Trainee Records & Data Protection Policy
ASF Surveyor Training Programme — Records Management and GDPR Compliance Framework
Aligned with ISQua EEA STP 4th Edition (2021) Criteria 3.2 and 3.3
ISQua EEA STP Criteria Addressed
| Criterion | Exact ISQua Text (4th Ed., 2021) | Status |
|---|---|---|
| 3.2 | “The organisation maintains accurate and up-to-date records of trainees.” | MET |
| 3.3 | “The organisation has a policy for the management and protection of trainee data.” | MET |
Trainee Record Management (Criterion 3.2)
ASF maintains a comprehensive, accurate, and up-to-date electronic record for each trainee enrolled in the Surveyor Training Programme. Records are held in the ASF Learning Management System (LMS) and the Quality Management System (QMS), with access controlled by role-based permissions.
Mandatory Record Elements per Trainee
| Record Element | Source / Entry Method | Update Frequency | Retention Period |
|---|---|---|---|
| Personal identification data (name, date of birth, contact details, employer) | Enrolment application form; verified by Training Coordinator | At enrolment; updated when notified by trainee | 7 years post-qualification or withdrawal (see §3.3) |
| Professional qualifications and experience (pre-enrolment) | Application form; certified copies of documents | At enrolment | 7 years post-qualification or withdrawal |
| Enrolment and cohort details | LMS system record | At enrolment; at each cohort milestone | Permanent (qualification register) |
| Module attendance record | LMS attendance log; trainer sign-off | After each module delivery day | 7 years post-programme completion |
| Assessment results (all attempts, including failures) | LMS grade book; OSCE marking sheets retained in QMS | Within 5 working days of assessment | 7 years post-qualification or withdrawal |
| Mentor supervision log | Completed by trainee and countersigned by mentor; uploaded to QMS | After each supervised survey; at minimum monthly during mentorship phase | 7 years post-qualification or withdrawal |
| Qualification award | Certificate issued by Programme Director; recorded in Qualification Register | On award | Permanent (Qualification Register) |
| CPD record (post-qualification) | Annual CPD log submitted by surveyor; recorded in Qualification Register | Annually by 31 January | 7 years per CPD cycle; permanent summary in Qualification Register |
| Complaints and appeals (if any) | Complaints Manager; QMS record | Within 5 working days of event | 10 years post-resolution |
Data Protection Policy (Criterion 3.3)
ASF is a data controller for trainee personal data under Regulation (EU) 2016/679 (GDPR) and the French implementing legislation (Loi n°78-17 du 6 janvier 1978 modifiée, dite Loi Informatique et Libertés, as amended by Ordonnance n°2018-1125 du 12 décembre 2018). A Data Protection Officer (DPO) has been appointed in accordance with GDPR Art. 37, given ASF’s large-scale processing of personal data.
Legal Basis for Processing
- Contract performance (GDPR Art. 6(1)(b)): Personal and assessment data necessary to deliver the training programme and issue qualifications
- Legal obligation (GDPR Art. 6(1)(c)): Training records required by French labour law (Loi n°2018-771) and professional qualification frameworks
- Legitimate interest (GDPR Art. 6(1)(f)): Quality monitoring and programme improvement; interrater reliability analysis (pseudonymised)
Key Data Subject Rights (GDPR Art. 12–22)
- Right of access (Art. 15): Trainees may request a copy of all personal data held within 30 days. Contact: dpo@france-asf.fr
- Right to rectification (Art. 16): Inaccurate records corrected within 5 working days of notification
- Right to erasure (Art. 17): Subject to legal retention obligations; requests assessed by DPO within 30 days
- Right to data portability (Art. 20): Assessment results and CPD records provided in machine-readable format on request
- Right to object (Art. 21): Trainees may object to processing for legitimate interest purposes; assessed case by case
Technical and Organisational Security Measures (GDPR Art. 32)
- All personal data stored on EU-based servers (data residency: France)
- Encryption at rest (AES-256) and in transit (TLS 1.3)
- Role-based access control: only training staff with a need to know have access to individual trainee records
- Quarterly GDPR compliance audit by DPO; annual external audit by accredited auditor
- Data breach notification procedure: internal report to DPO within 24 hours; CNIL notification within 72 hours where required (GDPR Art. 33); affected individuals notified without undue delay (GDPR Art. 34)
- All LMS access logged; audit trail retained for 2 years
Data Retention and Deletion
Personal data is retained only as long as necessary for the purposes for which it was collected, and no longer than the retention periods in the table above. Data deletion is carried out by the IT Manager on instruction from the DPO, documented in the Data Deletion Log, and confirmed in writing to the trainee where requested.
References & Regulatory Basis
GDPR — Regulation (EU) 2016/679 — Art. 5(1)(e) (storage limitation), Art. 6 (lawfulness of processing), Art. 12–22 (data subject rights), Art. 25 (data protection by design), Art. 32 (security), Art. 33–34 (breach notification), Art. 37 (DPO). Official Journal of the EU, 4 May 2016.
Loi n°78-17 du 6 janvier 1978 — Loi relative à l’informatique, aux fichiers et aux libertés (Loi Informatique et Libertés), modifiée par Ordonnance n°2018-1125 du 12 décembre 2018. JORF, 13 décembre 2018.
Loi n°2018-771 du 5 septembre 2018 (Loi “Avenir professionnel”) — Training documentation obligations. JORF, 6 septembre 2018.
CNIL (2022) — Guide du délégué à la protection des données (DPO). Commission Nationale de l’Informatique et des Libertés. cnil.fr
Décret n°79-1037 du 3 décembre 1979 — Archivage des documents administratifs: prescriptions de conservation applicables aux organismes de formation.