Data Protection & Privacy Policy

1. Purpose and intent

Sets principles for responsible collection, use, storage, sharing and retention of personal information. This policy is intended to provide a consistent reference for decisions, conduct and controls. It should be read alongside applicable laws, contractual obligations and relevant internal procedures. Where requirements differ, the applicable legal requirement and formally approved internal control take precedence.

2. Scope and application

Applies to personal data handled by the organisation in relation to employees, applicants, customers, suppliers, visitors and other individuals, across paper and digital systems.

Business partners are expected to observe equivalent standards where these are relevant to the services they provide or the activities they undertake on the organisation’s behalf. Application should be proportionate to role, activity, risk and applicable legal requirements.

3. Core principles

• Lawfulness and transparency: identify an appropriate legal basis and provide relevant notices.
• Purpose limitation: use data for defined and legitimate purposes.
• Data minimisation: collect only what is reasonably necessary.
• Accuracy: take reasonable steps to keep information accurate and current.
• Retention: retain information only for as long as justified by legal and business needs.
• Security and accountability: apply safeguards and maintain evidence of responsible handling.

4. Minimum standards and controls

The following controls describe the expected minimum approach. Specific procedures, approval limits, forms and technical controls may be established separately and updated through controlled internal documents.

• Limit access to authorised personnel with a legitimate business need.
• Use approved systems and secure methods for storage and transfer.
• Do not disclose personal information without appropriate authority or legal basis.
• Escalate suspected loss, unauthorised access or disclosure immediately.
• Respond to valid individual requests in accordance with applicable law.
• Dispose of records securely when retention is no longer required.

5. Roles and accountability

Data owners and system administrators must apply appropriate controls. Personnel must handle personal data only for authorised purposes and report suspected incidents promptly.

Any person who is uncertain about the application of this policy should seek guidance before taking action. No individual may override a legal obligation or approved control without appropriate authority and documented justification.

6. Reporting and escalation

Concerns, suspected breaches, control weaknesses and incidents should be raised promptly through the relevant management or designated reporting channel. Urgent threats to health, safety, the environment or the security of information must be escalated immediately. Reports should be handled fairly, sensitively and in accordance with applicable privacy and records requirements.

7. Monitoring, assurance and review

Privacy risks, access permissions, retention practices, incidents and third-party processing should be reviewed periodically. Where required, incidents and individual requests must be handled within applicable legal timeframes.

Where improvement actions are identified, they should be assigned to an accountable owner, given a proportionate target date and monitored to closure. Material changes in law, risk, organisational context or operating arrangements should trigger an earlier review.

8. Non-compliance

Failure to follow applicable requirements may result in corrective action, additional training, restricted authority, disciplinary measures, contractual remedies or referral to relevant authorities, depending on the circumstances and applicable law. Any response should be proportionate and follow fair process.

9. Related policies and standards

Information Security; Records Management; HR; Whistleblowing; Supplier Due Diligence.

Additional policy requirements

The following provisions expand the practical expectations set out in this policy. They should be applied in conjunction with applicable law, approved internal procedures, contractual obligations and the circumstances of each activity.

Lawful and fair processing

Personal information should be collected and used for specified, legitimate purposes and handled in accordance with applicable data protection law. Processing should be fair, transparent and limited to what is reasonably necessary.

Data quality and retention

Reasonable steps should be taken to keep personal information accurate and current. Information should not be retained indefinitely; retention periods should reflect legal, contractual, operational and evidential needs. Secure deletion or anonymisation should be used when information is no longer required.

Access and disclosure

Access should be restricted according to role and legitimate business need. Disclosures to service providers, counterparties or authorities should have an appropriate legal basis and safeguards. Personal information must not be shared through unauthorised channels.

Individual rights

Requests relating to access, correction, deletion, restriction or other applicable rights should be routed to the responsible function and handled within statutory timeframes. Identity and authority should be verified proportionately before action is taken.

Incidents and breach response

Suspected loss, misuse, unauthorised access or disclosure of personal information must be reported promptly. Response should include containment, preservation of evidence, assessment of affected data subjects and legal notification obligations where applicable.

Third-party processing

Service providers handling personal information should be assessed and bound by appropriate contractual safeguards, confidentiality, security, retention, incident notification and return or deletion requirements.

10. Document governance

This web page is a public policy statement. The controlled internal version, where formally approved, is maintained through the organisation’s document-control process. Approval status, document owner, effective date, review cycle and revision history must be confirmed in the controlled document register before this text is represented as a formally issued internal policy.