1.0 Overview The Institute for Jewish Policy Research (JPR) is committed to protecting the rights, freedoms and privacy of individuals in accordance with the General Data Protection Regulation (GDPR). 2.0 Purpose The GDPR became legally enforceable on 25th May 2018 and applies to individuals and organisations operating within the EU. The regulation places specific legal obligations on data controllers and data processors with regards to the handling of personal data. As a processor, JPR is legally required to take certain steps to protect personal information in its care. JPR will have a legal liability if the organisation is responsible for a breach.  This document outlines how JPR intends to comply with the requirements of the GDPR. 3.0 Scope This policy applies to all personal data processed and controlled by JPR. The policy is available to all staff and volunteers working with JPR. This includes all temporary or locum staff, and agents acting on behalf of JPR. While voluntary, temporary and locum staff are expected to comply with the policy, this does not imply or create an employment relationship. A copy of this policy will also be made available on the JPR website. 4.0 Compliance Any breach of this policy or the regulation itself will be considered an offence and will be dealt with under JPR disciplinary procedures. Breaches of the regulation will be reported to the Information Commissioners Office (ICO). 5.0 Policy The GDPR demands higher transparency and accountability for the handling of personal data. JPR needs to process specific information about its employees, subscribers, donors and other stakeholders for various reasons such as, but not limited to: Paying staff and keeping internal records Communicating information it produces Tracking website visitors Raising funds Complying with legal obligations The GDPR applies to both ‘controllers’ and ‘processors’. The data controller determines the purposes and means of processing personal data. The data proces