Data Protection and Confidentiality Policy
Scope
This policy covers the personal data RODMENA LIMITED handles as a controller for its own business and as a processor for its customers. We comply with UK GDPR and the Data Protection Act 2018. When we handle health and care data, we also apply the Caldicott Principles.
How we keep personal data safe
- We collect only the personal data a task needs.
- Only people whose work requires it get access, and we review that access when a role or engagement changes.
- Personal data is encrypted in transit. Laptops, phones and other portable devices use full-disk encryption.
- We keep personal data for as long as the purpose we collected it for needs, then delete it securely.
- Our Privacy Policy tells people what we do with their data.
New projects and changes
Before a project, system or change that involves personal data starts, we complete a screening check. If the check shows a likely high risk to individuals, we carry out a data protection impact assessment (DPIA) following the ICO's guidance before any processing begins. The Director approves each DPIA and keeps it on file.
Data protection rights
People can exercise their rights by emailing gdpr@rodmena.co.uk, and we reply within one month. Erasure requests can also go to rtbf@rodmena.co.uk.
Health and care data
When we process NHS or social care data, we apply the national data opt-out as the controller directs. We complete the NHS Data Security and Protection Toolkit every year, and the Trust Centre shows our current assessment.
Breaches
Anyone who suspects a breach or a near miss tells the Director at once and emails security@rodmena.co.uk. The Director contains it, keeps the logs and records what happened, which data and how many people were involved, and what was done. Every breach and near miss is recorded, whether or not it has to be reported.
As a controller, we notify the ICO within 72 hours of becoming aware of a breach that is likely to put people at risk, and we tell the people affected without undue delay when the risk to them is high. As a processor, we tell the controller without undue delay.
Confidentiality
Everyone who works for RODMENA keeps personal and customer information confidential while they work for us and after their engagement ends.
Devices
- Work devices use full-disk encryption and lock the screen automatically.
- A personal phone or computer may be used for RODMENA work only if it has a screen lock, current updates and full-disk encryption, and the company accounts on it use multi-factor authentication. Company data stays in the company's apps and is not copied to the device's own storage. The Director can sign the device out of company accounts at any time.
- A lost or stolen device is reported to the Director at once. The Director signs it out of company accounts, changes any password or key it held and decides whether the loss is a reportable breach.
- Before a device leaves the company, its storage is securely erased or its encryption key destroyed. The Director records the device, the date and the method in the asset register.
- Company work is not done over public or open Wi-Fi unless the traffic is protected, for example by a phone's own hotspot.
Responsibilities and review
The Director owns this policy and is the company's data security and protection lead. The policy is reviewed at least once a year and after any breach.
See also: Information Security Policy · Privacy Policy · Trust Centre.