Confidentiality and Data Protection Policy

1. Purpose

The Karbi Anglong Baptist Convention (KABC) receives and maintains information about individuals, churches, Member Associations, employees, children, donors, partners, programmes, institutions, and other persons and organizations connected with its work.

Some of this information is personal, sensitive, confidential, or entrusted to the Convention for a specific purpose.

The purpose of this Policy is to ensure that such information is collected, used, stored, shared, retained, and disposed of responsibly, with appropriate respect for privacy, confidentiality, dignity, and applicable law.

KABC recognizes that responsible handling of information is an important part of maintaining trust with the people and communities it serves.

2. Scope

This Policy applies to:

Office Bearers;
employees;
members of the Executive Committee and Governing Body;
members of Boards, Committees, Councils, Task Forces, and Working Groups;
volunteers;
consultants and service providers who have access to Convention information;
institutions, departments, programmes, and projects directly administered by KABC, where applicable.

The Policy applies to information held in any form, including:

paper records;
electronic documents;
databases;
email;
photographs and videos;
websites and online forms;
mobile devices;
messaging applications;
cloud storage;
financial and accounting systems;
other digital platforms used for Convention work.

3. Guiding Principles

KABC shall handle information according to the following principles:

3.1 Respect and Dignity

Information about individuals shall be handled in a manner that respects their dignity and privacy.

3.2 Purpose

Personal information shall be collected and used for legitimate and clearly understood organizational purposes.

3.3 Minimum Necessary Information

Only information reasonably required for the intended purpose should be collected and retained.

3.4 Accuracy

Reasonable steps shall be taken to keep important personal and organizational information accurate and up to date.

3.5 Confidentiality

Confidential information shall be accessible only to persons who have a legitimate need to use it.

3.6 Security

Reasonable safeguards shall be maintained to protect information against unauthorized access, loss, misuse, alteration, or disclosure.

3.7 Accountability

Persons entrusted with information are responsible for handling it appropriately.

3.8 Lawful and Responsible Use

Information shall be handled in accordance with applicable law, organizational policies, and the purpose for which it was collected.

4. Categories of Information

Information held by KABC may include:

4.1 Public Information

Information intended for public communication, such as:

published reports;
public events;
approved photographs;
public leadership information;
published policies;
website content.

4.2 Internal Information

Information intended primarily for organizational use, such as:

internal correspondence;
meeting papers;
administrative records;
programme planning documents.

4.3 Confidential Information

Information requiring restricted access, including:

employee records;
disciplinary matters;
donor information not intended for publication;
financial records;
confidential committee discussions;
contractual information;
pastoral or personal matters entrusted in confidence.

4.4 Sensitive Personal Information

Information that may require a higher level of protection because inappropriate disclosure could cause harm, discrimination, embarrassment, exploitation, or other serious consequences.

This may include information concerning children, health, disability, financial circumstances, safeguarding matters, or other information considered sensitive under applicable law.

5. Collection of Personal Information

KABC shall collect personal information only where there is a legitimate organizational purpose.

Where appropriate, individuals should be informed:

what information is being collected;
why it is required;
how it will be used;
whether it may be shared;
how they may contact KABC regarding their information.

Information should not be collected merely because it may be useful at some unspecified future time.

6. Use of Information

Information collected for one purpose shall not ordinarily be used for an unrelated purpose without appropriate justification or authorization.

Personal information may be used for legitimate activities such as:

administration;
employment;
programme participation;
education;
safeguarding;
donor administration;
financial accountability;
communication;
legal and regulatory compliance;
organizational planning.

Access shall be limited according to responsibility and legitimate need.

7. Confidentiality Responsibilities

Every person entrusted with confidential information shall:

use it only for authorized purposes;
avoid unnecessary discussion or disclosure;
protect records from unauthorized access;
share information only with persons who have a legitimate need to know;
exercise care when communicating by email, telephone, messaging applications, or other digital channels;
continue to respect confidentiality after leaving office, employment, committee membership, or other service with KABC.

Confidential information obtained through Convention service shall not be used for personal benefit.

8. Children and Safeguarding Information

Information concerning children and safeguarding matters requires particular care.

Such information shall be handled in accordance with the Child Protection Policy and Procedures.

Access shall be restricted to persons who require the information for safeguarding, administration, legal compliance, or another legitimate purpose.

Safeguarding information shall not be casually circulated through messaging groups, social media, or other inappropriate communication channels.

Where there is a conflict between ordinary confidentiality and the need to protect a child from harm, the safety and protection of the child shall take priority, subject to applicable law and established safeguarding procedures.

9. Employee and Personnel Records

Employee records shall be treated as confidential and accessed only by authorized persons.

Personnel records may include:

employment applications;
contracts;
salary information;
attendance and leave records;
performance records;
disciplinary records;
identity and contact information;
other employment-related documents.

Information shall not be disclosed merely because another employee requests it.

10. Donor and Financial Information

Donor information shall be used responsibly and only for appropriate organizational purposes.

KABC shall not sell or improperly disclose donor contact information.

Banking information, payment details, financial records, and other sensitive financial information shall be protected from unauthorized access.

Public recognition of donors should respect donor preferences and applicable organizational policies.

11. Photographs, Video and Media

Photographs and videos are important for documenting and communicating the work of the Convention. They shall nevertheless be used responsibly.

Particular care shall be exercised when images involve:

children;
vulnerable persons;
persons receiving relief or assistance;
sensitive community situations;
medical or personal circumstances.

Images should preserve the dignity of the people represented.

Consent shall be obtained where required or appropriate.

Images shall not be used in a misleading, humiliating, exploitative, or unnecessarily intrusive manner.

12. Digital Communication

Official information should, as far as practicable, be communicated through approved organizational systems and accounts.

Persons handling Convention information shall exercise care when using:

email;
WhatsApp or other messaging applications;
shared drives;
cloud services;
mobile phones;
removable storage;
social media.

Confidential information should not be posted in large or unrelated messaging groups merely for convenience.

13. Passwords and Access

Passwords, verification codes, and other access credentials shall be kept confidential.

Individuals shall not:

share passwords unnecessarily;
allow unauthorized persons to use organizational accounts;
retain access after their authorization has ended;
deliberately bypass security measures.

Access to organizational systems should reflect the person's responsibilities.

When an employee or Office Bearer leaves a role, unnecessary access should be removed promptly.

Information may be shared with external organizations where there is a legitimate reason, including:

statutory or regulatory requirements;
banking and payment services;
auditors;
professional advisers;
programme partners;
funding partners where required;
service providers;
government authorities;
law enforcement or other lawful authorities.

Only information reasonably necessary for the purpose should be shared.

Where appropriate, third parties handling KABC information should be required to maintain suitable confidentiality and security.

15. Disclosure Required by Law or Safety

Confidentiality does not prevent KABC from disclosing information where disclosure is:

required by law;
required by a lawful authority;
necessary for safeguarding;
necessary to prevent serious harm;
otherwise properly authorized under Convention policy.

Such disclosures should be limited to what is reasonably necessary.

16. Information Security

Reasonable safeguards shall be used according to the sensitivity of the information.

These may include:

secure storage;
passwords;
access restrictions;
backups;
locked cabinets;
appropriate device security;
secure disposal;
periodic review of access permissions.

Not every record requires the same level of protection. More sensitive information requires stronger safeguards.

17. Data Accuracy and Correction

KABC shall take reasonable steps to maintain accurate information where accuracy is important to its use.

Individuals may request correction of inaccurate personal information held about them, subject to applicable legal and organizational requirements.

18. Retention of Records

Information shall not be retained indefinitely without reason.

Records shall be retained according to:

legal requirements;
financial and audit requirements;
safeguarding requirements;
historical or institutional value;
operational need;
approved records-retention requirements.

RM-001 — Records Management & Retention Policy and its Records Retention Schedule may establish detailed retention periods for different categories of records.

19. Secure Disposal

When records no longer need to be retained, they shall be disposed of appropriately.

Depending on the information, this may include:

shredding confidential paper records;
securely deleting electronic records;
removing data from devices before disposal or transfer;
destroying obsolete storage media appropriately.

20. Loss, Unauthorized Access or Disclosure

Any suspected loss, theft, unauthorized access, accidental disclosure, or misuse of confidential or personal information shall be reported promptly to the appropriate Convention authority.

The Convention shall assess:

what information was involved;
who may have been affected;
the potential consequences;
steps necessary to contain the incident;
whether individuals or authorities should be informed;
measures required to prevent recurrence.

21. Individual Responsibilities

Every person covered by this Policy is responsible for:

protecting information entrusted to them;
following approved procedures;
using reasonable security precautions;
reporting suspected breaches;
returning or securely transferring organizational records when their role ends.

22. Responsibilities of Leaders

Leaders and persons responsible for departments, institutions, programmes, and systems shall take reasonable steps to ensure that:

access is appropriate;
staff understand confidentiality requirements;
sensitive records are protected;
information is not collected unnecessarily;
breaches are addressed promptly.

23. Breach of this Policy

Improper access, use, disclosure, alteration, destruction, or misuse of confidential or personal information may result in appropriate administrative or disciplinary action.

Serious matters may also be referred to the appropriate authority where required by law.

This Policy should be read together with:

Constitution of the Karbi Anglong Baptist Convention;
GP-001 Code of Conduct;
GP-002 Conflict of Interest Policy;
GP-003 Ethical Concerns Reporting Policy;
Child Protection Policy and Procedures;
Finance Policy and Financial Procedures Manual;
HR-001 — Human Resources Policy;
RM-001 — Records Management & Retention Policy;
applicable legal requirements.

25. Review and Amendment

This Policy shall be reviewed periodically and may be amended by the Executive Committee of the Karbi Anglong Baptist Convention.

The Policy should also be reviewed when significant changes occur in applicable law, technology, organizational systems, or the nature of information handled by KABC.

26. Approval

Document Code: GP-004Version: 1.0Approved By: Executive CommitteeEffective Date: 18 August 2026Review Cycle: Every three (3) years

Schedule A — Practical Information-Handling Guide

Information	General Treatment
Published website information	Public
Public annual reports	Public
General internal correspondence	Internal
Meeting papers	Internal or confidential depending on content
Employee records	Confidential
Donor personal information	Confidential
Banking/payment information	Highly restricted
Child safeguarding records	Highly restricted
Disciplinary records	Confidential
Passwords/access credentials	Highly restricted
Approved photographs	Public according to approved use
Pastoral/personal matters	Confidential

This classification is a practical guide. The nature and circumstances of the information should always be considered.

Schedule B — Confidentiality Undertaking

Where appropriate, employees, volunteers, consultants, committee members, or other persons with access to sensitive information may be required to sign a confidentiality undertaking confirming that they will:

use information only for authorized Convention purposes;
not disclose confidential information without authorization;
protect passwords, records, devices, and other information entrusted to them;
immediately report loss or unauthorized disclosure;
return or transfer organizational information when their role ends; and
continue to respect confidentiality after their service with KABC ends.

Policy details