Data Controller: Katharine Lane-Sims

Data Processor: Katharine Lane-Sims

Senior Information Risk Owner: Katharine Lane-Sims

Review Date: June 2026

Introduction 

If your child has been referred for individual play therapy or group play therapy by an organisation or charity and the sessions take place within that organisation or charity, Skylark Play Therapy will use their data protection policy in conjunction with this policy. 

If you have made a private referral to Skylark Play Therapy this policy applies to you. 

This policy explains how Skylark Play Therapy collects, uses and stores personal information. It is intended to set out your rights and answer any queries you may have about your personal data. If you need more information, please contact the Data Controller, Katharine Lane-Sims: kls@skylarkplaytherapy.co.uk (ICO registration ZB314347)

Data Protection Law 

The DPA (Data Protection Act, 1998) and the GDPR (General Data Protection Regulation, 2018) describes how organisations and services must collect, handle and store personal information. 

Data must be stored appropriately, regardless of whether it is stored electronically, on paper or elsewhere. 

To comply with the law, personal information must be collected and used fairly, stored safely and not disclosed unlawfully. 

The Data state that Protection Law is underpinned by eight important principles. The principles personal data must: 

• Be processed fairly and lawfully
• Be obtained only for specific, lawful purposes
• Be adequate, relevant and not excessive
• Be accurate and kept up to date
• Not be held for any longer than necessary
• Processed in accordance with the rights of data subjects
• Be protected in appropriate ways
• Not be transferred outside the European Economic Area (EEA), unless that country or territory also ensures an adequate level of protection 

Responsibilities 

Skylark Play Therapy is responsible for: 

● Keeping updated about data protection responsibilities, risks and issues 

● Reviewing all data protection procedures and related policies annually 

● Handling data protection questions from service users covered by this 

policy 

● Ensuring all systems, services and equipment used for storing data meet 

acceptable security standards 

● Performing regular checks and scans to ensure security hardware and 

software is operating correctly 

Data Accuracy 

Skylark Play Therapy will take every opportunity to ensure data is accurately updated when necessary. 

1. What information does Skylark Play Therapy collect? 

In accordance with legislation, Skylark Play Therapy will only collect personal data that is necessary and relevant for staff to carry out their role. 

Skylark Play Therapy will collect information about your child’s education, health and care needs, as well as relevant previous and current contextual factors that have impacted on their development. 

Skylark Play Therapy will also collect information about you and your child when you voluntarily complete questionnaires and during review meetings. This information will include: 

● Names of family members 

● Date of birth of the child 

● Telephone, email address and other contact details of parents/carers 

● Home address of the child 

● ICE (in case of emergency) contact details 

● Assessment information and case work notes 

2. How does Skylark Play Therapy use this information? 

During supervision, Skylark Play Therapy will discuss a child’s personal information with a clinical supervisor (registered with Play Therapy UK), for the purposes of ensuring safe and effective practice. Personal identifying information is not disclosed in supervision. Supervision is confidential, and clinical supervisors do not share this information elsewhere. 

3. In what circumstances will data be shared? 

On occasion there may be a need to discuss your personal information with third parties. 

If there is an immediate and serious risk that your child might harm themselves or someone else, or if they disclose harm concerning another person, then Skylark Play Therapy must pass on these concerns and follow the legally required child protection procedure (see Skylark Play Therapy Safeguarding Policy). 

If personal information is requested by a Court of Law, Coroner’s Office or Professional Body you may have limited or no rights of refusal. 

In situations where Skylark Play Therapy must share personal information with third parties to protect your child or another person, only personal information that is relevant and necessary for safety will be shared. 

Skylark Play Therapy uses this information to provide therapeutic support to children. 

This information is confidential. 

Skylark Play Therapy submits anonymised client data to PTUK. This data is collected for quality assurance and research purposes. You are informed of this in the consent form you sign. 

4. How long will Skylark Play Therapy keep personal data? 

Skylark Play Therapy will keep personal information and the record of therapeutic work in accordance with PTUK guidelines. 

5. Where is my data stored? 

Most of the information held by Skylark Play Therapy is stored as electronic records on Fortuna (a secure database). Some data is stored on Google Drive. Electronic data is protected by strong passwords that are changed regularly and never shared with anyone. Files are backed up and anti-virus software is installed. Software updates are downloaded and installed as soon as they appear.

Confidential paper copies are kept in a locked cabinet until they are scanned, uploaded and stored with the electronic documents held. Confidential papers are shredded and disposed of securely when no longer required. Personal data will only be accessible to staff who are permitted to process the information. 

When working with personal data, Skylark Play Therapy will ensure computers are locked when left unattended. Data will be encrypted before being transferred electronically via email. Confidential paper copies are not left where unauthorised people could see them. 

6. How will my data be transported? 

If a member of staff needs to transport personal data away from the office base, they will be fully trained and will have been provided with a secure means of transporting the information. When carrying paper files, or electrical items which contain personal data, outside of the office, they will be carried in a lockable briefcase or folder that can be securely closed or zipped up. The briefcase or folder will contain the contact details of Skylark Play Therapy. 

7. How will Staff be trained in Data Protection? 

Staff will be aware of the person within Skylark Play Therapy who is responsible for overseeing compliance with the data protection policy and know to notify them in the event that a Data Protection breach is suspected. 

All staff who handle personal data will be provided with mandatory Data Protection training as part of their induction. This Data Protection training will provide staff with the necessary practical knowledge required to keep personal data secure. Regular updates and training refreshers will be provided. All staff will follow the Data Protection training and data protection policy at all times, when handling data. 

Staff will be aware that: 

● They will not process personal data outside the strict requirements of their job role 

● Any deliberate or reckless breach of the Data Protection policy may result in disciplinary action, which could lead to dismissal 

● It is a requirement for all staff to report any suspected Data Protection breaches to the nominated person within Skylark Play Therapy 

Data protection training will include detailed processes for the following: 

Emailing Personal Data
Posting Personal Data
Office Security
Carrying Personal Data Off-Site
Viruses, SPAM and Suspicious Emails Accessing Personal Data Appropriately Reporting a Suspected Data Protection Breach 

8. What are my rights in relation to my personal data? 

If the information Skylark Play Therapy holds about you is inaccurate or incomplete, you can notify the data controller to correct or supplement it. 

You have the right, with some exceptions and qualifications, to ask us to provide a copy of any personal data we hold about you. 

All individuals who are the subject of personal data held by Skylark Play Therapy are entitled to: 

● Ask what information the service holds about them and why 

● Ask how to gain access to it 

● Be informed how to keep it up to date 

● Be informed how Skylark Play Therapy is meeting its data protection obligations 

If you contact Skylark Play Therapy requesting this information, this is called a subject access request. 

Subject access requests from individuals should be made by email, addressed to the data controller, Katharine Lane-Sims: kls@skylarkplaytherapy.co.uk

9. What happens if there is a suspected data breach? 

Skylark Play Therapy would contact the ICO immediately to report a suspected data breach and follow their protocol. 

If Skylark Play Therapy suspects that a Data Protection breach involving Bristol City Council data has occurred, an email would be sent to data.protection@bristol.gov.uk or a phone call would be made to 01392383000 asking for the “Information Governance Team”. The following information would be to hand before contacting this team: 

• What personal data was involved 

• In what way the personal data was inappropriately processed and/or who it was disclosed to 

• How the incident occurred 

• What Skylark Play Therapy intend to do in order to prevent a similar incident from occurring in future 

If you have any queries regarding this Data Protection Policy, about Skylark Play Therapy’s processing of your personal data or wish to exercise your rights, you can contact the Data Controller, Katharine Lane-Sims, using this email address: kls@skylarkplaytherapy.co.uk 

If you have a complaint about how Skylark Play Therapy have handled your data, you can contact the Information Commissioner's Office: www.ico.org.uk