Data Protection
The information the Institute is required by law to give you about how it uses your personal data, your rights, and how to enforce them. This page sits alongside the IAM Privacy Notice and Cookie Policy, which is the Institute’s published notice.
Who is responsible
The data controller
| Item | Detail |
|---|---|
| Controller | The Institute of Administrative Management, a company limited by guarantee registered in England and Wales. Registered office: IAM Office 1, Unit 1, Haggwood Quarry Industrial Estate, Honley, Holmfirth, HD9 6PW. |
| Data protection contact | dpo@instam.org — for any question about your data, any request under your rights, and any complaint. |
| Legislation | The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, together with the Privacy and Electronic Communications Regulations 2003 (PECR) for cookies and similar storage. |
| Supervisory authority | The Information Commissioner’s Office (ICO), the United Kingdom’s independent regulator for data protection. |
Article 13 information
What we process, why, and on what lawful basis
UK GDPR requires a lawful basis for every purpose. These are the Institute’s, purpose by purpose.
| Purpose | Personal data involved | Lawful basis (UK GDPR Article 6) |
|---|---|---|
| Assessing an application for membership, an upgrade, or a Certified Programme | Identity and contact details; curriculum vitae; evidence of qualifications; Statements of Professional Experience; identity-verification data; declarations | Contract — Article 6(1)(b): steps at your request before entering the membership contract, and performance of it |
| Administering membership, subscriptions, renewals, CPD records, and credentials | Membership record; grade and Good Standing; CPD activities and evidence; payment records; digital badge and certificate data | Contract — Article 6(1)(b) |
| Verifying qualifications, experience, and identity with issuing institutions and employers | The claims you make and the evidence you supply | Legitimate interests — Article 6(1)(f): maintaining the integrity of a professional register on which the public relies. You may object; see Your Rights below |
| Maintaining the public Directory and Verify a Member | Name, grade, post-nominal entitlement, Good Standing; any profile detail you choose to publish | Legitimate interests — Article 6(1)(f): enabling employers, clients, and the public to verify professional standing. Your Directory entry can be limited or withheld at any time; verification of status remains available because it is the purpose of a professional register |
| Conduct, complaints, appeals, and disciplinary procedures | Correspondence, evidence, and outcomes relating to a complaint or appeal | Legitimate interests — Article 6(1)(f): upholding the Code of Ethics and protecting the public; and legal obligation — Article 6(1)(c) — where a regulator or court requires it |
| Recognising Centres and endorsing provision | Named contacts at applicant organisations; their professional details | Contract — Article 6(1)(b) with the organisation; legitimate interests — Article 6(1)(f) for the individuals named |
| Statutory accounting, tax, and corporate records | Payment and invoicing records | Legal obligation — Article 6(1)(c) |
| The newsletter and optional communications | Name and email address | Consent — Article 6(1)(a): you subscribe, and may unsubscribe at any time with no effect on your membership |
| Reasonable adjustments, CPD exemptions on health grounds, safeguarding | Health or other special category data you choose to disclose | Explicit consent — Article 9(2)(a); where a safeguarding duty arises, substantial public interest under Schedule 1 of the Data Protection Act 2018 |
Recipients, transfers, and retention
Who sees your data, where it goes, and for how long
Recipients
Processors and disclosures
Service providers acting on the Institute’s written instructions under Article 28 contracts — the IAM Portal and Badge Platform, payment processing, email, and hosting. Recognised Centres, only for learners they enrol. Panels and auditors within assessment and quality assurance. Public authorities where the law requires. Corporate Coordinators see aggregate compliance data only, never an individual’s records.
Transfers
Outside the United Kingdom
Membership is worldwide, so data may be processed outside the UK. Where it is, the Institute relies on UK adequacy regulations or the International Data Transfer Agreement and Addendum approved by the ICO, and can supply details of the safeguard used on request to dpo@instam.org.
Retention
How long
Credential and certificate records: indefinitely, so qualifications remain verifiable for life. Membership and learner records: the relationship plus six years. CPD evidence: the three years the CPD Regulation requires. Financial records: the statutory period. Enquiries: until resolved and evidenced. Then secure deletion or anonymisation. The Privacy Notice carries the full schedule.
Your rights
The eight rights, and how to use them
| Right | What it means | Any limit |
|---|---|---|
| To be informed | This page and the Privacy Notice. | — |
| Of access | A copy of your personal data and the information on this page as it applies to you. | Free; within one month, extendable by two for complex requests |
| To rectification | Correction of inaccurate or incomplete data. | Facts on a register are corrected; assessment judgements are challenged through the Appeals and Complaints Policy |
| To erasure | Deletion where the data is no longer necessary. | Credential records are kept indefinitely so that awards remain verifiable; this is a legitimate interest the law recognises |
| To restrict processing | Suspension of use while accuracy or an objection is examined. | — |
| To data portability | Your data in a structured, machine-readable form where processing rests on contract or consent. | — |
| To object | To processing based on legitimate interests, including verification and Directory listing. | The Institute will stop unless it shows compelling grounds; Directory entries are withdrawn on request without question |
| Concerning automated decisions | Not to be subject to a decision based solely on automated processing with legal or similarly significant effect. | Admission, assessment, audit, and disciplinary decisions are made by people; Affiliate and Subscriber registration is automatic on payment, which you request |
If something is wrong
Complaining to the Institute and to the ICO
First, tell us
Write to dpo@instam.org. Most concerns are resolved quickly once they are understood, and the Institute would rather put a problem right than have it escalated. Complaints about the Institute’s own service quality may also go to enquiry@instam.org under the Appeals and Complaints Policy.
You have the right to lodge a complaint with the ICO at any time, and you do not have to complain to the Institute first. Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · Telephone 0303 123 1113 · ico.org.uk/make-a-complaint. If you live outside the United Kingdom, you may instead complain to the supervisory authority where you live.
Children and young people
Student Members under 18
Student Membership is open from age 16, so the Institute may hold the personal data of 16- and 17-year-olds. It processes that data only for enrolment, study support, and the obligations of the Code of Ethics, applies the same rights and the same responses, and uses language a young person can understand. It does not knowingly collect data from anyone under 16; if it learns it has, it deletes it. A parent or guardian may act for a Student Member under 18 on request.
Cookies and local storage
What this website stores on your device
| Item | Set by | Purpose | Consent |
|---|---|---|---|
| Cookies | — | This website sets no cookies of any kind: none for advertising, none for analytics, none for tracking. | Not applicable |
| Display preference (Day, Night, or Auto) | Your browser’s local storage, only when you press the control | Remembers the display mode you chose | Not required: storage strictly necessary to provide a feature you explicitly requested (PECR regulation 6(4)) |
| Text-size preference | Your browser’s local storage, only when you press the control | Remembers the text size you chose | As above |
| The Ask the IAM assistant | — | Runs entirely in your browser; stores nothing and sends nothing | Not applicable |
| The Grade Navigator and other tools | — | Run entirely on your device; store nothing and send nothing | Not applicable |
Security and changes
How data is protected, and how this page is kept current
- Security. Encrypted connections; role-based access with multi-factor authentication on the Institute’s platforms; segregation of sensitive records; audit trails of register and certificate changes; and arrangements to notify the ICO within 72 hours of a personal data breach likely to result in a risk to individuals, and to notify the individuals where the risk is high, as Articles 33 and 34 require.
- Processors. Every processor acts under a written contract meeting Article 28, and processes data only on the Institute’s documented instructions.
- Records. The Institute keeps a record of processing activities under Article 30, available to the ICO on request.
- Changes. This page and the Privacy Notice are reviewed together at least annually and whenever processing changes. Material changes affecting members are notified through the IAM Portal.
Enquiries about your personal data
The data protection contact answers within one month, and usually much sooner.