Last updated: 1 October 2025

1. Purpose

This policy sets out how Cyan Care Recruitment Ltd complies with the UK GDPR and the Data Protection Act 2018.

2. Principles

We process data lawfully, fairly, and transparently. Data is collected for specific purposes, kept accurate, stored securely, and retained only as long as necessary.

3. Roles

• Directors: overall compliance responsibility
• Data Protection Officer: daily oversight
• All staff: follow procedures and report breaches

4. Security Measures

• Password and access controls
• Encryption and secure backups
• Staff training on data protection
• Confidentiality agreements for staff

5. Data Breaches

Breaches are logged, investigated, and reported to the ICO within 72 hours where required. Individuals are informed if risks are high.

6. International Transfers

Where data is transferred outside the UK, appropriate safeguards are applied.

7. Review

This policy is reviewed annually to ensure ongoing compliance.