INFORMATION SECURITY, COMMUNICATIONS & TECHNOLOGY, INCLUDING CARDHOLDER DATA, POLICY 2026
This policy was approved by the Committee of Management on 22nd July 2026 It should be reviewed again no later than 30th June 2029
The policy has been assessed through the organisational impact assessment process.
We can, if requested, produce this document in different formats such as larger print or audioformat. We can also translate the document into various languages, as appropriate.
SCOTTISH
HOUSING
STANDARD 1
The governing body leads and directs the RSL to achieve REGULATOR good outcomes for its tenants and other service users. STANDARDS
STANDARD 2
The RSL is open about and accountable for what it does. It understands and takes account of the needs and priorities of its tenants, service users and stakeholders. Its primary focus is the sustainable achievement of these priorities.
STANDARD
3
The RSL manages its resources to ensure its financial well-being, while maintaining rents at a level that tenants can afford to pay.
STANDARD 4
The Governing body bases its decisions on good quality information and advice and identifies and mitigates risks to the organisation’s purpose.
STANDARD 5
The RSL conducts its affairs with honesty and integrity.
STANDARD 6
The Governing body and senior officers have the skills and knowledge they need to be effective.
1.0 INTRODUCTION
This policy sets out West Granton Housing Co-operative’s requirements for the secure and appropriate use of information, communications technology, personal data, confidential business information and payment card information. It incorporates requirements relating to cardholder data and should be read together with operational procedures including the Payment Card Security Procedures, ICT procedures, Data Protection procedures and any approved incident response arrangements.
The following have been considered in relation to this policy:
UK General Data Protection Regulation (UK GDPR)
Data Protection Act 2018
Data (Use and Access) Act 2025, where relevant to the processing, access and use of data
Freedom of Information (Scotland) Act 2002 and associated Scottish Information Commissioner guidance, where applicable
Environmental Information (Scotland) Regulations 2004, where applicable
Equality Act 2010
Housing (Scotland) Act 2010
Scottish Housing Regulator Regulatory Framework and Regulatory Standards of Governance and Financial Management
Scottish Social Housing Charter
Payment Card Industry Data Security Standard (PCI DSS) version 4.0.1, or any successor version adopted by the payment card industry
EU Artificial Intelligence Act, where relevant to the use of AI tools and services
1.1 Responsibility & Authority
WGHC policies must be approved by the Committee of Management. Minor amendments or updates to policy may be made by the CEO or COO within the limits set out in WGHC’s Governance Policy. Operational procedures, in line with policy, may be approved by the CEO or COO.
The COO will be primarily responsible for making relevant information about the Co-operative available, via information provided on the WGHC website and/or via the Guide to Information.
The focus will be very much on providing accessible, relevant information to our members and their households. The CEO will primarily be responsible for information security and for registration under the Data Protection Act. The CEO must authorise the release of business information. The CEO or COO must authorise the release of personal data to the data subject or third parties / requester if not personal data, i.e. Police or Home Office requests.
1.2 Information made widely available
WGHC will strive to achieve implementation of the Office of the Scottish Information Commissioner’s (OSIC) model publication framework. The Senior Management Team has responsibility for various tenant and services information and will share this with the COO who will act as the website Co-ordinator and DPO for both FOISA requests and Subject Access Requests. The DPO will also respond to any data protection complaints, if received.
Document Name:
Created:
Owner:
Location / Path:
Information, Communications & Technology Policy
David Mills / WGHC
David Mills / WGHC
WGHC \ X:
Version:
In accordance with recommended practice, we will use our website as the main method of publication. However, we recognise not all our members have internet access and will continue to also use letters, leaflets, newsletters etc. to disseminate information.
On our website we will publish and keep up to date information in the following categories:
About us – structure, governance and membership;
Decision making – role of committee and recent committee decisions;
Finance – income and expenditure;
Services – what we do and how to contact us
Who we work with – contractors
Performance – performance information, complaints & appeals;
Policies – key WGHC policies.
1.3 Annual Information
In accordance with our rules, we will provide information to tenants prior to the Annual General Meeting including:
Annual report;
Annual financial statements;
AGM agenda, minutes & reports.
We will also provide an Annual Report on the Charter (ARC) to tenants by the end of October each year. The ARC will contain a summary of how WGHC has performed in relation to key performance indicators issued by the Scottish Housing Regulator.
1.4 Periodic Information
WGHC will periodically produce leaflets and guides about housing related topics. We also receive leaflets from other agencies about housing or local issues. These will be displayed or distributed in the most appropriate ways. We shall issue information periodically about new proposals and issues of concern. The principal methods will be by email, personal letter or personal contact. Regular updates will be displayed on the WGHC website. Our quarterly newsletters are another popular way of receiving general information.
1.5 Translation
WGHC will promote the use of interpreters and/or provide assistance for those that may need it, as appropriate
2.0 INFORMATION SECURITY - GENERAL
Information should only be accessible to those to whom it is of use in the course of their work. However, given the small number of staff and extent of generic working it is recognised that barriers to information, especially relating to tenants, is often impractical.
Document Name:
Created:
Owner:
Location / Path:
Information, Communications & Technology Policy
David Mills / WGHC
David Mills / WGHC
WGHC \ X:
Version:
Version Date: Review Due: Pages: 1.0 22/07/26 30/06/29 Page 5 of 18
Both staff and committee members must not disclose any personal information about data subjects to which they have access to any other person except as permitted by this policy. This respect for confidentiality is also highlighted in other WGHC policies and in the Staff and Committee Codes of Conduct.
The Committee of Management’s role is strategic rather than operational. Committee will not have access to personal information about other tenants, staff and other data subjects.
Disclosure of information about individuals to Committee members will only be made when it is necessary (e.g. disciplinary hearings, membership applications). Such disclosure should be limited to the information necessary for the task in hand.
In the case of appeals or complaints or disciplinary cases being heard by the Committee or a Subcommittee: where practical names and addresses and other information which would identify an individual will not be disclosed in reports.
In some cases, given WGHC’s relatively small stock and small number of staff, it is accepted that it may be effectively impossible not to identify an individual, especially where the individual puts their case in person. However, Committee members are at all times bound to act impartially and to disclose any personal interest.
3.0 CARDHOLDER DATA SECURITY
WGHC handles payment card information only where there is a legitimate business requirement. Sensitive cardholder data must be protected by appropriate technical, physical and organisational safeguards. Staff must handle cardholder information in line with this policy, the Payment Card Security Procedures, relevant data protection procedures and PCI DSS requirements.
3.1
Cardholder information and acceptable use
Cardholder data must only be accessed, used, displayed or shared where there is a genuine business need and appropriate authorisation.
Staff must protect cardholder data from unauthorised access, disclosure, alteration, loss or destruction.
Passwords, accounts and authentication methods must be kept secure and must not be shared.
Desks, screens, payment devices and any paper records containing sensitive information must be secured when unattended.
Information security incidents, suspected cardholder data breaches, device tampering or suspicious behaviour must be reported without delay to the COO, CEO or DPO in accordance with the incident response procedure.
Document Name:
Created:
Owner:
Location / Path:
Information, Communications & Technology Policy
David Mills / WGHC
David Mills / WGHC WGHC \ X:
Version:
3.2 Stored cardholder data
WGHC must not store sensitive authentication data after authorisation. Where cardholder data is required for a legitimate business purpose, it must be minimised, protected and retained only for as long as necessary in accordance with approved retention arrangements.
The contents of a payment card magnetic stripe or chip track data must not be stored on any media.
The card verification value or code must not be stored on any media after authorisation.
A PIN or encrypted PIN block must not be stored.
Any display of a primary account number must be restricted to the minimum necessary, normally no more than the first six and last four digits.
3.3 Classification, access and third parties
Cardholder data is classified as confidential information. Access must be limited to authorised users whose role requires it and must follow the principles of least privilege and need to know. Where a service provider may store, process, transmit or otherwise affect the security of cardholder data, WGHC must maintain appropriate records, carry out due diligence, obtain written acknowledgement of the provider’s responsibilities and monitor relevant PCI DSS compliance status where applicable.
3.4 Payment devices and physical security
Access to areas, systems or media containing cardholder data must be physically restricted to authorised persons.
Visitors must be escorted where they may access areas containing sensitive information or payment devices.
WGHC must maintain a list of payment devices, including make, model, location and serial number or other unique identifier.
Payment devices must be inspected periodically to identify tampering, substitution or other suspicious changes.
Staff using payment devices must verify the identity of third parties claiming to repair, maintain, install or replace devices and must report suspicious behaviour immediately.
3.5 Transmission and transfer of cardholder data
Cardholder data must not be sent by email, instant messaging, chat or other end-user messaging technology unless there is an approved business requirement and strong encryption or an approved secure method is used. Physical movement of media containing cardholder data must be authorised, logged and protected in transit. Only secure and approved delivery arrangements may be used.
Version: Version Date:
3.6 Disposal of cardholder data
Cardholder data must be securely disposed of when no longer required, regardless of format or storage location.
Paper records must be cross-cut shredded, pulped, incinerated or otherwise destroyed so that they cannot be reconstructed.
Electronic media must be securely wiped, rendered unrecoverable or physically destroyed using an approved method.
Material awaiting destruction must be held securely with access restricted to authorised staff.
3.7 PCI security awareness and incident response
Staff and contractors who handle sensitive information must receive appropriate awareness information and must follow approved procedures. Suspected or confirmed compromise of cardholder data, payment devices or systems forming part of the cardholder data environment must be managed under WGHC’s incident response arrangements, including escalation to the CEO, COO, DPO, IT provider, merchant services provider, insurer, Police Scotland or payment card brands where required by procedure, contract or law.
4.0 INFORMATION SECURITY – COMPUTER SYSTEMS
WGHC’s computers are on a network controlled by a server housed within the comms room. The server has a mapped drive “WGHC files” on which most WGHC day to day files are stored. Files are arranged in folders according to activity. There is a mixture of pro forma letter, tenant file notes, spreadsheets etc. These files are for common use. Staff should try to ensure any new file is saved in the right place and avoid filling folders with files which only they as individuals may ever use or refer to.
Files stored on the server are backed up daily at 09.00, 13.00 and 18.00hrs Incremental backups are retained for 2 weeks. Each member of staff’s “my documents” is mapped to a U-drive on the server. Files saved in my documents should therefore be backed up along with other files.
Organisational logos, working procedures, document layouts, legislative requirements change reasonably frequently. As such, staff should not save files to their computer desktop or to anywhere other than “my documents” on their computer as:
These files will not be backed up
WGHC could encounter ‘version control’ issues
4.1 Use of Computer systems
Staff must not use either WGHC computers, network or mobile ‘phones to access pornography or to send harassing, abusive or offensive messages. Staff must not WGHC computers, network or mobile ‘phones for personal commercial purposes. Staff’s work email addresses must not be used to subscribe to or access any internet sites or services that are not ‘housing services’ related, i.e. SHR / EVH / SHN etc.
Version:
4.2 Access Control
Access Control systems are in place to protect the interests of all users of WGHC computer systems by providing a safe, secure and readily accessible environment in which to work. WGHC will provide all employees and other users with the information they need to carry out their responsibilities in an as effective and efficient manner as possible.
Generic or group IDs shall not normally be permitted but may be granted under exceptional circumstances if sufficient other controls on access are in place.
The allocation of privilege rights (e.g. local administrator, domain administrator, super-user, root access) shall be restricted and controlled, and authorization provided jointly by the system owner and IT Services. Technical teams shall guard against issuing privilege rights to entire teams to prevent loss of confidentiality.
Access rights will be accorded following the principles of least privilege and need to know. Every user should attempt to maintain the security of data at its classified level even if technical security mechanisms fail or are absent. Users electing to place information on digital media or storage devices or maintaining a separate database must only do so where such an action is in accord with the data’s classification.
Users are obligated to report instances of non-compliance to WGHC CISO.
Access to WGHC IT resources and services will be given through the provision of a unique Active Directory account and complex password.
No access to any WGHC IT resources and services will be provided without prior authentication and authorization of a user’s WGHC Windows Active Directory account.
Password issuing, strength requirements, changing and control will be managed through formal processes. Password length, complexity and expiration times will be controlled through Windows Active Directory Group Policy Objects.
Access to Confidential, Restricted and Protected information will be limited to authorised persons whose job responsibilities require it, as determined by the data owner or their designated representative. Requests for access permission to be granted, changed or revoked must be made in writing.
Users are expected to become familiar with and abide by WGHC policies, standards and guidelines for appropriate and acceptable usage of the networks and systems. Access for remote users shall be subject to authorization by IT Services and be provided in accordance with the Remote Access Policy and the Information Security Policy. No uncontrolled external access shall be permitted to any network device or networked system.
Access control methods include logon access rights, Windows share and NTFS permissions, user account privileges, server and workstation access rights, firewall permissions, IIS intranet/extranet authentication rights, SQL database rights, isolated networks and other methods as necessary.
A formal process shall be conducted at regular intervals by system owners and data owners in conjunction with IT Services to review users’ access rights. The review shall be logged and IT Services shall sign off the review to give authority for users’ continued access rights.
Document Name: Created:
Owner:
Location / Path:
Information, Communications & Technology Policy
David Mills / WGHC
David Mills / WGHC WGHC \ X:
Version:
4.3
Creation of User Accounts
Once a new employee has confirmed acceptance of an offer of employment, Management will raise a request to the IT Provider to set up an email address and user account. Each user will be set up with a unique user ID and password to access to their user account. Once this is provided to the employee the employee will be asked to change their password immediately.
All new users will be given standard level access to the server. (Standard service includes MS Outlook including Office 365 email, MS Office, and Internet Access). Where the employee has no access to an existing laptop, a new laptop shall be ordered and set up to the system by the IT Provider.
4.4 Removal of User Accounts
As soon as an employee leaves WGHC’s employment or a Committee member leaves, access to their account shall be stopped with immediate effect. As part of the employment termination process, a request may be made by Management to revoke access levels by requesting a change to the leavers password which will prevent the leaver accessing the system. Information and emails may be retained for a period of 6 months after which the email account shall be deleted.
A request shall be made to remove the leaver from the 2-factor authentication process. All leavers will return all property belonging to WGHC, including laptops and/or mobile ‘phones
4.5
Access for remote users
Access for remote users shall be subject to authorisation by WGHC and be provided in accordance with the Remote Access Policy and the Information Security Policy. No access to the network is permitted for personal devices. Any remote access is granted via a VPN and the WGHC firewall. (However, this may change in the future as the use of Sharepoint is escalated)
4.6
Physical access control
Access to the Comms Rooms is restricted and can only be accessed by authorised staff who have been permitted keys. If keys are lost, this should be reported to Management as soon as possible. Of the 9 WGHC, 3 have keys for the Comms Room.
4.7
Passwords
WGHC staff should select strong passwords and as a result enhance the security of the network. Where possible, Multi-Factor Authentication should be enabled on any software or platform used that allow this facility.
Document Name: Created:
Owner:
David Mills / WGHC
David Mills / WGHC WGHC \ X:
Version:
4.7.1
Password Requirements
According to the National Institute of Standards and Technology, the following is recommended:
Passwords should have a length of 8-16 characters;
They should include non-standard characters, i.e. * / £ / $ / # etc.;
Long passphrases are encouraged;
Password reset is only required if the password is compromised or forgotten; and
Multi-factor authentication is encouraged.
4.7.2 Password Privacy
Passwords are to be treated as sensitive, confidential information and should be kept private. Passwords should not be shared with anyone or talked about in front of others. Users are responsible for maintaining and ensuring the protection of their passwords.
4.8
Change Management
Changes to the IT infrastructure must only be undertaken by authorised personnel, e.g. the IT Provider. Changes to the Co-op’s IT infrastructure and operational systems should be requested to the IT Provider, as follows:
Raising a ticket with the IT Provider with a description of and reason for the change (e.g. increased administrative privileges).
Formal approval process – managerial approval and authorisation prior to proceeding with changes which may have a significant impact
Implementation of requested change, if approved by the IT Provider.
Once the change has been carried out, this should be communicated to all relevant people of the changes, including:
Advance communication/warning of changes
Proposed schedules
Description of reasonably anticipated outcomes provided to all relevant personnel
All changes made, and all the steps taken in the change management process should be logged. The IT Provider should have procedures in place for aborting and rolling back if problems occur. All changes to the IT infrastructure should be assessed by the IT Provider for impact on the security of data and information.
4.9 Network and Systems / Data ‘back up’
West Granton Housing Co-operative’s local server (WGHC Server) provides domain and file system services. The server has two 2TB MB002000GWFGH drives which are mirrored. This means that, in the event that one drive is corrupted or damaged, West Granton Housing Cooperative can continue working on the second drive.
Document Name:
Created:
Owner:
Location / Path:
Information, Communications & Technology Policy
David Mills / WGHC
David Mills / WGHC WGHC \ X:
Version:
Version Date: Review Due: Pages: 1.0 22/07/26 30/06/29
Incremental backups are taken at 9am, 1pm and 6pm. These backups only save modified data, so the server can be restored to an earlier state without requiring a full backup to be taken each time. This also allows for faster file recovery in the event that a file has been deleted between two incremental backups.
Incremental backups are retained for 2 weeks. These incremental backups are tested by Windows Backup Manager for bootability within an hour of the backup being taken. The IT Provider is notified if a backup has failed or if it has taken longer than expected to complete.
4.10 Future Backup Arrangements
Once WGHC has implemented the server shutdown and migrated to SharePoint and OneDrive, the Co-op will use SharePoint for its cloud file system. This means that every change made to files is synced to the cloud. Where a device is offline when files are edited, the files will be synced the next time the device connects to the network.
These changes are added to the version history of the file, which means that, in the event of a file becoming corrupted or being edited incorrectly, files can be restored using version history, up to 500 version edits.
West Granton Housing Co-operative also uses the Cove M365 backup solution, which takes a backup of all files every 15 minutes. This means that files are recoverable even after being permanently deleted from the SharePoint system. The retention period for these backups is 5 years. These backups are tested for accessibility when they are taken.
Cove stores backup data across more than one UK location so that, in the event that one of its data servers goes down, the backups and data remain recoverable.
5.0 WORKING FROM HOME / REMOTELY
Due to the recent Coronavirus pandemic, many people are working remotely at home instead of in their usual place of work. Data Protection law still needs to be complied with even in these unusual circumstances, including security of data and systems
The following section covers home working generally and should be followed in all situations where staff are working from home or away from the office.
5.1 Homeworking definitions
Home Worker refers to Staff using either company provided or their own device or systems or applications, to access and store company information, at their home or remotely, typically connecting to WGHC’s network via a VPN. (Provided by WGHC out-sourced IT provider).
This policy covers the use of electronic devices which could be used to access WHGC’s systems and store information, alongside employees’ own personal data. Such devices include, but are not limited to, smart phones, tablets, laptops and similar technologies.
Document Name: Created:
Owner:
David Mills / WGHC
Version: Version Date:
5.2 Data ‘ownership’
WGHC acting as the Data Controller, remains in control of the data regardless of the ownership of the device, or the location in which the data is processed. Staff are required to keep any company information and data securely and comply with Data Protection law. (Data Protection Act 2018 and/or UK GDPR) Staff are required to assist and support WGHC in carrying out its legal and operational obligations, including co-operating with the out-sourced IT provider should it be necessary to access or inspect company data stored on personal devices or equipment at their home.
5.3 Data Protection & Confidentiality
Staff must follow WGHC’s policies and procedures in relation to working with personal data as if they are still based in the office. However, there are additional risks relating to working remotely. Staff should keep the following in mind:
The data protection principles still apply and need to be adhered to, i.e., Staff should only access personal data that is needed for “specified, explicit and legitimate purposes”. Staff should “limit what they take home to only what is necessary” and keep it there for “no longer than is necessary”. Staff must consider “appropriate security”, both at home and in transit.
Additionally, if required to, Staff must be able to provide WGHC with evidence they are complying with the following principles:
Never leave a computer with personal confidential information on screen. An unauthorised person reading personal data is a data breach.
Never leave your computer ‘logged on’ when unattended. Think about who may access the device when you are not around – whether deliberate or accidental.
Ensure that rooms containing computers and other equipment, are secure when unattended, with windows closed and locked and blinds or curtains closed.
If making a phone or online conference call remember that it is confidential and consider who is around who might overhear.
Levels of Home Security should be at a similar level as at work.
You should only work within WGHC’s approved systems – e.g. Microsoft teams, outlook, SDM etc.
Do not hold person identifiable information on electronic devices. If you absolutely have to download a document to your personal device, ensure it is deleted as soon as possible.
If using your own device, check for automatic uploads to Cloud storage systems. For example, if you have subscribed to iCloud or Dropbox, you may inadvertently be uploading WGHC’s documents to your personal account in these applications. You should disable these uploads whilst you are doing WGHC work.
Any paper taken from the office to work at home must be protected in transit and in your home.
Paper files should be ‘signed out’ from the office and ‘signed in’ again when returned.
Ensure paper is transported safely – and not left in an unattended vehicle.
Keep paperwork secure at home and out of sight of members of your family and others
It is imperative that paper no longer needed is shredded or returned to the office for safe disposal, on no account should files be disposed of within general waste.
Document Name: Created:
Owner:
David Mills / WGHC
David Mills / WGHC WGHC \ X:
6.0 DISPOSAL OF STORED DATA
All data must be securely disposed of when no longer required by WGHC, regardless of the media or application type on which it is stored.
An automatic process must exist to permanently delete on-line data, when no longer required.
All hard copies of cardholder data must be manually destroyed when no longer required for valid and justified business reasons. A quarterly process must be in place to confirm that all non-electronic cardholder data has been appropriately disposed of in a timely manner.
WGHC will have procedures for the destruction of hardcopy (paper) materials. These will require that all hardcopy materials are crosscut shredded, incinerated or pulped so they cannot be reconstructed.
WGHC will have documented procedures for the destruction of electronic media. These will require:
All cardholder data on electronic media must be rendered unrecoverable when deleted e.g. through degaussing or electronically wiped using military grade secure deletion processes or the physical destruction of the media;
If secure wipe programs are used, the process must define the industry accepted standards followed for secure deletion.
All cardholder information awaiting destruction must be held in lockable storage containers clearly marked “To Be Shredded” - access to these containers must be restricted.
7.0 EMAIL & INTERNET
Each member of staff has an email address. This is for work. It must not to be used to subscribe to or access any internet sites or services which are not directly related to WGHC work. Sending or receiving emails should also be restricted to work. The only exception which will be viewed as reasonable is sending or receiving urgent messages to or from home when telephone or text is not appropriate. This should be exceptional.
It is up to staff individually to decide how widely to publicise their individual email address. It is not expected that it will be discloses as a matter of course to any tenant, applicant, contractor etc. Equally other staff’s email addresses should not be disclosed without their consent.
In leaflets, newsletters etc. WGHC’s general email address mail@westgrantonhc.co.uk should generally be used. Emails to this address are delivered to a public folder named WGHC emails which can be accessed via a centralised folder in MS Outlook. Some general emails (e.g. Scottish Housing News) may be of interest and are generally left for a day or two before being deleted.)
Alternatively, there are distribution groups for finance, maintenance and housing management. Emails to these addresses are distributed to all members of the group. The email addresses can be used by external agencies or individuals to access particular services.
Document Name: Created:
Owner:
David Mills / WGHC
Version:
Internally, emails to the all staff group will be distributed to all staff members. Other ‘WGHC email accounts in use are:
allstaff@westgrantonhc.co.uk
finance@westgrantonhc.co.uk
hm@westgrantonhc.co.uk
mail@westgrantonhc.co.uk
maintenance@westgrantonhc.co.uk
7.1 BYOD (Bring Your Own Device)
It is accepted that Staff may bring their own devices (mobile telephones / tablets) to work. It is permitted for Staff to access the WGHC Wi-Fi system using the password provided by their line manager.
Whilst using WGHC Wi-Fi, Staff are expected to comply with all WGHC information policies as indicated within section 1.0 and sections 2.0, 3.0, 3.1, 4.3 and 5.0.
Under NO circumstances are guests, visitors, contractors, suppliers or tenants to be given access to the WGHC Wi-Fi systems, unless authorised by a member of the Senior Management Team.
7.2 Telephones
Staff may use telephones (for local calls for personal use only during lunch breaks or before or after their working day as entered on their timesheet. Outside these times they should only use telephones for personal business in the event of a very urgent matter which cannot reasonably wait.
Staff must not use telephones to access chat lines, gambling lines or any line that promotes abusive or offensive messages. Staff must not use telephones for personal commercial purposes. Staff must not telephone long distance or premium rate numbers without the consent of a senior staff member
7.3 Social Media
Staff should not post any information or comments regarding WGHC, colleagues or service users on social media. This applies at all times and in all media whether at work or in the employees own time.
WGHC reserves the right to monitor telephone, internet and email use to ensure that the facilities are not being abused. WGHC also reserves the right to withdraw access to telephones, email and internet. Abuse of the facilities could also result in disciplinary action, especially, if the reputation of the organisation is tarnished or questioned.
Document Name:
Created:
Owner:
Location / Path:
Information, Communications & Technology Policy
David Mills / WGHC
David Mills / WGHC
WGHC \ X:
Version:
Version Date: Review Due: Pages: 1.0 22/07/26 30/06/29 Page 15 of 18
7.4 Use of Artificial Intelligence
Artificial intelligence tools, including but not limited to Co-Pilot, ChatGPT, Claude and similar technologies, may only be used by WGHC staff for generic purposes. Any output produced using AI technology must always be checked for accuracy, appropriateness and completeness before it is relied upon, shared or published.
Under no circumstances must AI technology be used to create, amend, alter or respond to any statutory or regulatory documents, arrears letters, notice of proceedings letters or pre-action requirement letters.
AI technology must not be used to generate any letters or correspondence relating to health and safety matters in respect of annual gas safety checks or 5 yearly electrical installation condition reports.
Approval must be sought from Senior Officers before WGHC staff implement or extend the use of AI technology for any work-related purpose.
8.0 WGHC POLICIES AND PROCEDURES
Reference can be made to many other WGHC policies that include details which could be construed as ‘information’. These should be consulted where necessary and in addition to the detail within this policy. Most are available via the WGHC website.
WGHC have other policies that also cover the area of ‘information’ thus:
Freedom of Information Policy (Non personal data information)
Guide to Information (Generic information requests linked to FOI / FOISA)
Data Subject Access Request Policy (Personal data information)
Environmental Information Requests (Non personal data information)
Allocation Policy
Governance Policy
Payment Card Security Procedures
Information Security Policy, Cardholder Data
9.0 APPEALS AND COMPLAINTS
WGHC is committed to valuing complaints and ensures that the organisation benefits from feedback to identify areas for change and improvement.
If anyone is dissatisfied with the service they have received because of this Policy, they will be encouraged to use our Complaints Procedure. Similarly, any individuals dissatisfied with decisions made in the operation of the Policy are entitled to appeal against these.
The WGHC Complaints Policy details the way in which complaints can be made, the timescales for responding and the appeals process.
Anyone dissatisfied with the outcome of their complaint having exhausted WGHC’s complaint procedure has the right to refer the matter to the Scottish Public Services Ombudsman.
Document Name:
Created:
Owner:
Location / Path:
Information, Communications & Technology Policy
David Mills / WGHC
David Mills / WGHC
WGHC \ X:
Version:
10.0 EQUALITY, DIVERSITY AND INCLUSION
WGHC will ensure that in implementing this Policy it will not unfairly discriminate against any individual, household or group on the grounds of sex or marital status, race, disability, age, sexual orientation, language or social origin, or other personal attributes, including beliefs or opinions such as religious beliefs or political opinions. This policy will be implemented consistently with WGHC’s equality, diversity and inclusion commitments and the Equality Act 2010. (See Section 11.0 for an Equalities Impact Assessment)
11.0 UK GDPR AND DATA PROTECTION
WGHC will treat all personal data in line with its obligations under the UK General Data Protection Regulation, the Data Protection Act 2018 and relevant guidance issued by the Information Commissioner’s Office.
Information regarding how data will be used and the basis for processing data is provided within the WGHC Privacy Notices (available on the WGHC website, or, upon request).
Separate complaints relating to Data Protection can be made via the WGHC website.
Document Name: Created:
Owner:
Location / Path: Information, Communications & Technology Policy
David Mills / WGHC
Version:
Version
