DataPrivacy

This policy applies to all GBS employees, associates, contractors and others who use, manage or support GBS information or computing services. It covers personal and corporate information in all forms, including paper, electronic, printed, audio and video records, and all person-identifiable records.

GBS will hold only the personal information necessary to perform its functions and will handle it securely and lawfully. GDPR applies to the obtaining, holding, using and disclosing of personal information, including computerised and manual records.

GBS is registered under the Data Protection Act (registration number Z1317587) and complies with GDPR under policy PLPOL025.

GBS will maintain a security culture through training and awareness and will follow applicable UK and European security and data protection requirements. The framework is based on four principles:

• Authority - people are authorised to act within defined limits

• Accountability - people are responsible for their actions

• Assurance - required controls and actions are implemented and monitored

• Awareness - people understand the actions and responsibilities required of them

Its objectives are to ensure that:

• All Information Technology (IT) systems used in GBS are properly assessed to ensure that corporate procedures, responsibilities and IT security objectives, in particular the legal requirements, are fully met

• Appropriate levels of security are in place to maintain the confidentiality, integrity and availability of information and information systems; and

• All employees are aware of the limits of their authority and the levels of their accountability for their actions

All GBS IT systems must be assessed against corporate procedures, security objectives and legalrequirements. Security controls must be proportionate to risk and protect the confidentiality, integrity and availability of information and systems.

3.1 Authority

• IT systems and users must comply with this policy and applicable legal requirements

• GBS will maintain an organised security structure for approving, discussing and monitoring IT security matters

• Access must be authorised, authenticated and limited to information and processes required for the user's role (need-to-know)

• Only authorised and authenticated personnel may make changes affecting information integrity

• Controls must restrict access to approved terminals, workstations, laptops and handheld devices

• External network and dial-up access must receive additional security controls because of increased vulnerability

• IT equipment and media must be protected from physical loss or damage

• Authority to use GBS systems must be appropriate to each person's role and responsibilities

3.2 Accountability

• Those approving or procuring IT systems must ensure specifications meet their intended purpose

• Developers must ensure systems perform as specified, comply with requirements and include appropriate security

• IT operators must protect systems against security risks

• Shared systems must provide each user with a unique, verifiable identity

• Interactions with external shared systems must be recorded and monitored

• Compliance with this policy will be enforced through staff disciplinary procedures or contractual arrangements for third parties

3.3 Assurance

• Security controls will reflect system risk, business criticality and management priority

• Procedures and good-practice guidance will be maintained to support the required controls

• Appropriate contingency and recovery arrangements will be established for IT systems where required

• Contingency plans will be maintained and tested regularly

• IT security breaches and other security incidents must be recorded, investigated and initially reported to the Group Managing Director

3.4 Awareness

• All staff with IT access must understand this policy and relevant standards and procedures

• Staff must receive appropriate training for their security responsibilities and correct use of IT

systems

• All staff must sign the GBS Confidentiality Statement

• Third parties requiring IT access must be made aware of and comply with the relevant

requirements

4. Keeping Personal Information Secure

• Use secure passwords, change them regularly and never share them

• Lock or log off computers when away from the desk

• Shred confidential paper waste securely

• Take care with emails, attachments and unfamiliar websites to reduce malware and virus risks

• Use a clear-desk approach and securely store hard-copy personal information when not in use

• Visitors must sign in/out or be accompanied in staff-only areas

• Position screens to prevent unauthorised viewing or accidental disclosure

• Encrypt personal information taken outside the office where loss or theft could cause harm or distress

• Maintain appropriate backups of information

5. Personal Information and Customer/Employee Expectations

• Collect only the personal information needed for a specific business purpose

• Explain new or changed purposes to customers and employees and obtain consent or provide an opt-out where appropriate

• Keep records accurate and update them promptly, including addresses and marketing preferences

• Delete personal information when it is no longer required

• Do not disclose customer or employee records without appropriate consent or other lawful basis

• Make people aware of any workplace monitoring that may operate

6. Telephone Disclosure of Personal Information

• Be alert to attempts to obtain personal information by deception

• Verify identity before disclosing personal information on incoming calls

• Apply appropriate identity checks on outgoing calls

• Disclose only the minimum information necessary and confirm in writing where appropriate

7. GDPR Notifications

• Maintain the organisation's ICO notification/registration position or applicable exemption

• Monitor changes in how personal information is used and notify the ICO where required

8. Subject Access Requests

• Individuals have the right to request a copy of their personal information

• Staff must recognise a Subject Access Request (SAR) and know where to refer it

• Requests must be handled within the applicable statutory timeframe and any permitted fee limits

• Verify the requester's identity

• Check for third-party information before releasing a response and take appropriate action

9. Addendum

Please note that GBS Corporate Training is:

• Cyber Essentials certified (Certificate Number: 6181078)

• Registered with the ICO (Registration Number: Z1317587)

• Certified with ISO 9001:2015 (Certificate Number: GB92/1127)