Privacy Notice and Cookie Policy

Legal Notice

© 2026 Institute of Administrative Management. All rights reserved. This document is published for public reference. It may be cited, quoted, and reproduced in whole or in part for non-commercial professional, educational, and research purposes, provided that the Institute of Administrative Management is clearly acknowledged as the source and the document reference (IAM-PRN-2026-001) is given. Reproduction or distribution for commercial purposes, or any modification of the text, requires the prior written permission of the Institute of Administrative Management.

This Notice explains what personal data the Institute of Administrative Management collects, why, on what basis, for how long, with whom it is shared, and what rights individuals have. It gives public effect to Regulation 10 of the IAM Membership Regulation (IAM-MEM-REG-2026-001). The Institute is the data controller. Where the data protection law of the place where an individual lives gives greater rights than this Notice describes, that law applies and the Institute honours it.

This document is jurisdiction-neutral. Where it refers to legal, regulatory, or compliance obligations, it does so in general terms; the law of the place where a person lives, studies, or works may give additional rights, and nothing here limits them.

Accessibility: The Institute is committed to publishing this document accessibly. The electronic edition is prepared to meet internationally recognised digital accessibility standards, and the document is available in alternative formats on request to dpo@instam.org.

Language: This document is issued in English. The English text is the authoritative text. Where the Institute issues a translation, it is provided for convenience only and the English text prevails in the event of any difference of meaning.

Recommended citation: Institute of Administrative Management (2026), IAM Privacy Notice and Cookie Policy, Edition 1.0, IAM-PRN-2026-001, available at www.instam.org.

Document Control

Edition History

1. Who We Are and How to Reach Us

1.1 The Institute of Administrative Management is the controller of the personal data described in this Notice. Its Data Protection Officer can be reached at dpo@instam.org. Requests to exercise any right in Section 6 go to that address.

1.2 This Notice is issued under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and, for cookies and similar storage, the Privacy and Electronic Communications Regulations 2003 (PECR). The Institute’s supervisory authority is the Information Commissioner’s Office (ICO).

2. What We Collect and Why

Table 1: Personal data, purpose, and basis

2.2 The lawful bases in Table 1 are those of UK GDPR Article 6: “contract” is Article 6(1)(b); “legitimate interest” is Article 6(1)(f), where the Institute’s interest is the integrity of a professional register on which the public relies and you may object at any time; “legal obligation” is Article 6(1)(c); and “consent” is Article 6(1)(a), which you may withdraw at any time without affecting anything done before withdrawal. Special category data that you choose to disclose — for example, health information supporting a reasonable adjustment or a CPD exemption — is processed with your explicit consent under Article 9(2)(a), or, where a safeguarding duty arises, under Schedule 1 of the Data Protection Act 2018.

2.3 We do not collect more than the purpose needs, do not sell personal data, and do not use personal data for automated decisions that produce legal or similarly significant effects on you. Admission, assessment, and disciplinary decisions are made by people.

3. Sharing

3.1 We share personal data only: with employers and issuing institutions, to verify evidence you have supplied, using the consent you give at application; with an IAM Recognised Training Centre, for the learner it enrols, under the Data Processing Terms in the Centre Recognition Agreement; with a Corporate Member’s Coordinator, in aggregate only, never your individual record; with the public, through the Member Directory at the privacy level you choose and through Verify a Member, which confirms current status, grade, and Good Standing; with our platform, payment, and email service providers, who process on our instructions under contract; with our external examiners and moderators, under confidentiality; and with authorities where the law requires or where the public interest in the regulation of the profession demands it under Regulation 10 and the Malpractice and Maladministration Policy.

4. International Transfers

4.1 The Institute operates internationally and its platform is hosted where its providers’ contracts specify. Where personal data moves between countries, the Institute uses safeguards recognised by the law of the country the data leaves: contractual clauses, adequacy determinations, or your explicit consent for a specific transfer. Details of current hosting locations and safeguards are available from dpo@instam.org.

5. Retention

5.1 Retention follows Regulation 10.2 of the Membership Regulation: membership records for the duration of membership plus six years; application and assessment records for six years from the decision; CPD records for membership plus three years; disciplinary and complaints records for six years from the final decision or membership plus six years, whichever is longer, and indefinitely for expulsion or rescission; certificate and credential records indefinitely as archiving in the public interest; financial records for the period the applicable law requires; and Subscriber records for one year after registration ends.

6. Your Rights

6.0 Under UK GDPR you have the rights to be informed, of access, to rectification, to erasure, to restrict processing, to data portability, to object, and in relation to automated decision-making. The Institute responds to a request within one month, extendable by two months for a complex request, and may first ask you to confirm your identity.

6.1 Wherever you live, the Institute will: tell you what personal data it holds about you and give you a copy; correct anything inaccurate; delete what it no longer needs to keep, where no retention obligation applies; restrict processing while a dispute is resolved; give you your data in a portable form where processing is by consent or contract; honour your objection to processing on legitimate-interest grounds unless a compelling reason overrides it; and let you withdraw consent at any time where consent is the basis. Requests go to dpo@instam.org and are answered within thirty calendar days, extended only where the law of your country allows and you are told why. You may complain to the data protection authority of the country where you live, and to the Institute under the Appeals and Complaints Policy.

6.2 You have the right to lodge a complaint with the Information Commissioner’s Office at any time, and you do not have to complain to the Institute first: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; telephone 0303 123 1113; ico.org.uk/make-a-complaint. If you live outside the United Kingdom, you may instead complain to the supervisory authority where you live. The Institute would nevertheless welcome the chance to resolve any concern first, at dpo@instam.org.

6.3 Student Membership is open from age sixteen, so the Institute may hold the personal data of sixteen- and seventeen-year-olds. It processes that data only for enrolment, study support, and the obligations of the Code of Ethics, applies the same rights and the same responses, and uses language a young person can understand. It does not knowingly collect personal data from anyone under sixteen and deletes any it discovers. A parent or guardian may act for a Student Member under eighteen on request.

7. Security

7.1 The Institute protects personal data with measures appropriate to the risk: access control and least privilege; encryption in transit and at rest where practicable; logging; supplier contracts; staff training; and a breach response plan under which affected individuals and authorities are told without undue delay where the law or the risk requires.

8. Cookies

8.1 The public IAM website sets no cookies. It stores two preferences — display mode and text size — in your browser’s local storage, only when you press the control that sets them; under PECR regulation 6(4) storage that is strictly necessary to provide a feature you have explicitly requested needs no consent, and the site therefore shows no consent banner. The website makes no request to any third party. The IAM Portal, where you sign in, uses strictly necessary session cookies; it uses analytics cookies, which measure how the Portal is used in aggregate, only with your consent, which you give or refuse through the cookie banner and may change at any time through the cookie settings link in the footer. The website does not use advertising or tracking cookies, and the Institute does not permit third parties to set cookies for their own purposes. The interactive tools the Institute publishes — the Progression Profiler, Grade Navigator, and Ethics Navigator — run entirely on your own device and set no cookies and send no data.

9. Changes

9.1 This Notice is reviewed with the Membership Regulation and whenever the Institute’s processing changes materially. Changes are published at www.instam.org with the date of the change, and members are notified through the Platform of any change that affects their rights.

Institute of Administrative Management · In effect from 1 January 2027

INSTITUTE OF ADMINISTRATIVE MANAGEMENT

Inspiring professionals since 1915

IAM Privacy Notice and Cookie Policy

IAM-PRN-2026-001 • Edition 1.0 • In effect from 1 January 2027

Non Sibi Sed Toti

Not for Oneself but for All

www.instam.org • enquiry@instam.org

© 2026 Institute of Administrative Management. All rights reserved.

A company limited by guarantee, registered in England and Wales, No. 09016031.