Confidentiality Policy

Al-Waris Foundation is committed to protecting confidential information entrusted to it.

Confidentiality is essential to maintaining the trust of:

Confidential information must be handled carefully, accessed only where necessary, and shared only where there is a legitimate, lawful and proportionate reason.

Confidentiality is not absolute.

Information may need to be shared where necessary for:

This policy should therefore be applied together with the Data Protection and UK GDPR Policy and relevant safeguarding policies.

The purpose of this policy is to:

This policy applies to:

It applies whether information is:

Confidential information includes information that is not intended for unrestricted public disclosure.

Examples may include:

Information may be confidential even if it is not legally classified as personal data.

Where confidential information is personal data, it must also be handled in accordance with:

Confidentiality does not replace data protection obligations.

The two frameworks overlap but are not identical.

People handling confidential information must:

Confidentiality must not be used to conceal wrongdoing or prevent lawful safeguarding or regulatory reporting.

Confidential information should be shared internally only with people who reasonably need it for their role.

Trustee status, seniority or familiarity with the charity does not automatically create a right to access all confidential information.

Examples include:

The Board should receive sufficient information to discharge its governance duties without unnecessary disclosure of identifiable personal information.

Beneficiary information requires particular care.

People may disclose information concerning:

This information must not be:

Public accountability does not justify unnecessary identification of beneficiaries.

Donor information should be treated as confidential unless appropriately made public by the donor or otherwise lawfully disclosed.

This may include:

The charity must not sell donor information.

Donor information should not be used for personal solicitation by trustees, volunteers or other representatives.

Safeguarding information is highly sensitive.

It should normally be shared only with people who need it to:

Absolute confidentiality must never be promised in a safeguarding situation.

A person making a disclosure should be told, where appropriate, that information may need to be shared with people who can help.

See:

Complaints should be handled confidentially.

Information should normally be shared only with people involved in:

the complaint.

Where a complaint involves safeguarding, fraud, criminal conduct or another serious matter, information may need to be shared outside the ordinary complaint process.

See the Complaints Policy.

Trustees may have access to sensitive information through their governance role.

Trustees must not disclose confidential Board information without authority.

This may include:

The duty of confidentiality continues after a trustee leaves office where the information remains confidential.

Board discussions may include differing opinions, challenge and sensitive information.

Trustees should be free to discuss matters honestly without expecting every comment to be disclosed publicly.

However, confidentiality must not be used to:

Volunteers may encounter confidential information during:

Volunteers must only access and use information relevant to their duties.

They must not:

Where contractors or partners require access to confidential information, access should be:

The charity should not disclose entire databases or files where only limited information is required.

Confidentiality requirements apply to overseas work.

Particular care should be taken where:

Only information required for legitimate project purposes should be shared.

Photographs and video may reveal confidential or sensitive information.

Before publishing content, the charity should consider whether it reveals:

Consent or another appropriate lawful basis should be established where required.

See the Photography, Video and Beneficiary Consent Policy.

Confidential information sent by email must be handled carefully.

Before sending, users should:

Sensitive information should not be sent insecurely where a safer reasonable method is available.

Misdirected emails containing confidential information must be reported promptly.

Messaging services should not be used casually for confidential charity records.

Where messaging is necessary:

Disappearing messages should not be used where retention is required for safeguarding, complaints, governance or other accountability purposes.

Where personal devices are used for legitimate charity activity, confidential information must be protected.

Users should:

Confidential charity files should not remain indefinitely on personal devices without a legitimate reason.

Paper records containing confidential information must be stored securely.

They should not be:

Secure destruction should be used where appropriate.

Confidential matters should not be discussed where conversations can easily be overheard by unauthorised people.

Care should be taken when discussing sensitive information:

When handling confidential information remotely:

Passwords, API keys, recovery codes and other credentials are confidential security information.

They must not be:

Access credentials must be revoked when no longer required.

Confidential financial information may include:

Such information must only be accessed and disclosed where appropriate.

Published statutory accounts or approved public financial information are not confidential once properly published.

Legal advice received by Al-Waris Foundation may be confidential and may also be subject to legal professional privilege.

Legal advice should not be circulated more widely than necessary.

Before disclosing legal advice externally, appropriate advice should be obtained where necessary.

Information received confidentially from another organisation must be protected in accordance with:

Al-Waris Foundation should not promise confidentiality that would prevent necessary legal or safeguarding disclosures.

Information that is legitimately public is not automatically confidential.

Examples may include:

However, the existence of some public information does not justify disclosure of additional private information about the same person or matter.

Family members do not automatically have a right to receive information about:

Information should only be disclosed where there is appropriate authority, consent, lawful basis or safeguarding justification.

Requests from police, regulators or statutory authorities should be assessed appropriately.

The charity should consider:

Where urgent action is required to protect life or prevent serious harm, information may need to be shared promptly.

Where appropriate, professional advice should be sought.

Confidentiality must not prevent reasonable safeguarding action.

Information may be shared without consent where necessary and lawful to protect:

Only relevant information should be shared.

The decision and reasons should be recorded where appropriate.

Confidential information may be disclosed where necessary and lawful in connection with:

This policy does not require the charity to conceal criminal conduct.

Nothing in this policy prevents a person from making a protected or legitimate disclosure under the Whistleblowing Policy or applicable law.

Confidentiality clauses must not be used to silence genuine reports of serious wrongdoing.

Information may need to be disclosed to the Charity Commission where a serious incident is reportable.

Only information reasonably necessary for the regulatory purpose should be provided.

See the Serious Incident Reporting Policy.

Where information is personal data, individuals may have rights under data protection law.

A confidentiality obligation does not automatically override those rights.

Equally, an individual's right of access does not necessarily entitle them to confidential personal information about another person.

See the Data Protection and UK GDPR Policy.

Requests for access to confidential records must be handled through the appropriate process.

People should not release records informally merely because the requester is:

The appropriate legal and governance basis must be considered.

Where disclosure is justified, only the minimum information reasonably necessary should be shared.

For example, a trustee may need to know:

a serious safeguarding incident occurred and was referred appropriately

without needing the beneficiary's full identifiable case file.

Where practical, confidential reporting to the Board or public should use:

This is particularly important for:

Confidential decisions and disclosures should be recorded where appropriate.

Records may include:

Records should themselves remain appropriately confidential.

A confidentiality breach may include:

All suspected significant breaches should be reported promptly.

When a breach occurs, reasonable steps should be taken to:

Where a confidentiality breach involves personal data, it must also be assessed under the Data Protection and UK GDPR Policy.

This includes considering whether:

Not every confidentiality breach requires ICO notification.

Where disclosure creates or increases a safeguarding risk, safeguarding procedures must be followed immediately.

Examples may include revealing:

A breach of confidentiality may result in:

The response should reflect:

Deliberate use of confidential information for:

will be treated particularly seriously.

People who routinely handle confidential information should receive guidance proportionate to their responsibilities.

Training may include:

Relevant trustees, volunteers, staff and contractors should be informed during induction that:

When a person's involvement ends, they must:

Confidentiality obligations do not automatically end when someone stops volunteering, working or serving as trustee.

The Board of Trustees retains overall responsibility for this policy.

Operational responsibility for confidentiality controls may be delegated.

Significant breaches should be escalated to the Board where appropriate.

This policy should be read alongside:

This policy will be reviewed:

Version: 2.0 Status: Approved Approved by: Board of Trustees Approval date: 25/08/2026 Next scheduled review: 24/08/2027