Legal
Data Protection & UK GDPR
This page summarises how we govern personal data — the principles we work to, the controls we apply and how we demonstrate accountability.
It complements the Privacy Notice, which explains what we do with your data specifically.
The principles
The seven data protection principles
-
Lawfulness, fairness, transparency
We identify a lawful basis before processing and tell people what we are doing.
-
Purpose limitation
Data is collected for specified purposes and not reused in incompatible ways.
-
Data minimisation
We collect what the role or service genuinely needs, and no more.
-
Accuracy
We keep records current and correct errors promptly when told about them.
-
Storage limitation
We apply defined retention periods and delete or anonymise at the end of them.
-
Integrity and confidentiality
Appropriate technical and organisational security measures protect the data.
Policy detail
Accountability
The seventh principle requires us to demonstrate compliance, not merely assert it. In practice that means:
- Records of processing activities under Article 30
- An appropriate policy document covering special category and criminal offence data
- Data protection impact assessments where processing is likely to be high risk
- Written processor agreements meeting Article 28 with every supplier that handles personal data for us
- Data protection training for staff who handle personal data
- A breach response procedure with defined roles and reporting timescales
- Regular review of retention, access rights and supplier arrangements
Roles
We are a controller for the data we hold about clients, candidates and workers. Where we supply workers, the client organisation is normally a separate controller for the data it holds. In limited circumstances we may act as a processor — where we do, it is set out in the contract.
Data Protection Officer: Debora Kiladejo, Founder & Director, info@komestaffing.co.uk.
Security measures
- Role-based access control, so staff see only what their duties require
- Encryption in transit, and at rest where our systems support it
- Multi-factor authentication on business systems
- Secure disposal of paper and electronic records
- Supplier due diligence before personal data is shared
- Logging and review of access to sensitive records
Specific technical controls are kept under review and may change as our systems develop.
Personal data breaches
A personal data breach is any security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
We record all breaches. Where a breach is likely to result in a risk to people's rights and freedoms we report it to the ICO without undue delay and within 72 hours of becoming aware. Where the risk is high we also tell the individuals affected.
To report a suspected breach involving our data, email info@komestaffing.co.uk with "Data breach" in the subject line.
Data protection impact assessments
We carry out a DPIA before processing that is likely to result in a high risk — for example large-scale processing of special category data, or introducing a new system that profiles candidates. Where a DPIA identifies a high residual risk we consult the ICO before proceeding.
Working with client organisations
Before sharing worker data with a client we satisfy ourselves that there is a lawful basis and a genuine need, and that the sharing is proportionate. Where appropriate we put a data sharing agreement in place setting out what is shared, why, and on what terms.
Procurement or DPIA questions?
We can provide policy documents, processor terms and security information to support supplier onboarding.
Prefer to talk? Call 020 8075 5966
