1. Purpose & scope

This policy sets out how Hagan Institute of Leadership (HIL) handles personal information responsibly and lawfully. It applies to everyone who handles personal information on HIL’s behalf — staff, facilitators, mentors, volunteers, contractors and partners — and to all personal information HIL holds, in any format.

2. Data protection principles

In line with the Data Protection Act, 2012 (Act 843), HIL processes personal information according to these principles:

• Accountability — HIL takes responsibility for how personal information is handled.
• Lawfulness — information is processed lawfully, fairly and with respect for privacy.
• Specified purpose — information is collected for clear, legitimate purposes and not used for unrelated ones.
• Minimality — we collect only what is necessary.
• Quality — we keep information accurate and up to date.
• Openness — we tell people how their information is used, through our Privacy Policy.
• Security — we protect information against loss, misuse and unauthorised access.
• Participation — we respect individuals’ rights to access and correct their information.

3. Responsibilities

HIL’s leadership is responsible for compliance with this policy and reports on data protection to the Governing Board, as set out in our Governance Policy. A designated person within HIL coordinates data protection matters, including requests and incidents. Everyone handling information on HIL’s behalf must follow this policy and complete appropriate orientation.

4. Children’s information

Information about participants under 18 is collected with parental or guardian knowledge and consent, used only for programme delivery, safeguarding and development reporting, and shared only where necessary. Assessment and mentorship records about young people are shared with their parents or guardians and, where a school has enrolled the student, with the school as agreed in advance.

5. Sensitive information

Health information (such as medical needs and allergies) and safeguarding information are treated as sensitive. They are collected only where necessary to protect a participant, accessed only by those who need them, and stored separately from general programme records.

6. Security

• Access to personal information is limited to people with a legitimate need.
• Devices and accounts used for HIL information are password-protected, and shared or public devices are avoided.
• Paper records are kept securely and disposed of by shredding.
• Personal information is not entered into external technology systems, including artificial intelligence tools, without appropriate authority and safeguards.
• Service providers that process information for HIL are expected to protect it to an equivalent standard.

7. Retention

Information is kept only as long as necessary. As a general guide:

8. Data breaches

Anyone who becomes aware that personal information may have been lost, disclosed or accessed without authority must report it to HIL immediately. HIL will contain the incident, assess the risk to the people affected, inform them where appropriate, notify the Data Protection Commission where required, and take steps to prevent it happening again.

9. Individual rights

Individuals may request access to, correction of or deletion of their personal information, and may object to certain uses. Requests are handled promptly and free of charge in ordinary circumstances. See section 9 of our Privacy Policy.

10. Contact & complaints

Questions, requests and concerns about data protection should be sent to [email protected]. If you are not satisfied with our response, you may complain to Ghana’s Data Protection Commission.