Appropriate Policy Document (DPA 2018, Schedule 1, Part 4)

at-Taʾṣīl (التأصيل) · Foundation Diploma in Islamic Studies · International Islamic College, Leicester

Ref: TSL-POL-012 · Version: 1.0 (draft) · Date: 7 September 2026 · Owner: Programme Lead (Ustādh Emran Ahmed) · Review: before the Programme opens, then annually.

1. Why this document exists

The College's Privacy Notice (TSL-POL-010) relies on a substantial-public-interest condition in the Data Protection Act 2018 when it processes special-category data to act on a safeguarding concern. Schedule 1, Part 4 of that Act requires a controller relying on such a condition to have an "appropriate policy document" in place. This is that document. It must exist, and be kept, before the first applicant's data is taken.

2. The condition relied on

Schedule 1, paragraph 18 — safeguarding of children and of individuals at risk. The College processes special-category data (most often health information, and the sensitive content of a safeguarding record) without consent only where the processing is necessary to protect a child (a student aged 16 or 17) or an adult at risk from neglect or physical, mental or emotional harm, or to protect their physical, mental or emotional wellbeing, and where consent cannot be obtained, cannot reasonably be expected to be obtained, or would prejudice the protection. Religious data processed in the ordinary running of the Programme is handled under Article 9(2)(d) (or explicit consent), not under this condition — see Privacy Notice §5.

3. How the Article 5 principles are met

• Lawfulness, fairness, transparency. The lawful bases are stated in Privacy Notice §4; students and parents receive the notice and the safeguarding statement before the first session.
• Purpose limitation. Safeguarding data is used to act on the concern and for nothing else; it is never used in assessment or admissions decisions.
• Data minimisation. Only what the concern requires is recorded — in the person's own words, with date and time (Safeguarding Policy §8.1).
• Accuracy. Records distinguish fact from account; corrections are appended, never overwritten.
• Storage limitation. Retention follows §4 below.
• Integrity and confidentiality. Records are held confidentially by the College as data controller, separately from academic records, seen only by those who must act on them (Safeguarding Policy §11; Privacy Notice §7); a record of a concern that involves the safeguarding lead himself — who is also the teacher, Ustādh Emran Ahmed — is held by the Academic Lead, to whom such concerns go, and the lead has no access to it; nothing goes to the masjid beyond what safety requires.

4. Retention and erasure

Safeguarding records concerning an under-18 are kept until the person's 25th birthday, and longer where abuse is alleged; other safeguarding records follow statutory safeguarding guidance for the type of record (Privacy Notice §8). They are not erased early on request. This document is retained for the duration of the processing and for six months after it ends, and is provided to the ICO on request.

Revision history

International Islamic College, Leicester · 07436 436363 · info@theiic.uk · theiic.uk