Data Protection and Privacy Policy

Bangladesh Breastfeeding Foundation

Purpose

Bangladesh Breastfeeding Foundation is dedicated to upholding the highest standards of data protection to safeguard personal and sensitive information, especially data related to children, adolescents, and families. This Data Protection and Privacy Policy establishes a framework to ensure that data collected, processed, and shared by Bangladesh Breastfeeding Foundation is handled responsibly, securely, and transparently. By adhering to this policy, we aim to demonstrate our commitment to data privacy and accountability, in line with international data protection standards. This policy is also designed to assure partners and donors of our data protection measures and commitment to best practices.

Scope

This policy applies to all data collected, processed, stored, and shared by Bangladesh Breastfeeding Foundation. It covers data gathered from participants, beneficiaries, employees, and any other individuals whose information is handled by the organization. All staff, contractors, and partners are required to adhere to this policy.

Data Protection Principles

Bangladesh Breastfeeding Foundation is committed to the following core principles for data protection:

Lawfulness, Fairness, and Transparency: Personal data must be processed lawfully, fairly, and transparently. Individuals will be informed of how their data will be used, shared, and stored.
Purpose Limitation: Data will only be collected for specific, legitimate purposes related to the organization’s activities and not processed in ways incompatible with those purposes.
Data Minimization: Only data that is strictly necessary to achieve the organization’s objectives will be collected. We will avoid collecting and storing excessive information.
Accuracy: Personal data must be kept accurate and up-to-date. Measures will be in place to correct or delete data that is inaccurate or outdated.
Storage Limitation: Data will be retained only as long as necessary to fulfill the purposes for which it was collected. Afterward, it will be securely deleted or anonymized.
Integrity and Confidentiality (Security): Personal data will be safeguarded against unauthorized access, loss, or damage through appropriate technical and organizational measures, including encryption and access controls.

Individual Rights

Individuals whose data we process have the following rights:

Right to Access: Request to see the data held about them.
Right to Rectification: Request corrections to inaccurate or incomplete data.
Right to Erasure (Right to be Forgotten): Request deletion of their data when it is no longer necessary.
Right to Restrict Processing: Request restrictions on processing under certain conditions.
Right to Data Portability: Obtain and reuse their data across different services.
Right to Object: Object to the processing of their data in certain situations.

consent

We will obtain clear, informed consent from individuals (or their guardians in the case of minors) before collecting personal data, especially sensitive information. Consent information will include:

The purpose of data collection.
The intended use and sharing of the data.
Information on how to withdraw consent.

Data Collection and Processing Standards

Data Collection: Conducted through secure methods, such as encrypted online forms, secure paper records, and compliant data collection software.
Data Processing: Conducted securely. Sensitive data will be anonymized where possible, and access to personal data will be restricted to authorized personnel only.

Data Sharing and Transfers

Data will only be shared with trusted third-party partners who comply with equal or stricter data protection standards.
Sharing will be minimized to what is necessary, with data-sharing agreements outlining partner obligations.

Data Security

- Technical Measures: Use of encryption, access controls, and secure storage solutions. Remote access through secure connections (e.g., VPNs) with strict authentication protocols.
- Organizational Measures: Access limited to those with a legitimate need. Regular training provided. Incident response plans in place to manage breaches.

Data Retention and Disposal

Personal data will only be kept as long as necessary or as required by law. When no longer needed, it will be securely deleted, erased, or anonymized.

Data Breach Protocol

- In the event of a data breach, Bangladesh Breastfeeding Foundation will:
  - Take immediate action to contain and assess the breach.
  - Notify affected individuals and, if required, regulatory authorities within the mandated time frame.
  - Conduct a thorough investigation and implement corrective actions to prevent future incidents.

Training and Awareness

All employees, contractors, and relevant partners will receive regular training on data protection practices. The organization will foster a culture of privacy and security across operations.

Policy Review

All employees, contractors, and relevant partners will receive regular training on data protection practices. The organization will foster a culture of privacy and security across operations.

Compliance Statement
By adhering to this Data Protection and Privacy Policy, Bangladesh Breastfeeding Foundation commits to protecting personal data with integrity and transparency. This policy aligns with international data protection standards, ensuring that all collected data is responsibly managed, securely stored, and ethically used.

Data Protection and Privacy Policy

Bangladesh Breastfeeding Foundation

Purpose

Scope

Data Protection Principles

Bangladesh Breastfeeding Foundation is committed to the following core principles for data protection:

Lawfulness, Fairness, and Transparency: Personal data must be processed lawfully, fairly, and transparently. Individuals will be informed of how their data will be used, shared, and stored.

Purpose Limitation: Data will only be collected for specific, legitimate purposes related to the organization’s activities and not processed in ways incompatible with those purposes.

Data Minimization: Only data that is strictly necessary to achieve the organization’s objectives will be collected. We will avoid collecting and storing excessive information.

Accuracy: Personal data must be kept accurate and up-to-date. Measures will be in place to correct or delete data that is inaccurate or outdated.

Storage Limitation: Data will be retained only as long as necessary to fulfill the purposes for which it was collected. Afterward, it will be securely deleted or anonymized.

Integrity and Confidentiality (Security): Personal data will be safeguarded against unauthorized access, loss, or damage through appropriate technical and organizational measures, including encryption and access controls.

Individual Rights

Individuals whose data we process have the following rights:

Right to Access: Request to see the data held about them.

Right to Rectification: Request corrections to inaccurate or incomplete data.

Right to Erasure (Right to be Forgotten): Request deletion of their data when it is no longer necessary.

Right to Restrict Processing: Request restrictions on processing under certain conditions.

Right to Data Portability: Obtain and reuse their data across different services.

Right to Object: Object to the processing of their data in certain situations.

consent

We will obtain clear, informed consent from individuals (or their guardians in the case of minors) before collecting personal data, especially sensitive information. Consent information will include:

The purpose of data collection.

The intended use and sharing of the data.

Information on how to withdraw consent.

Data Collection and Processing Standards

Data Collection: Conducted through secure methods, such as encrypted online forms, secure paper records, and compliant data collection software.

Data Processing: Conducted securely. Sensitive data will be anonymized where possible, and access to personal data will be restricted to authorized personnel only.

Data Sharing and Transfers

Data will only be shared with trusted third-party partners who comply with equal or stricter data protection standards.

Sharing will be minimized to what is necessary, with data-sharing agreements outlining partner obligations.

Data Security

Technical Measures: Use of encryption, access controls, and secure storage solutions. Remote access through secure connections (e.g., VPNs) with strict authentication protocols.

Organizational Measures: Access limited to those with a legitimate need. Regular training provided. Incident response plans in place to manage breaches.

Data Retention and Disposal

Personal data will only be kept as long as necessary or as required by law. When no longer needed, it will be securely deleted, erased, or anonymized.

Data Breach Protocol

In the event of a data breach, Bangladesh Breastfeeding Foundation will:

Take immediate action to contain and assess the breach.

Notify affected individuals and, if required, regulatory authorities within the mandated time frame.

Conduct a thorough investigation and implement corrective actions to prevent future incidents.

Training and Awareness

All employees, contractors, and relevant partners will receive regular training on data protection practices. The organization will foster a culture of privacy and security across operations.

Policy Review

All employees, contractors, and relevant partners will receive regular training on data protection practices. The organization will foster a culture of privacy and security across operations.

YOU CAN DOWNLOAD THE PDF