Governance & responsibility
Data Protection Policy
A public summary explaining how personal information should be handled lawfully, securely and transparently.
Purpose and commitment
Personal information must be treated responsibly.
The company should process personal data only for defined purposes, using an appropriate lawful basis and controls proportionate to the sensitivity and risk of the information.
The policy should cover employee, applicant, customer, supplier, visitor, CCTV, body-worn video and operational information processed in physical or digital form.
Responsibilities
Clear ownership and escalation.
Everyone handling personal information must follow authorised processes. Managers must control access and retention, while the appointed privacy lead should oversee rights requests, breaches and compliance questions.
Reporting and review
Concerns must be acted upon.
Suspected loss, unauthorised access or disclosure should be reported immediately through the company’s data-breach process so containment, assessment and any required notification can be considered.
Review dates, document ownership and the approved full policy should be confirmed before publication.
This page provides draft website content and is not a substitute for the company’s approved controlled policy. Replace or approve the wording before launch.
Return to all policies →Client feedback
Trusted to protect what matters.
Add an approved client testimonial in WordPress to replace this demonstration text.
Add an approved client testimonial in WordPress to replace this demonstration text.
Add an approved client testimonial in WordPress to replace this demonstration text.
Standards & assurance