6 Integrity and confidentiality

Personal data must be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

The Company takes the security of personal data seriously and we have implemented and maintain safeguards which are appropriate to the size and scope of our business, the amount of personal data that we hold and any identified risks. This includes encryption and pseudonymisation of personal data where appropriate. We have also taken steps to ensure the ongoing confidentiality, integrity, availability and resilience of our processing systems and services and to ensure that, in the event of a physical or technical incident, availability and access to personal data can be restored in a timely manner. We regularly test and evaluate the effectiveness of our technical and organisational safeguards to ensure the security of our processing activities.

In turn, staff are responsible for protecting the personal data that we hold, and they must implement reasonable and appropriate security measures against unauthorised or unlawful processing of personal data and against their accidental loss, destruction or damage. Staff must be particularly careful in protecting special categories of personal data and criminal records personal data. Staff must follow all procedures, and comply with all technologies and safeguards that we put in place to maintain the security of personal data from the point of collection to the point of destruction.

Where the Company uses third-party service providers to process personal data on our behalf, additional security arrangements need to be implemented in contracts with those third parties to safeguard the security of personal data. You can only share personal data with third-party service providers if you have been authorised to do so and provided that certain safeguards and contractual arrangements have been put in place, including that:

• the third party has a business need to know the personal data for the purposes of providing the contracted services
• sharing the personal data complies with the privacy notice that has been provided to the data subject (and, if required, the data subject’s consent has been obtained)
• the third party has agreed to comply with our data security procedures and has put adequate measures in place in ensure the security of processing
• the third party only acts on our documented written instructions
• a written contract is in place between the Company and the third party that contains specific approved terms
• the third party will assist the Company in allowing data subjects to exercise their rights in relation to data protection and in meeting our obligations in relation to the security of processing, the notification of data breaches and data protection impact assessments
• the third party will delete or return all personal data to the Company at the end of the contract
• the third party will submit to audits.

Before any new agreement involving the processing of personal data by a third-party service provider is entered into, or an existing contract is amended, you must seek the approval of its terms from our Data Protection Officer.

You may only share personal data with other members of staff if they have a business need to know in order to properly perform their job duties and responsibilities.

Hard copy personnel files, which hold personal data gathered during the working relationship, are confidential and must be stored in locked filing cabinets. Only authorized members of staff, who have a business need to know in order to properly perform their job duties and responsibilities, have access to these files. Files will not be removed from their normal place of storage without good reason. Personal data stored on removable storage media must be kept in locked filing cabinets or locked drawers and cupboards when not in use by authorized members of staff. Personal data held in electronic format will be stored confidentially by means of password protection, encryption or pseudonymisation, and again only authorized members of staff have access to that data.

The Company has network backup procedures in place to ensure that personal data held in electronic format cannot be accidentally lost, destroyed or damaged. Personal data must not be stored on local computer drives or on personal devices.

The data protection legislation requires the Company to notify any personal data breach to the Information Commissioner’s Office within 72 hours after becoming aware of the breach and, where there is a high risk to the rights and freedoms of data subjects, to the data subject themselves. A personal data breach is any breach of security which leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed and includes any act or omission that compromises the confidentiality, integrity or availability of personal data or the safeguards that we, or our third-party service providers, have put in place to protect them. The Company has procedures in place to deal with any suspected personal data breach and you are required to comply with these. If you know or suspect that a personal data breach has occurred, you must immediately contact our data compliance manager, retain any evidence you have in relation to the breach and follow the Company’s data breach policy and response plan.

ACCOUNTABILITY

The Company is responsible for, and must be able to demonstrate compliance with, the data protection principles. This means that we must implement appropriate and effective technical

and organisational measures to ensure compliance and we also require you to fully assist and cooperate with us in this regard. In particular, we have:

• appointed a Data Protection Officer to be responsible for data protection compliance and privacy matters within the business
• kept written records of personal data processing activities
• implemented a privacy by design approach when processing personal data and we will conduct and complete data protection impact assessments (DPIAs) where a type of data processing, e.g. the launch of a new product or the adoption of a new program, process or IT system, in particular using a new technology, is likely to result in a high risk to the rights and freedoms of data subjects
• integrated data protection requirements into our internal documents, including this data protection policy, other related policies and privacy notices
• introduced a regular training programme for all members of staff on the data protection legislation and on their data protection duties and responsibilities and we also maintain a training record to monitor its delivery and completion – you must undergo all mandatory data protection training
• introduced regular reviews of our privacy measures and our policies, procedures and contracts and regular testing of our systems and processes to monitor and assess our ongoing compliance with the data protection legislation and the terms of this policy in areas such as security, retention and data sharing.

We also keep records of our personal data processing activities and you are required to assist us in ensuring these records are full, accurate and kept up to date.

PRIVACY BY DESIGN AND DATA PROTECTION IMPACT ASSESSMENTS

We are required to implement privacy by design measures when processing personal data by implementing appropriate technical and organisational measures in an effective manner to ensure compliance with the data protection legislation. You must assess what privacy by design measures can be implemented on all processes or systems that process personal data where this is part of your job duties or responsibilities because those processes or systems are under your control.

Where a type of data processing, e.g. the launch of a new product or the adoption of a new program, process or IT system which is under your control, is likely to result in a high risk to the rights and freedoms of data subjects, you must assist us in conducting and completing a DPIA.

This includes (but is not limited to):

• systematic and extensive automated processing and automated decision-making activities, including profiling, and on which decisions are based that have legal effects, or similar significant effects, on data subjects
• large-scale processing of special categories of personal data or criminal records personal data
• large-scale systematic monitoring of publicly accessible areas, e.g. using CCTV.

Before any form of new technology, program, process or system is introduced, you must contact our Data Protection Officer in order that a DPIA can be carried out.

A DPIA will comprise a review of the new technology, program, process or system and it must contain a description of the processing operations and the purposes, an assessment of the necessity and proportionality of the processing in relation to those purposes, an assessment of the risks to individuals and the measures in place to address or mitigate those risks and demonstrate compliance.

AUTOMATED PROCESSING AND AUTOMATED DECISION-MAKING

Automated processing is any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, and automated decision-making occurs when an electronic system uses an individual’s personal data to make a decision without human intervention.

The Company does not carry out any automated processing and does not take any decisions based solely on automated decision-making, including profiling.

DIRECT MARKETING

The Company is subject to certain rules when marketing our clients and customers. If you are involved in direct marketing to customers, you must comply with the Company’s guidelines on this. In particular, a data subject’s prior consent is required for electronic direct marketing. There is a limited exception for existing clients and customers which allows us to send marketing texts and e-mails if we have obtained their contact details in the course of a sale to that person, we are marketing similar products or services to them and we gave that person an opportunity to opt out of marketing when first collecting their details and in every subsequent message.

If a data subject objects to direct marketing, it is essential that this is actioned in a timely manner and their details should be suppressed as soon as possible. You can retain just enough information to ensure that marketing preferences are respected in the future.

TRANSFERRING PERSONAL DATA OUTSIDE THE EUROPEAN ECONOMIC AREA

The data protection legislation restricts transfers of personal data to countries outside the European Economic Area (EEA) in order to ensure that the level of data protection afforded to data subjects is maintained.

The Company may transfer personal data to countries outside the EEA, provided one of the following applies:

• there is an adequacy decision by the European Commission in respect of the particular country, i.e. that country is deemed to provide an adequate level of protection for personal data
• appropriate safeguards are in place, such as binding corporate rules or standard data protection clauses approved by the European Commission
• the data subject has provided their explicit consent to the proposed transfer after being informed of any potential risk.]

DATA SUBJECT RIGHTS TO ACCESS PERSONAL DATA

Under the data protection legislation, data subjects have the right, on request, to obtain a copy of the personal data that the Company holds about them by making a written Data Subject Access Request (DSAR). This allows the data subject to check that we are lawfully processing their personal data. The data subject has the right to obtain:

• confirmation as to whether or not their personal data are being processed
• access to copies of their specified personal data
• Other additional information.

The other additional information (which should be provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language) comprises:

• the purposes of the processing and the categories of personal data concerned
• the recipients, or categories of recipients, to whom the personal data have been or will be disclosed, in particular recipients in non-EEA countries
• where the personal data are transferred to a non-EEA country, what appropriate safeguards are in place relating to the transfer
• the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
• the existence of the data subject’s rights to request rectification or erasure of their personal data or restriction of processing of their personal data or to object to such processing
• their right to lodge a complaint with the Information Commissioner’s Office if they think the Company has failed to comply with their data protection rights
• where the personal data are not collected from them, any available information as to their source
• the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the envisaged consequences of such processing for them.

When a data subject makes a DSAR, we will log the date on which the request was received and confirm their identity. Where we have reasonable doubts concerning the data subject’s identity, we will request them to provide such additional information necessary to confirm their identity before complying with their DSAR. We will then search databases, systems and other places where the personal data which are the subject of the DSAR may be held. Where we process a large quantity of personal data about a data subject, we may ask them to first specify the information that their DSAR relates to.

If the data subject makes their DSAR electronically, the Company must provide a copy of the personal data in a commonly used electronic format, unless they specifically request otherwise. If the data subject wants additional copies of the personal data, the Company will charge a reasonable fee, which is based on our administrative costs of providing the additional copies.

The Company will normally respond to a DSAR and provide copies of the personal data within one month of the date of receipt of the request. However, we may extend this time limit for responding by a further two months if the request is complex or there are a number of requests made by the data subject. If we intend to extend the time limit, we will contact the data subject within one month of the DSAR’s receipt to inform them of the extension and to explain why it is necessary.

Before providing the personal data to the data subject making the DSAR, we will review the personal data requested to see if they contain the personal data of other data subjects. If they do, we may redact the personal data of those other data subjects prior to providing the data subject with their personal data, unless those other data subjects have consented to the disclosure of their personal data. We will also check whether there are any statutory exemptions from disclosure that apply to the personal data that are the subject of the DSAR. If a statutory exemption applies to any of the personal data, those personal data may not be disclosed.

Whilst we will normally provide a copy of the personal data in response to a DSAR free of charge, we reserve the right to charge a reasonable fee, based on our administrative costs of providing the personal data, when a DSAR is manifestly unfounded or excessive, particularly if it repeats a DSAR to which we have already responded. Alternatively, where a DSAR is manifestly unfounded or excessive, we reserve the right to refuse to respond altogether. Where we refuse to act on a request in this way, we will set out our written reasons why to the data subject within one month of receipt of their DSAR. We will also inform them of their right to complain to the Information Commissioner’s Office or to seek a judicial remedy in the courts.

If you wish to exercise your data subject access rights, please complete our Data Subject Access Request form, available from our Data Protection Officer, or complete the electronic form on the Company’s website]. We will inform you if we need to further verify your identity. If employees receive a DSAR from another data subject, they must immediately forward it to our Data Protection Officer who will deal with responding to it.

Other data subject rights in relation to their personal data

Data subjects have a number of other rights in relation to their personal data. When we process data subjects’ personal data, we will respect those rights. It is the Company’s policy to ensure that requests by data subjects to exercise their rights in respect of their personal data are handled in accordance with the data protection legislation.

Subject to certain conditions, and in certain circumstances, data subjects have the right to:

• be informed – this is normally satisfied by issuing them with an appropriate privacy notice
• request rectification of their personal data – this enables them to have any inaccurate or incomplete personal data we hold about them corrected or completed, including by their providing a supplementary statement
• request the erasure of their personal data – this enables them to ask us to delete or remove their personal data where there’s no compelling reason for their continued processing, e.g. it’s no longer necessary in relation to the purpose for which they were originally collected or if there are no overriding legitimate grounds for the processing
• restrict the processing of their personal data – this enables them to ask us to suspend the processing of their personal data, e.g. if they contest the accuracy and so want us to verify the accuracy or the processing is unlawful but they don’t want the personal data to be erased
• object to the processing of their personal data – this enables them to ask us to stop Processing their personal data where we are relying on the legitimate interests of the business as our lawful basis for processing and there is something relating to their particular situation which makes them decide to object to processing on this ground
• data portability – this gives them the right to request the transfer of their personal data to another party so that they can reuse them across different services for their own purposes
• not be subject to automated decision-making, including profiling – this gives them the right not to be subject to a decision based solely on the automated processing of their personal data, if such decision produces legal effects concerning them or similarly significantly affects them
• prevent direct marketing – this enables them to prevent our use of their personal data for direct marketing purposes
• be notified of a data breach which is likely to result in a high risk to their rights and freedoms.

If, as a data subject, you wish to exercise any of these rights, please contact our Data Protection Officer.

If a data subject invokes any of these rights, we must take steps to verify their identity, log the date on which the request was received and seek advice from our if you need assistance in dealing with the matter. The following response procedures apply as applicable:

• response to requests to rectify personal data – unless there is an applicable exemption, we will rectify the personal data without undue delay and we will also communicate the rectification of the personal data to each recipient to whom the personal data have been disclosed, e.g. our third-party service providers, unless this is impossible or involves disproportionate effort
• response to requests for the erasure of personal data – we will erase the personal data without undue delay provided one of the grounds set out in the data protection legislation applies and there is no applicable exemption (and, where the personal data are to be erased, a similar timetable and procedure to that applying to responding to DSARs will be followed). We will also communicate the erasure of the

personal data to each recipient to whom the personal data have been disclosed, unless this is impossible or involves disproportionate effort. Where we have made the personal data public, we will take reasonable steps to inform those who are processing the personal data that the data subject has requested the erasure by them of any links to, or copies or replications of, those personal data

• response to requests to restrict the processing of personal data – where processing has been restricted in accordance with the grounds set out in the data protection legislation, we will only process the personal data (excluding storing them) with the data subject’s consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another person, or for reasons of important public interest. Prior to lifting the restriction, we will inform the data subject that it is to be lifted. We will also communicate the restriction of processing of the personal data to each recipient to whom the personal data have been disclosed, unless this is impossible or involves disproportionate effort
• response to objections to the processing of personal data – where such an objection is made in accordance with the data protection legislation and there is no applicable exemption, we will no longer process the data subject’s personal data unless we can show compelling legitimate grounds for the processing which overrides the data subject’s interests, rights and freedoms or we are processing the personal data for the establishment, exercise or defence of legal claims. If a data subject objects to the processing of their personal data for direct marketing purposes, we will stop processing the personal data for such purposes
• response to requests for data portability – unless there is an applicable exemption, we will provide the personal data without undue delay if the lawful basis for the processing of the personal data is consent or pursuant to a contract and our processing of those data is carried out by automated means (and a similar timetable and procedure to that applying to responding to DSARs will be followed)
• [response to requests not to be subject to automated decision-making – where such a request is made we will, unless there is an applicable exemption, no longer make such a decision unless it’s necessary for entering into, or the performance of, a contract between us and the data subject, is authorised by applicable law which lays down suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests, or is based on the data subject’s explicit consent. In these circumstances, the data subject will still be given the right to obtain human intervention, to express their point of view and to contest the decision.]

In the limited circumstances where the data subject has provided their consent to the processing of their personal data for a specific purpose, they have the right to withdraw their consent for that specific processing at any time. This will not, however, affect the lawfulness of processing based on consent before its withdrawal.

If, as a data subject, you wish to withdraw your consent to the processing of your personal data for a specific purpose, please contact our Data Protection Officer.

Once we have received notification that you have withdrawn your consent, we will no longer process your personal data for the purpose you originally agreed to, unless we have another lawful basis for processing.

If a data subject invokes their right to withdraw their consent, seek advice from our Data Protection Officer.

If you need assistance in dealing with the matter.

Data subjects also have the right to make a complaint to the Information Commissioner’s Office at any time.

YOUR OBLIGATIONS IN RELATION TO PERSONAL DATA

You must comply with this policy and the data protection principles at all times in your personal data processing activities where you are acting on behalf of the Company in the proper performance of your job duties and responsibilities. We rely on you to help us meet our data protection obligations to data subjects.

Under the data protection legislation, you should also be aware that you are personally accountable for your actions and you can be held criminally liable. It is a criminal offence for you knowingly or recklessly to obtain or disclose personal data (or to procure their disclosure to a third party) without the consent of the Company. This would include, for example, taking clients’ or customers’ contact details or other personal data without the Company’s consent on the termination of your employment, accessing another employee’s personal data without authority or otherwise misusing or stealing personal data held by the Company. It is also a criminal offence to knowingly or recklessly re-identify personal data that has been anonymised without the consent of the Company, where we de-identified the personal data, and it is a criminal offence to alter, block, erase, destroy or conceal personal data with the intention of preventing their disclosure to a data subject following a data subject access request. Where unlawful activity is suspected, the Company will report the matter to the Information Commissioner’s Office for investigation into the alleged breach of the data protection legislation and this may result in criminal proceedings being instigated against you. The Company may also need to report the alleged breach to a regulatory body. This conduct would also amount to a gross misconduct offence under the Company’s disciplinary procedure and could lead to your summary dismissal.

You must also comply with the following guidelines at all times:

• only access personal data that you have authority to access and only for authorized purposes, e.g. if you need them for the work you do for the Company, and then only use the data for the specified lawful purpose for which they were obtained
• only allow other members of staff to access personal data if they have the appropriate authorization and never share personal data informally
• Do not disclose personal data to anyone except the data subject. In particular, they

should not be given to someone from the same family, passed to any other unauthorized third party, placed on the Company’s website or posted on the Internet in any form. Unless the data subject has given their explicit consent to this

• be aware that those seeking personal data sometimes use deception to gain access to them, so always verify the identity of the data subject and the legitimacy of the request
• where the Company provides you with code words or passwords to be used before releasing personal data, you must strictly follow the Company’s requirements in this regard
• only transmit personal data between locations by email if a secure network is in place, e.g. encryption is used for email
• if you receive a request for personal data about another member of staff or data subject, you should forward this to the Company’s data protection officer ensure any personal data you hold are kept securely, either in a locked non-portable filing cabinet or drawer if in hard copy, or password protected or encrypted if in electronic format, and comply with Company rules on computer access and secure file storage
• do not access another member of staff’s personal data, e.g. their personnel records, without authority as this will be treated as gross misconduct and it is a criminal offence
• do not obtain or disclose personal data (or procure their disclosure to a third party) without authority or without the Company’s consent as this will be treated as gross misconduct and it is a criminal offence
• do not write down (in electronic or hard copy form) opinions or facts concerning a data subject which it would be inappropriate to share with that data subject
• do not remove personal data, or devices containing personal data, from the workplace with the intention of processing them elsewhere unless this is necessary to enable you to properly carry out your job duties and responsibilities, you have adopted appropriate security measures (such as password protection, encryption or pseudonymisation) to secure the data and the device and it has been authorized by your line manager
• ensure that, when working on personal data as part of your job duties and responsibilities when away from your workplace and with the authorization of your line manager, you continue to observe the terms of this policy and the data protection legislation, in particular in matters of data security
• do not store personal data on local computer drives, your own personal computer or on other personal devices
• do not make unnecessary copies of personal data and keep and dispose of any copies securely, e.g. by cross-shredding hard copies
• ensure that you attend all mandatory data protection training
• refer any questions that you may have about the data protection legislation or compliance with this policy to our data protection officer
• Remember that compliance with the data protection legislation and the terms of this policy is your personal responsibility.