the child.

Security incident

A person who discovers loss, unauthorised access, mistaken disclosure or another data compromise must alert the Privacy Responsible Person at once. Punjabi Samvad contains the incident, preserves facts, assesses affected people and makes any notice required by law.

Current legal position

The Digital Personal Data Protection Rules, 2025 use staggered commencement dates. Punjabi Samvad applies the safeguards in this policy as its current standard and will update procedures as the remaining provisions take effect.