Personal data may not be transmitted over a wireless network if there is a reasonable wired alternative; Where personal data is to be transferred in hardcopy form, it should be passed directly to the recipient or sent using a signed-for delivery service; All personal data transferred physically should be transferred in a suitable container marked “confidential”; All hardcopies of personal data, along with any electronic copies stored on physical media should be stored securely; No personal data may be transferred to any employees, agents, contractors, or other parties, whether such parties are working on behalf of the Company or not, without authorisation; Personal data must be handled with care at all times and should not be left unattended or on view; Computers used to view personal data must always be locked before being left unattended; No personal data should be stored on any mobile device, whether such device belongs to the Company or otherwise, without the formal written approval of <<insert position>> and then strictly in accordance with all instructions and limitations described at the time the approval is given, and for no longer than is absolutely necessary]; No personal data should be transferred to any device personally belonging to an employee and personal data may only be transferred to devices belonging to agents, contractors, or other parties working on behalf of the Company where the party in question has agreed to comply fully with the Data Protection Policy and the Company’s GDPR; All personal data stored electronically should be backed up with backups stored TBD. All backups should be encrypted; All passwords used to protect personal data should be changed regularly and should must be secure; Under no circumstances should any passwords be written down or shared. If a password is forgotten, it must be reset using the applicable method. IT staff do not have access to passwords; All software should be kept up-to-date. Security-related updates should be installed [not more than <<insert period>>] OR [as soon as reasonably possible after] becoming available; No software may be installed on any Company-owned computer or device without approval; and Where personal data held by the Company is used for marketing purposes, it shall be the responsibility of <<insert position>> to ensure that the appropriate consent is
Personal data may not be transmitted over a wireless network if there is a reasonable wired alternative; Where personal data is to be transferred in hardcopy form, it should be passed directly to the recipient or sent using a signed-for delivery service; All personal data transferred physically should be transferred in a suitable container marked “confidential”; All hardcopies of personal data, along with any electronic copies stored on physical media should be stored securely; No personal data may be transferred to any employees, agents, contractors, or other parties, whether such parties are working on behalf of the Company or not, without authorisation; Personal data must be handled with care at all times and should not be left unattended or on view; Computers used to view personal data must always be locked before being left unattended; No personal data should be stored on any mobile device, whether such device belongs to the Company or otherwise, without the formal written approval of <<insert position>> and then strictly in accordance with all instructions and limitations described at the time the approval is given, and for no longer than is absolutely necessary]; No personal data should be transferred to any device personally belonging to an employee and personal data may only be transferred to devices belonging to agents, contractors, or other parties working on behalf of the Company where the party in question has agreed to comply fully with the Company’s Data Protection Policy and the GDPR; All personal data stored electronically should be backed up with backups stored TBD. All backups should be encrypted; All passwords used to protect personal data should be changed regularly and should must be secure; Under no circumstances should any passwords be written down or shared. If a password is forgotten, it must be reset using the applicable method. IT staff do not have access to passwords; All software should be kept up-to-date. Security-related updates should be installed [not more than <<insert period>>] OR [as soon as reasonably possible after] becoming available; No software may be installed on any Company-owned computer or device without approval; and Where personal data held by the Company is used for marketing purposes, it shall be the responsibility of <<insert position>> to ensure that the appropriate consent is
pol03_data_protection_policy.docx