UK GDPR & Data Protection Policy

1. Policy statement

JN Compliance & Safety Solutions Ltd is committed to protecting all personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We collect only the minimum data required, process it lawfully and fairly, and store it securely using appropriate technical and organisational measures. We ensure transparency, accuracy, confidentiality and accountability in all data-handling activities.

2. Scope, purpose & privacy

This policy applies to all personal data processed by JN Compliance & Safety Solutions Ltd, including clients and landlords, tenants (where compliance services require access to tenancy information), employees and subcontractors, suppliers and business contacts, training learners, and website and social media users.

The purpose of this policy is to ensure that all personal data is handled in a way that protects privacy and meets legal requirements.

3. Responsibilities

Director: ensures overall compliance with UK GDPR and approves policies, procedures and annual reviews.

Compliance Manager / Data Lead: manages data storage, access, retention and disposal; maintains Records of Processing Activities (ROPA); oversees breach reporting and investigation; and ensures privacy notices and consent processes are accurate and up to date.

Employees and subcontractors: follow all data protection procedures and training, handle personal data responsibly, and report suspected breaches immediately.

4. UK GDPR principles

JN Compliance & Safety Solutions Ltd follows the seven principles of UK GDPR:

• Lawfulness, fairness and transparency
• Purpose limitation
• Data minimisation
• Accuracy
• Storage limitation
• Integrity and confidentiality
• Accountability

5. Security & confidentiality

We protect personal data using a combination of technical and organisational measures, including encrypted digital storage, password-protected systems, secure cloud platforms, restricted access for authorised personnel only, locked physical storage where applicable, and regular security reviews and updates.

These measures ensure data is protected from unauthorised access, accidental loss or damage.

6. Data classification

We classify data to ensure it is handled appropriately:

• Personal data – names, contact details, property information.
• Special category data – processed only when necessary (e.g. health information for risk assessments).
• Confidential business data – compliance reports, contractor information, internal documentation.

7. Identity & access control

Access to personal data is restricted based on job role and necessity. Controls include unique user accounts, strong password requirements, two-factor authentication where available, access logs and monitoring, and immediate removal of access when staff leave the business.

8. Compliance requirements

We comply with all relevant legislation, including UK GDPR, the Data Protection Act 2018, ICO guidance and industry-specific compliance requirements such as landlord safety documentation and contractor records.

We maintain documentation to demonstrate compliance, including training records, breach logs and ROPA.

9. Staff training

All staff receive training covering password security procedures, secure browsing habits, workplace social media policy, environmental controls (verifying contractors, avoiding shoulder-surfing, logging out of systems), data management and privacy, data classification and confidentiality levels, and legal responsibilities under UK GDPR.

Training is refreshed annually or when legislation changes.

10. Data collection

We only collect data necessary for delivering compliance services, such as client and landlord contact details, property information, compliance documentation, and tenant details where required for safety checks. Data is collected lawfully, fairly and transparently.

11. Data storage & retention

Data is stored securely using encrypted systems and secure cloud platforms. Retention periods are based on legal requirements, contractual obligations and business needs. Data is deleted or anonymised when no longer required.

12. Data sharing

We may share data with accredited assessors, certification bodies, legal authorities if required, and subcontractors working under confidentiality agreements. We never sell personal data.

13. Privacy notice

Our privacy notice, published on this website, includes company contact details, the lawful basis for processing, the types of data collected, how data is used, who data is shared with, retention periods, the rights of individuals, the complaints process (ICO), and whether automated decision-making is used (currently none).

14. Subject access requests (SARs)

Individuals have the right to request access to their personal data. Requests will be acknowledged promptly, completed within 30 days, logged and recorded, and provided free of charge unless excessive or repetitive.

15. Children's data

JN Compliance & Safety Solutions Ltd does not routinely process children’s data. If this changes, parental consent will be required for anyone under 13, and additional safeguards will be implemented.

16. Data breach management

All suspected data breaches must be reported immediately. We follow a structured process: identify and contain the breach; assess risk and impact; notify affected individuals if required; report to the ICO where legally required; and record the incident and corrective actions.

17. Review & approval

This policy will be reviewed annually or sooner if legislation changes.

Approved by the Director, JN Compliance & Safety Solutions Ltd. Date: May 2026. Review: annual.