Managers and trustees must take data security seriously and must take appropriate steps to avoid sensitive data falling into the wrong hands. This includes client information, staff and volunteer details, financial information or confidential reports.

Have a written policy about using and storing passwords and include it in your induction information.

Store data in as few places as possible and allow access to the fewest people possible. Check regularly that you still comply with the Data Protection Act. Take practical steps. Have data backed up off site. Make sure premises are secure. Check your insurance. Change administrator passwords when staff leave. Have a firewall installed to prevent external access.

www.ictknowledgebase.org.uk/security