Data Protection Policy

Download the signed policy (PDF)

Octaga Security Services Ltd. Data Protection Policy: UK General Data Protection Regulation (GDPR) and Data Protection Act 2018 (DPA 2018).

Key risks

• Information becomes available to unauthorised individuals as a result of inadequate security measures or inappropriate disclosure of information.
• Individuals being evaluated by relevant bodies, governments, or organisations in a negative manner, as a direct result of the data stored by Octaga Security Services being inaccurate or insufficient.
• Fines, regulatory action, or reputational damage arising from non-compliance with GDPR or DPA 2018.

Purpose of policy

It is our company policy to ensure our compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 which replaces the Data Protection Act 1998. This policy applies to all personal data processed by Octaga Security Services Ltd, including employee, client, supplier, and contractor data. We commit to ensuring compliance throughout our business activities by following good practice, protecting the organisation and all interested parties whose data we hold for the purpose of conducting business.

Octaga Security Services Ltd takes the protection of data seriously and provides training and support for employees that handle any type of personal data. We undertake to ensure our employees respect individuals’ rights and perform their tasks with strict adherence to our company’s ethics, whilst ensuring our compliance with the UK GDPR and Data Protection Act 2018.

Personal data held for individuals will not be issued to any third parties by Octaga Security Services Ltd without lawful basis. Where sharing is required to fulfil contractual or legal obligations, it will only be done under one of the lawful bases in Article 6 of UK GDPR, and with appropriate safeguards, including Data Processing Agreements where required.

Octaga Security Services Ltd ensures that data stored on the company server can only be accessed by internal authorised employees on a need-to-know basis and that appropriate technical and organisational security measures are in place. Our company recognises the importance of correct storage of data and will also provide training and support for staff regarding the correct way to archive and / or destroy data.

Responsibilities

Trustee: Tracey Allison, Director.

Group Compliance Manager. Their responsibilities include:

• Briefing the board on Data Protection and GDPR responsibilities.
• Reviewing Data Protection and related policies frequently.
• Advising other staff on relevant Data Protection issues.
• Ensuring that Data Protection induction and ongoing training takes place.
• Ensuring that the Information Commissioner form is completed annually and the required fee is paid.
• Handling subject access requests.
• Approving unusual or controversial disclosures of personal data if such extreme action is required in order for the Company to be working in an ethical, lawful manner.
• Approving contracts with Data Processors to ensure that they include a declaration that safeguards our client and employee’s personal data.

Fair processing conditions

Octaga Security Services Ltd recognises that the Information Commissioner’s Office (ICO), UK GDPR and The Data Protection Act 2018 require that we process and store personal data in accordance with the principles set out in Article 5 of UK GDPR.

The main stipulations of this are that the data we hold is:

• Processed lawfully, fairly and in a transparent manner in relation to the data subject.
• Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
• Adequate, relevant and limited to what is necessary. (Any data that are not correct and true will be updated and / or erased from records both physical and electronic.)
• Kept in a form which permits identification of data subjects for no longer than is necessary.
• Processed in a manner that ensures appropriate security of personal data.

Employees are required to comply with this policy at all times, and breaches may result in disciplinary action.

We reserve the right to amend this policy at any time.

Document QD20 · Policy issued 21 January 2026 · Approved by TA