Data protection at work policy

This policy explains how to handle personal data at work. It helps us protect people's information and meet our duties under data protection law, including the UK GDPR and the Data Protection Act 2018.

It applies to everyone who works for us, and to all the personal data we handle, on screen or on paper. We decide why and how we use personal data, so we are responsible for it. Our data protection lead answers questions about this policy. HR can tell you who that is.

What personal data is

Personal data is any information about a living person who can be identified, directly or indirectly. Examples include a name, a work email address, a phone number, a photo, an employee number, location data and online identifiers.

Some personal data needs extra care. This includes information about someone's health, sex life or sexual orientation, race or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, and genetic or biometric data. Information about criminal convictions and offences needs extra care too.

Use only what you need

Use personal data only when you need it for your work. Do not look at records you do not need, even if your access allows it.
Collect only the information you need, and keep it accurate and up to date.
Do not use personal data for a new purpose without checking with the data protection lead first.
Tell the data protection lead before you start a project or system that uses personal data in a new way, so that we can assess the risks first.
When you collect personal data from people, tell them how we will use it. Usually you can point them to our privacy notice.
Do not send marketing emails or texts to anyone unless the marketing team has checked that we may contact them.

Personal data about colleagues, such as HR records, pay and sickness absence, needs the same care as data about customers. Look at a colleague's records only when your role needs you to.

Keep it secure

Keep personal data only in our approved systems. Do not keep copies on personal devices, in personal email accounts or in apps we have not approved.
Use strong passwords and two-step sign-in. Lock your screen when you step away, and lock paper records away.
Be alert to scams. Check who you are dealing with before you give out personal data, and report suspicious emails or calls to IT.

Sharing personal data

Share personal data only with people who need it and are allowed to have it, inside or outside the company.
Before you share it outside the company, check that the sharing has been agreed, and send it securely. If you are unsure, ask the data protection lead.
Check every recipient before you press send.
Putting personal data into an AI tool or another online service is also sharing it. Use only tools approved for that, as our Using AI at work policy explains.

Keeping and deleting personal data

Keep personal data only for as long as we need it. Our retention schedule says how long to keep each kind of record. When the time is up, delete or destroy it securely, including any copies you made. Do not delete records we have told you to keep, for example because of a legal claim.

Requests from people about their data

People have rights over their personal data. For example, they can ask for a copy of it, which is called a subject access request. They can also ask for it to be corrected or deleted.

A request can come in any form: in person, by phone, by email or on social media. It does not have to use any special words.
Pass any request to the data protection lead on the day you receive it, or the next working day. Do not answer it yourself.
We usually have one month to respond, so passing requests on quickly matters.

Personal data breaches

A personal data breach is when personal data is lost, destroyed, changed or made unavailable, or when someone sees or gets it without permission. It can happen by accident or on purpose. Examples include an email sent to the wrong person and a lost laptop.

If you think there has been a breach:

Tell the data protection lead at once, even if it seems small or you are not sure.
Do not try to deal with it alone, and do not delete anything that shows what happened.
Follow the instructions you are given.

We may have to report a breach to the Information Commission within 72 hours of becoming aware of it, and tell the people affected. That is why reporting quickly matters.

Working away from the office

The same rules apply when you work from home, while travelling or anywhere else.
Make sure other people are unable to see your screen or overhear calls about people. Do not leave devices or papers unattended, including in a car.
Use company devices. On public wifi, use the secure connection IT provides.
Do not print personal data at home, or take paper records out of the office, unless your manager has agreed.

The Information Commission

The Information Commission is the UK regulator for data protection. On 30 September 2026 the Information Commissioner's Office became the Information Commission, and it is still known as the ICO. Its website, ico.org.uk, has guidance on data protection and people's rights.

If you are worried about how we use personal data, tell the data protection lead. You can also complain to the ICO.

If this policy is broken

Breaking this policy may lead to disciplinary action, up to and including dismissal. Knowingly or recklessly obtaining or sharing personal data without our permission can also be a criminal offence.

Find out more

Confirming you have read this policy

We review this policy at least every year, and sooner if the law or our systems change. We will tell you what has changed. Ask the data protection lead if anything in it is unclear, then confirm below that you have read it.