GDPR Policy Statement

Compliance Chain is committed to compliance with all relevant EU and Member State laws in respect of personal data, and the protection of the “rights and freedoms” of individuals whose Compliance Chain collects and processes in accordance with the General Data Protection Regulation (GDPR). 

Compliance with the GDPR is described by this policy, the Personal Information Management System (PIMS) Manual and associated documentation such as the Information Security Policy.

This policy applies to all Employees, Staff and interested parties of Compliance Chain such as External Providers. Any breach of the GDPR PIMS will be dealt with under our disciplinary policy and may also be a criminal offence, in which case the matter will be reported as soon as possible to the appropriate authorities. 

Partners and External Providers working with or for Compliance Chain, and who have or may have access to personal data, will be expected to have read, understood and to comply with this policy. No third party may access personal data held by the Company without having first entered into a data confidentiality agreement, which imposes on the third-party obligations no less onerous than those which Compliance Chain is committed, and which gives Compliance Chain the right to audit compliance with the agreement.

Anyone processing personal data must comply with these 6 Principles of Good Practice. These principles are legally enforceable. To this end, I fully endorse and ensure that my Company will adhere to the 6 Principles of Data Protection, as set out within the General Data Protection Act 2019. Summarised, the principles require that personal data shall be:

1. Processed lawfully, fairly and in a transparent manner in relation to individuals 
2. Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes; 
3. Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed; 
4. Accurate and where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay; 
5. Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals;
6. Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures. accordance with the rights of data subjects under the Act

The GDPA provides conditions for the processing of any personal data. It also makes a distinction between personal data and ‘special category’ data. 

Personal data is defined as any information relating to an identified or identifiable natural person. Special category data is defined as personal data consisting of information as to:

• Racial or ethnic origin 
• Political opinion
• Religious/philosophical beliefs 
• Trade union membership 
• Physical or mental health or condition 
• Sexual life or sexual orientation
• Biometric data

Therefore, I will ensure that Compliance Chain will, through appropriate management and strict application of criteria and controls that include: 

• Use personal data in the most efficient and effective way to deliver a better service 
• Strive to collect and process only the data or information which is needed 
• Use personal data for such purposes as are described at the point of collection, or for purposes which are legally permitted 
• Strive to ensure information is accurate 
• Not keep information for longer than is necessary 
• Securely destroy data which is no longer needed 
• Take appropriate technical and organisational security measures to safeguard information (including unauthorised or unlawful processing and accidental loss or damage of data) 
• Ensure that information is not transferred abroad without suitable safeguards 
• Ensure that there is general information made available to the public of their rights to access information 
• Ensure that the rights of people about whom information is held can be fully exercised under the General Data Protection Regulation
• These rights include:
• The right to be informed
• The right of access to personal information
• The right to request rectification
• The right to request erasure 
• The right to restrict processing in certain circumstances 
• The right to data portability
• The right to object to processing 

The Company is not:

1. A Public Authority
2. An Organisation that engages in large scale systematic Monitoring
3. An Organisation that engages in large scale processing of Sensitive Personal Data

Therefore, there is no requirement to appoint a Data Protection Officer notwithstanding that I will appoint an individual at the appropriate senior level with specific responsibility for data protection.