GDPR Policy

Document Governance & Control

Revision History

Policy Statement

Orizon Group Ltd is committed to protecting the rights and freedoms of all individuals whose personal data we process[cite: 7]. This Policy establishes our comprehensive framework for full compliance with the UK GDPR, Data Protection Act 2018 (DPA 2018), and PECR[cite: 8].

It applies strictly to all directors, staff, workers, contractors, and any third party processing personal data on our behalf, across all formats (electronic, physical, verbal, visual) and all operational locations (office, client sites, remote)[cite: 9].

1. Scope and Related Documents

This serves as Orizon’s master internal data protection governance document[cite: 13]. It sits directly alongside and links structurally to our core environment assets[cite: 13]:

2. The Seven Data Protection Principles

All processing systems must systematically comply with Article 5 of the UK GDPR[cite: 15]. Breach of these core principles can attract ICO fines of up to £17.5 million or 4% of annual global turnover[cite: 16].

NEVER process personal data without confirming the lawful basis first. If unsure, stop and consult the Data Protection Lead[cite: 29].

3. Lawful Bases for Processing

3.1 Consent Requirements

Consent must be completely freely given, specific, informed, unambiguous, unbundled, granular, and explicitly documented[cite: 33]. Pre-ticked checkboxes or terms bundled into standard contracts are invalid[cite: 33]. Consent must be as easy to withdraw as it was to grant[cite: 34].

In employment contexts, consent is rarely appropriate for mandatory processing due to the inherent power imbalance between employer and worker[cite: 35].

3.2 Legitimate Interests: Three-Part Test

Every legitimate interest processing structure requires a documented, step-by-step assessment covering[cite: 37]:

1. Purpose Test: Is the target interest lawful, real, and current? [cite: 37]
2. Necessity Test: Is the processing activity necessary, or is a less intrusive alternative viable? [cite: 38]
3. Balancing Test: Do the individual's overriding fundamental rights or freedoms override Orizon's interest? [cite: 39]

3.3 Special Category Data Controls

4. Roles and Responsibilities

4.3 Mandated Responsibilities for All Staff & Workers

All personnel processing data must adhere to the following configurations without exception[cite: 50, 51]:

• Only access datasets explicitly necessary for your defined business role (strictly no browsing or curiosity access)[cite: 52].
• Report any actual, suspected, or near-miss security breach to the Data Protection Lead within 4 hours[cite: 54].
• Lock device screens immediately when leaving your workstation; follow the clear desk policy[cite: 57].
• Never share protected data strings with unauthorised entities or transmit them via unapproved personal channels/devices[cite: 56].

5. Data Subject Rights & SAR Procedure

All individual rights requests received by any team member must be escalated to the Data Protection Lead immediately[cite: 61].

Subject Access Request (SAR) Standard Operating Procedure

1. Log incoming requests in the SAR Tracker on the exact day of receipt; the clock starts immediately[cite: 64].
2. Issue a formal acknowledgment within 2 working days[cite: 65].
3. Verify identity proportionately without constructing artificial administrative barriers[cite: 66].
4. Query all active architectures: core databases, corporate emails, cloud vaults, physical file boxes, CCTV files, and processor engines[cite: 67].
5. Collate documentation. Redact third-party identifying markers and review for specific statutory exemptions (e.g., legal privilege)[cite: 68].
6. Respond transparently within one calendar month providing clean copies alongside data purpose definitions and retention notices[cite: 69]. Document all search parameters for future ICO inspection[cite: 71].

6. Privacy by Design and DPIAs

Privacy by Design and Default (Article 25): Data protection workflows must be built directly into every new technology deployment, service project, or data vendor relationship from the outset[cite: 74]. Default environmental parameters must restrict processing to the bare minimum[cite: 75].

When a DPIA is Mandated (Article 35)

A detailed Data Protection Impact Assessment must be completed before starting[cite: 76]:

• Large-scale handling of special category elements (e.g., occupational health history, criminal records data)[cite: 77].
• Systematic monitoring systems (e.g., CCTV operations, workforce tracking, GPS logs)[cite: 78].
• Deployments introducing emerging or alternative technologies with novel risk matrices[cite: 79].
• Processing focusing on vulnerable cohorts (migrant workforces, young workers under 18)[cite: 80].

If a completed DPIA signals high residual risks that cannot be effectively mitigated, Orizon must consult the ICO before initiating the project[cite: 88].

7. Data Security (Article 32)

7.1 Technical Protections

• Encryption Protocols: Implementation of TLS 1.2+ for data in transit and AES-256 configurations at rest[cite: 92]. Full-disk encryption is mandatory across all portable hardware assets[cite: 92].
• Authentication controls: Multi-Factor Authentication (MFA) is strictly enforced on all platforms holding personal data records[cite: 93]. Passwords must be 12+ characters and rotated every 90 days[cite: 93].
• Access Management: Role-Based Access Control (RBAC) following least-privilege logic[cite: 94]. Access maps are audited quarterly and revoked immediately upon role shift or termination[cite: 94].
• Vulnerability Sweeps: Monthly infrastructure scans paired with annual penetration testing[cite: 96]. Critical security patches must be fully applied within 14 days of release[cite: 96].

7.2 Organisational Controls

• Workstation Rules: Clear Screen and Clear Desk policy enforcement[cite: 100]. Device screens must be locked when moving away; physical data must be locked in specialized secure cabinets[cite: 57, 100].
• Secure Destruction: Physical items must pass through certificated shredding systems matching DIN 66399 P-4+ rules[cite: 102]. Hard drive structures must achieve NCSC-standard sanitisation; certificates must be retained for 2 years[cite: 102, 153].

7.3 Remote Work Requirements

Processing data in public areas where displays are vulnerable to being overlooked is strictly prohibited[cite: 107]. Only Orizon-approved, encrypted computing equipment may link to company ecosystems via secure corporate VPN networks[cite: 104, 105]. No personal data may be stored on unencrypted personal hardware[cite: 106]. Any lost or stolen device must be formally reported within 1 hour[cite: 108].

8. Data Breach Management

ALL BREACHES MUST BE ESCALATED TO THE DATA PROTECTION LEAD WITHIN 4 HOURS[cite: 110].

Examples include emails sent to incorrect addresses, using CC instead of BCC for mass candidate updates, losing unencrypted documents, phishing incidents, or unauthorized verbal disclosures[cite: 112, 114, 115, 116].

Incident Response Routine

If the assessment flags a high risk to individuals, Orizon must notify the affected data subjects directly using clear, plain language outlining steps they can take to minimize harm[cite: 123, 125].

9 & 10. Data Processors and International Transfers

9.1 Due Diligence: Before executing service relationships with third-party data processors, Orizon must verify their security systems and check for ISO 27001 or Cyber Essentials validation[cite: 130].

9.2 Article 28 DPAs: A written Data Processing Agreement (DPA) must govern every processor interaction[cite: 132]. It must explicitly restrict sub-processing, require written destruction confirmations, and grant Orizon full inspection and audit rights[cite: 134, 135, 136].

10. International Transfers: Personal data must never leave the United Kingdom without verified safeguards[cite: 140]. This requires either a UK adequacy decision, an active International Data Transfer Agreement (IDTA), or an executed UK Addendum alongside EU Standard Contractual Clauses[cite: 141, 142]. A Transfer Risk Assessment (TRA) must be documented for each cross-border processing instance[cite: 145].

11 & 12. Records, Retention, and Disposal

11. ROPA Maintenance (Article 30): Orizon maintains an internal Record of Processing Activities tracking categorizations, target purposes, transfer tracking, and active retention cycles[cite: 148]. The ROPA must be updated quarterly[cite: 149].

12. Operational Disposal Framework: Following retention expiration, records must be completely expunged or anonymized within 30 days[cite: 152]. Electronic drives must undergo permanent erasure across all backup platforms, and decommissioned computing equipment must receive NCSC-standard data sanitisation[cite: 154, 155].

13. Training and Awareness Path

14, 15 & 16. CCTV, Marketing, and Complaints

14. CCTV Operations: Managed under legitimate interest frameworks for security and prevention of crime[cite: 166, 167]. Footage is automatically overwritten after 30 days[cite: 167].

15. Direct Marketing: Digital campaigns require explicit prior consent unless PECR soft opt-in exclusions are met[cite: 170]. Opt-out requests must be fully updated inside suppression tables within 28 days[cite: 172]. No purchased data databases may be used without verified consent validation records[cite: 174].

16. Complaints: Internal entries to privacy@orizongroup.co.uk must receive an acknowledgment within 5 working days, with a substantive response completed within 28 days[cite: 177]. Data subjects retain the right to escalate complaints to the ICO at any time[cite: 178].

17 & 18. Enforcement Matrix & Penalties

Criminal Liability Notice (s.170 DPA 2018): Knowingly or recklessly obtaining, disclosing, or retaining personal data without data controller consent constitutes a criminal offense subject to unlimited judicial fines [cite: 184].