Information Security Policy

Islamic Sharia Council of Great Britain & Northern Ireland

Last updated: 15.10.2026

Document Control

Policy Owner

Secretary / Trustee with Information Governance portfolio

Version: 1.0

Date Approved: 15.10.2026

Review Date: 15.10.2027

1. Purpose

The Islamic Sharia Council (“the Council”, “we”, “us”) collects, processes and stores highly sensitive personal and religious information, including details of marriages, divorces, mediation proceedings, and fatwa enquiries. This information is provided to us in confidence and often relates to deeply personal family matters.

Information security incidents can lead to serious harm for our clients, including embarrassment, distress, discrimination or safeguarding risks. They can also expose the Council to regulatory action, reputational damage, and liability under UK data protection legislation.

This policy establishes the Council’s commitment to protecting its information assets and sets out the framework for managing information security across the organisation.

2. Scope

This policy applies to:

  • All information held by the Council, regardless of format (paper, electronic, verbal), including personal data, case records, adjudication decisions, fatwa responses, financial records, and correspondence.

  • All individuals who access Council information, including trustees, scholars, staff, volunteers, contractors, and third-party service providers.

  • All systems and devices used to process Council information, including office computers, mobile devices, email accounts, cloud services, and physical filing systems.

3. Information Security Objectives

The Council’s information security objectives are to:

  • Protect the confidentiality of client information, ensuring it is accessible only to authorised individuals.

  • Maintain the integrity of information, ensuring accuracy and completeness.

  • Ensure the availability of information to authorised users when required for the delivery of Council services.

  • Comply with applicable legal and regulatory obligations, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and charity law.

  • Foster a culture of security awareness among all individuals handling Council information.

4. Governance and Responsibilities

4.1 Trustees

The Board of Trustees holds ultimate accountability for information security and data protection. The Trustees will:

  • Designate a trustee with responsibility for information governance oversight.

  • Receive regular reports on information security matters.

  • Ensure adequate resources are allocated to information security.

4.2 Information Security Lead

The Council will appoint an Information Security Lead, who will:

  • Manage the day-to-day implementation of this policy.

  • Monitor compliance and report to the Trustees.

  • Maintain an inventory of information assets.

  • Coordinate staff training and awareness activities.

  • Act as the point of contact for information security incidents.

4.3 All Individuals

All trustees, scholars, staff, and volunteers must:

  • Read, understand, and comply with this policy.

  • Handle information in accordance with the Council’s classification and handling requirements.

  • Report suspected security incidents or breaches immediately to the Information Security Lead.

5. Information Classification

The Council recognises that its information varies in sensitivity. All information assets will be classified according to the following scheme:

Confidential

  • Highly sensitive information where unauthorised disclosure could cause serious harm or distress. Access is strictly limited to those with a specific need.

Examples: Case files, adjudication decisions, fatwa enquiries, safeguarding records, identity documents

Internal

  • Information intended for use within the Council only. Unauthorised disclosure would cause inconvenience or minor harm.

Examples: Internal correspondence, meeting minutes, policy drafts

Public

  • Information approved for public release.

Examples: Published guidance, website content, public statements

Confidential information must be stored securely, encrypted where appropriate, and shared only through secure channels. Website enquiry forms must not be used to transmit identity documents, detailed evidence, or religious case records.

6. Access Control

Access to Council information will be controlled on a need-to-know basis, determined by the individual’s role and the sensitivity of the information.

  • Access to case management systems and confidential records will require individual authentication using unique credentials.

  • Shared or group accounts will not be used for systems holding personal data.

  • Privileged access (administrator or supervisor rights) will be granted only where necessary and on a restricted basis.

  • Access rights will be reviewed periodically and revoked promptly when individuals leave the Council or change roles.

  • All staff, scholars, and volunteers must use strong passwords meeting minimum complexity requirements and must not share credentials.

7. Physical Security

The Council will implement appropriate physical controls to protect information and equipment, including:

  • Lockable storage for paper records containing confidential information.

  • Secure premises with controlled access.

  • Clear desk and clear screen practices for all staff and volunteers.

  • Secure disposal of paper records through shredding or confidential waste services.

  • Secure disposal or wiping of electronic devices at end of life.

8. Technical Security

The Council will maintain appropriate technical controls, including:

  • Anti-malware protection on all systems processing Council information, kept up to date.

  • Encryption of confidential information at rest and in transit where feasible.

  • Regular backups of critical systems and data, with tested recovery procedures.

  • Network security measures, including firewalls and secure configuration baselines.

  • Logging and monitoring of access to systems containing personal data.

  • Patch management to ensure systems and software are kept current.

  • Collecting only the information necessary for the specified purpose.

  • Retaining information only for as long as necessary (case records are retained for a minimum of five years following conclusion of a case, after which they are securely destroyed unless the applicant requests earlier destruction).

  • Respecting individual rights, including the right of access, rectification, and erasure where applicable.

  • Ensuring appropriate safeguards for international transfers of personal data, where relevant.

10. Information Sharing

Information will be shared with third parties only where:

  • The individual has provided consent, or

  • Sharing is required or permitted by law, or

  • Sharing is necessary to protect a person’s vital interests or for safeguarding purposes.

Where information is shared with partner organisations or service providers, the Council will ensure appropriate written agreements are in place and will seek assurance that adequate security measures are maintained.

11. Incident Management and Breach Reporting

All individuals must report suspected or actual information security incidents immediately to the Information Security Lead. Incidents include:

  • Loss or theft of devices or paper records.

  • Unauthorised access to or disclosure of information.

  • Accidental disclosure (e.g., sending information to the wrong recipient).

  • Suspected malware infection or system compromise.

The Information Security Lead will:

  • Log and investigate the incident.

  • Take immediate steps to contain and mitigate harm.

  • Where required, notify the Information Commissioner’s Office within 72 hours of becoming aware of a personal data breach.

  • Notify affected individuals where the breach poses a high risk to their rights and freedoms.

  • Report incidents to the Trustees and implement lessons learned to prevent recurrence.

12. Training and Awareness

All trustees, scholars, staff, and volunteers will receive information security and data protection training:

  • As part of their induction.

  • Annually thereafter.

  • When significant changes to this policy or relevant procedures occur.

Training will cover secure handling of personal data, password management, incident reporting, and the Council’s confidentiality commitments.

13. Compliance and Monitoring

Compliance with this policy will be monitored by the Information Security Lead through:

  • Periodic reviews of access controls and system configurations.

  • Spot checks on information handling practices.

  • Review of incidents and near-misses.

  • Annual policy review and update.

The Trustees will receive an annual report on information security compliance and any significant incidents.

14. Policy Review

This policy will be reviewed annually by the Information Security Lead and approved by the Trustees. It will also be reviewed following any significant security incident or change in legal or regulatory requirements.