Policies

The Paul Mellon Centre (PMC) needs to keep certain personal data in order to fulfil its purpose. This includes, but is not limited to, personal data about staff, Grant and Fellowship applicants, Yale in London students, British Art Network members, event contributors and attendees, researchers, scholars, authors, private owners and other individuals engaging with PMC activities.

The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (UK data protection legislation) provide the legal framework by which this personal data must be managed. They also give individuals important rights in relation to their personal information, including being able to find out what information is held about them.

The aim of this policy is to set out PMC’s commitment to UK data protection legislation and to the proper handling of personal data. It is also to help ensure that all staff are aware of their responsibilities in relation to the legislation and to minimise the risk of a breach, which would potentially damage valued relationships with staff, stakeholders and audiences, as well as PMC’s reputation.

This policy covers all personal data, including special category data processed by PMC. (definitions in Section 3.).

It applies to all personal data however it is recorded or used, whether on paper, electronically or in any other medium. This includes, but is not limited to, email.

It applies to all individuals working for PMC whatever their role. This includes permanent and contracted staff, as well as temporary employees, volunteers, interns etc.

This policy is complementary to PMC’s Archives & Records Management, IT & Security and Digital Preservation policies. It is also complementary to PMC’s Staff Handbook.

Detailed information about how PMC collects, uses and shares personal data of external individuals is available in our Privacy Policy.

Information about how PMC collects, uses and shares personal data of staff is available in our Employee Privacy Policy.

Under the terms of the legislation:

• Personal data means data which relates to a living individual (data subject) who can be directly or indirectly identified, in particular by reference to an identifier such as their name, ID number, location data, email address or online identifier (e.g. IP address and cookies).
• Special category is a subset of personal data and subject to tighter controls on its processing. It includes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, data concerning a person’s sex life, and data concerning a person’s sexual orientation.
• Data subject means the individual about whom the personal data/sensitive personal data is held.
• Processing encompasses almost anything that can be done to data, including (but not exclusively) obtaining, organisation, use, retrieval, consultation, disclosure and destruction.

PMC’s responsibilities in relation to data protection are determined by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

PMC is committed to the seven Data Protection Principles contained in the UK GDPR, as follows:

• lawfulness, fairness and transparency
• purpose limitation
• data minimisation
• accuracy
• storage limitation
• integrity and confidentiality (security)
• accountability

These principles sit at the heart of all processing of personal data undertaken at PMC.

PMC is committed to the rights of data subjects contained within the UK GDPR, as follows:

• the right of access
• the right to be informed
• the right to rectification
• the right to erasure
• the right to object
• the right to restrict processing
• the right to data portability
• the rights in relation to automated decision making and profiling

In accordance with these rights, PMC is committed to providing clear and transparent privacy notices at the point of data collection and ensuring that PMC’s online Privacy Notice is accurate and up to date.

Any individual data subject, including staff, has the right to ask what information PMC holds about them and why this is being held. Members of the public wishing to submit a Subject Access Request (SAR) should contact the Data Protection Manager by email at dataprotection@paul-mellon-centre.ac.uk or by post at 16 Bedford Square, WC1B 3JA. Members of staff wishing to exercise their rights under the regulation should contact the Data Protection Manager directly.

If an SAR is received by any member of staff it should be forwarded to the Data Protection Manager.

PMC will comply with requests for access to personal information (SARs) as quickly as possible. In compliance with the law, this will always be at the latest within one month of receipt of a request.

PMC is committed to the accountability principle and demonstrates compliance by ensuring it has in place, for example, a Data Protection Policy, an online privacy notice, staff training, transparent privacy notices and regular reviews of related relevant policies (HR, IT and Security etc.).

The Board of Trustees of PMC is the Data Controller. The Data Controller is the legal entity who must comply with UK Data Protection legislation and ensure that its provisions are upheld in all processing across PMC. The Board of Trustees has primary and ultimate responsibility for compliance with UK Data Protection legislation at PMC.

The Director is responsible for promoting accountability and compliance with UK Data Protection legislation within PMC. They are responsible for securing PMC-wide compliance and managing risk, ensuring appropriate technical (IT, infrastructure, software, systems etc.) and organisational measures (policies, procedures, practices etc.) are in place to confirm the integrity and security of personal data. They are also responsible for developing and implementing a PMC-wide strategy for Data Protection legislation adherence across the institution.

The Data Protection Manager is responsible for working with the Director to develop and implement a PMC-wide strategy for Data Protection legislation adherence across PMC. They are responsible for working with relevant staff to ensure PMC-wide compliance. They are also responsible for implementing data protection policies, internal audits, privacy notices, staff training and other relevant procedures. They will act as the first point of contact for all internal and external queries and are responsible for seeking legal advice where necessary and reporting any breach to the Information Commissioner’s Office.

The Senior Leadership Team are responsible for ensuring that all processing in their area complies with UK Data Protection legislation. In particular, they are responsible for liaising with the Data Protection Manager to ensure that, in their area, transparent privacy notices are included at all points of personal data collection, including special category data, and that any contracts or agreements with external contractors processing personal data, including special category data, on PMC’s behalf are compliant with UK data protection legislation. They are also responsible for notifying the Data Protection Manager of any significant changes to data processing that may require a change to PMC policy, training etc.

The HR Manager is responsible for working with the Data Protection Manager to ensure that appropriate guidance and training on compliance with UK data protection legislation is made available to all staff engaged in the processing of personal data, including special category data. They have delegated responsibility from the Data Controller to ensure that staff personal data is processed in accordance with UK data protection legislation.

The Records Managers are responsible for determining retention periods for records across PMC.

All staff are responsible for ensuring that any processing of personal data carried out in the course of their work is compliant with UK data protection legislation and with this Data Protection Policy. It is their responsibility to be aware of the UK data protection legislation’s processing principles (see Section 5. above) and to raise any concerns about how personal data, including special category data, is collected and managed with their line manager. PMC will ensure they are given appropriate training to fulfil this responsibility.

All external data processors processing personal data, including special category data on behalf of PMC (i.e. third parties), are contractually required to comply with UK data protection legislation and associated codes of practice. The Senior Leadership Team, in conjunction with the Director, are responsible for ensuring that this is upheld (see above). 

PMC will organise training for all new staff and annual training for staff regularly processing personal data, including special category data.

Breach of UK data protection legislation is a criminal and potentially civil offence and PMC will regard wilful or reckless breach of this policy as a disciplinary offence and such breaches will be subject to PMC’s disciplinary procedures.

It is the duty of all members of staff to flag up immediately to their line manager, the Data Protection Manager or the Director any matter arising which involves, or is thought to involve, a breach of UK data protection legislation. Any serious breach will be reported to the Board of Trustees.

This policy will be reviewed every five years.

Next review 2030

Approved at the Board of Trustees meeting on 16 June 2025