Legal
Data Policy
Effective 6 November 2026 · Version 2026-11-06
This policy sets out how the MPS Urban London Officer Portal classifies, protects, retains and deletes data, and what People & Culture and Administrators must do when handling it. It supports our Privacy Policy.
1. Principles
- Minimisation: we only collect what is needed for the directory, appraisals and Command forms.
- Roleplay only: the portal holds roleplay information. Real-world personal data must not be entered, and must be removed if found.
- Need to know: access is based on role and limited to what each person needs.
- Accountability: sensitive actions are recorded in the audit log.
2. Classification
| Data | Classification | Who can access |
|---|---|---|
| Command Directory and Hierarchy | Official | All signed-in members |
| Appraisals | Official – Sensitive | Author, the officer once released, People & Culture, Administrators |
| Other form submissions | Official – Sensitive | Author, the officer the submission is about (if released), People & Culture, Administrators |
| Audit log, Discord IDs, user management | Official – Sensitive | Administrators |
3. Roles and responsibilities
- Officers keep their own directory entry accurate and keep portal information confidential.
- Line managers write fair, evidenced appraisals only for officers who report to them.
- People & Culture verify directory entries, review submissions before release, respond to data requests and remove inappropriate content.
- Administrators manage access, keep the server and software up to date, protect backups and handle security incidents.
4. Retention schedule
| Record | Kept for | Then |
|---|---|---|
| Appraisals and form submissions | 24 months from submission | Deleted automatically |
| Archived submissions | 12 months from archiving | Deleted automatically |
| Audit log entries | 12 months | Deleted automatically |
| Account and directory entry | While you are a member | Erased on request or when you leave the Community |
| Exports (CSV downloads) | Only as long as needed | Deleted by the person who downloaded them |
| Server backups | Up to 30 days | Overwritten on rotation |
| Web server logs (IP addresses) | Up to 14 days | Rotated and deleted |
5. Security measures
- HTTPS everywhere with HSTS; security headers prevent the portal being framed or sniffed.
- Sign-in via Discord OAuth2 only; no passwords are stored. Membership of our server is checked on every sign-in.
- Role-based access enforced on the server for every page, action and export.
- Sessions expire after 12 hours. Suspended accounts are blocked immediately.
- Exports, reviews, deletions and role changes are written to the audit log.
- The database is stored on a private VPS with restricted SSH access and encrypted backups.
6. Exports and copies
CSV exports are restricted to People & Culture and Administrators and are logged. Exported files must be stored securely, not shared outside the Command team, and deleted once no longer needed.
7. Data requests
Members can download their own data from My Profile at any time. Requests for correction, erasure or restriction should be made by opening a ticket with People & Culture on our Discord server. People & Culture will respond within one month. Erasure is carried out by an Administrator using Users & Access → Erase, which removes the account, the directory entry and every submission written by or about the member.
8. Incidents and breaches
- Anyone who suspects a breach must report it to an Administrator immediately.
- Administrators contain the incident (for example revoking access or rotating secrets) and record what happened.
- Affected members are told without undue delay if their data was exposed.
- The incident is reviewed and this policy updated where needed.
9. Review
This policy is reviewed at least every 12 months, or sooner if the portal changes significantly.