Linkedin-in Youtube X-twitter
ABCOM IT Solutions logo
Book a free IT review

Data Protection and Data Security Policy

Last reviewed: 1 October 2026

Statement and purpose of policy

Albion Business Computers Ltd, trading as ABCOM IT Solutions (company number 03474597) (the “Company”), is committed to ensuring that all personal data handled by us is processed in line with legally compliant standards of data protection and data security.

For the purposes of the data protection laws, the Company is a data controller of the personal data we hold in connection with your employment or engagement. This means that we determine the purposes for which, and the manner in which, your personal data is processed. Where we process personal data on behalf of our clients, we act as their data processor, as explained in our Terms and Conditions.

The purpose of this policy is to help us achieve our data protection and data security aims by:

  • notifying our staff of the types of personal data that we may hold about them, our customers, suppliers and other third parties, and what we do with that information;
  • setting out the rules on data protection and the legal conditions that must be satisfied when we collect, receive, handle, process, transfer and store personal data, and ensuring staff understand our rules and the legal standards; and
  • clarifying the responsibilities and duties of staff in respect of data protection and data security.

This is a statement of policy only and does not form part of your contract of employment. We may amend this policy at any time.

For the purposes of this policy:

  • Criminal records data means information about an individual’s criminal convictions and offences, and information relating to criminal allegations and proceedings.
  • Data protection laws means all laws applicable in the United Kingdom relating to the processing of personal data, including the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and the Data (Use and Access) Act 2025, each as amended from time to time.
  • Data subject means the individual to whom the personal data relates.
  • Personal data means any information that relates to an individual who can be identified from that information.
  • Processing means any use that is made of data, including collecting, storing, amending, disclosing or destroying it.
  • Special categories of personal data means information about an individual’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health, sex life or sexual orientation.
  • Compliance Team means the people responsible for data protection at the Company, who can be contacted at compliance@abcom.co.uk.

Data protection principles

1. Staff whose work involves using personal data relating to staff or others must comply with this policy and with the following data protection principles, which require that personal data is:

  • processed lawfully, fairly and in a transparent manner. We must always have a lawful basis to process personal data, as set out in the data protection laws. Personal data may be processed as necessary to perform a contract with the data subject, to comply with a legal obligation, with the data subject’s consent, or for the legitimate interests of the Company or the party to whom the data is disclosed. The data subject must be told who controls the information (us), the purposes for which we are processing it and to whom it may be disclosed;
  • collected only for specified, explicit and legitimate purposes. Personal data must not be collected for one purpose and then used for another. If we want to change the way we use personal data, we must first tell the data subject;
  • processed only where it is adequate, relevant and limited to what is necessary for the purposes of processing. We will only collect personal data to the extent required for the specific purpose notified to the data subject;
  • accurate, and kept up to date where necessary. We take all reasonable steps to ensure that inaccurate information is rectified or deleted without delay. Checks will be made when data is collected and regular checks afterwards;
  • kept only for the period necessary for processing. Information will not be kept longer than it is needed and we will take all reasonable steps to delete information when we no longer need it. For guidance on how long particular information should be kept, contact the Compliance Team or ask for a copy of our data retention policy; and
  • processed securely, using appropriate technical and organisational measures to protect against unauthorised or unlawful processing and against accidental loss, destruction or damage.

The Company is responsible for, and must be able to demonstrate compliance with, these principles.

Who is responsible for data protection and data security

2. Maintaining appropriate standards of data protection and data security is a collective task shared between us and you. This policy and the rules in it apply to all staff of the Company, irrespective of seniority, tenure and working hours, including all employees, directors and officers, consultants and contractors, casual or agency staff, trainees, homeworkers, fixed-term staff and volunteers (“Staff”).

3. Questions about this policy, or requests for further information, should be directed to the Compliance Team at compliance@abcom.co.uk.

4. All Staff have personal responsibility to comply with this policy, to handle personal data consistently with the principles set out here and to make sure measures are taken to protect data security. Managers have special responsibility for leading by example and for monitoring and enforcing compliance. The Compliance Team must be told as soon as reasonably practicable if this policy has not been followed, or if it is suspected that it has not been followed.

5. Any breach of this policy will be taken seriously and may result in disciplinary action up to and including dismissal. Significant or deliberate breaches, such as accessing Staff or customer personal data without authorisation or a legitimate reason, may constitute gross misconduct and could lead to dismissal without notice.

What personal data and activities are covered by this policy

6. This policy covers personal data:

  • which relates to a living individual who can be identified either from that information in isolation or by reading it together with other information we hold;
  • which is stored electronically or on paper in a filing system;
  • including statements of opinion as well as facts;
  • which relates to Staff (present, past or future) or to any other individual whose personal data we handle or control; and
  • which we obtain, hold or store, organise, disclose or transfer, amend, retrieve, use, handle, process, transport or destroy.

7. This personal data is subject to the legal safeguards set out in the data protection laws.

What personal data do we process about Staff?

8. We collect personal data about you which:

  • you provide, or we gather, before or during your employment or engagement with us;
  • is provided by third parties, such as references or information from suppliers or other parties we do business with; or
  • is in the public domain.

9. The types of personal data we may collect, store and use about you include records relating to your:

  • home address, contact details and next of kin contact details;
  • recruitment, including your application form or CV, references received and details of your qualifications;
  • pay records, National Insurance number and details of taxes and employment benefits such as pension and health insurance (including details of any claims made);
  • use of telephone, email, internet, messaging and collaboration tools, and the devices, applications and AI tools we provide;
  • work location and attendance, and your photograph where used for identification; and
  • performance, and any disciplinary matters, grievances, complaints or concerns in which you are involved.

Sensitive personal data

10. We may from time to time need to process special categories of personal data (sometimes called “sensitive personal information”).

11. We will only process sensitive personal information if we have a lawful basis for doing so (for example, because it is necessary for the performance of the employment contract), and one of the following special conditions applies:

  • the data subject has given explicit consent;
  • the processing is necessary to exercise employment law rights or obligations of the Company or the data subject;
  • the processing is necessary to protect the data subject’s vital interests and the data subject is physically incapable of giving consent;
  • the processing relates to personal data which the data subject has manifestly made public;
  • the processing is necessary for the establishment, exercise or defence of legal claims; or
  • the processing is necessary for reasons of substantial public interest.

12. Before processing any sensitive personal information, Staff must notify the Compliance Team of the proposed processing so that it can assess whether the processing meets the criteria above.

13. Sensitive personal information will not be processed until that assessment has taken place and the individual has been properly informed of the nature of the processing, the purposes for which it is being carried out and the legal basis for it.

14. Our privacy notice for Staff sets out the types of sensitive personal information we process, what it is used for and the lawful basis for the processing.

Criminal records information

15. Criminal records information will be processed in accordance with our Criminal Records Information Policy.

How we use your personal data

16. We will tell you the reasons for processing your personal data, how we use it and the legal basis for processing in our privacy notice. We will not process Staff personal data for any other reason.

17. In general we will use information to carry out our business, to administer your employment or engagement and to deal with any problems or concerns you may have, including, but not limited to:

  • Staff address lists: to compile and circulate lists of home address and contact details, and to contact you outside working hours where necessary.
  • Sickness records: to maintain a record of your sickness absence and copies of any doctor’s notes or other documents you supply about your health, to inform colleagues and others that you are absent through sickness as reasonably necessary to manage your absence, to deal with unacceptably high or suspicious sickness absence, to inform reviewers for appraisal purposes of your sickness absence level, and to publish internally aggregated, anonymous details of sickness absence levels.
  • Monitoring IT systems: to monitor your use of email, internet, telephone, messaging, collaboration tools, computers and other communications or IT resources, including security, filtering and device management tools, in line with our IT and acceptable use policies.
  • Disciplinary, grievance or legal matters: in connection with any disciplinary, grievance, legal, regulatory or compliance matters or proceedings that may involve you.
  • Performance reviews: to carry out performance reviews.
  • Equal opportunities monitoring: to conduct monitoring for equal opportunities purposes and to publish anonymised, aggregated information about the breakdown of the Company’s workforce.

We may also use your personal data for other purposes that are set out in our privacy notice for Staff.

Accuracy and relevance

18. We will:

  • ensure that any personal data processed is up to date, accurate, adequate and relevant, and not excessive given the purpose for which it was collected; and
  • not process personal data obtained for one purpose for any other purpose, unless you agree to this or reasonably expect it.

19. If you consider that any information held about you is inaccurate or out of date, you should tell the Compliance Team. If they agree that the information is inaccurate or out of date, they will correct it promptly. If they do not agree with the correction, they will note your comments.

Storage and retention

20. Personal data (and sensitive personal information) will be kept securely in accordance with our Information Security Policy.

21. The periods for which we hold personal data are set out in our privacy notices.

Individual rights

22. You have the following rights in relation to your personal data.

23. Subject access requests. You have the right to make a subject access request. If you do, we will tell you:

  • whether or not your personal data is processed and, if so, why, the categories of personal data concerned and the source of the data if it is not collected from you;
  • to whom your personal data is or may be disclosed, including recipients outside the United Kingdom and the safeguards that apply to such transfers;
  • for how long your personal data is stored (or how that period is decided);
  • your rights of rectification or erasure, and your rights to restrict or object to processing;
  • your right to complain to us and to the Information Commissioner’s Office if you think we have failed to comply with your data protection rights; and
  • whether or not we carry out automated decision-making, and the logic involved in any such decision-making.

We will provide you with a copy of the personal data undergoing processing. This will normally be in electronic form if you made the request electronically, unless you agree otherwise.

To make a subject access request, contact us at compliance@abcom.co.uk. We may need to ask for proof of identification, or for clarification of what you are asking for, before your request can be processed. We will let you know if we need this. The time limit for responding is paused while we wait for your reply.

We will normally respond within one month of receiving your request. If your request is complex or you have made a number of requests, we may extend this by up to a further two months, and we will tell you within the first month if we do. We carry out reasonable and proportionate searches for the information you have asked for. If your request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act on it.

24. Other rights. You also have the right to ask us to:

  • rectify inaccurate data;
  • stop processing or erase data that is no longer necessary for the purposes of processing;
  • stop processing or erase data if your interests override our legitimate grounds for processing the data (where we rely on legitimate interests as the reason for processing);
  • stop processing data for a period if the data is inaccurate or if there is a dispute about whether your interests override the Company’s legitimate grounds for processing; and
  • provide your data in a portable format, where the right applies.

To make any of these requests, please email compliance@abcom.co.uk.

25. Complaints. If you are unhappy with how we have handled your personal data, you can complain to us at compliance@abcom.co.uk. We will acknowledge your complaint within 30 days, investigate it without undue delay, keep you informed of progress and tell you the outcome. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).

Data security

26. We will use appropriate technical and organisational measures to keep personal data secure, and in particular to protect against unauthorised or unlawful processing and against accidental loss, destruction or damage.

27. Maintaining data security means making sure that:

  • only people who are authorised to use the information can access it;
  • where possible, personal data is pseudonymised or encrypted;
  • information is accurate and suitable for the purpose for which it is processed; and
  • authorised people can access information when they need it for authorised purposes.

28. By law, we must use procedures and technology to secure personal data throughout the period that we hold or control it, from obtaining to destroying the information.

29. Personal data must not be transferred to any person to process on our behalf (for example while performing services for us) unless that person has agreed to comply with our data security procedures or we are satisfied that other adequate measures exist, including a written contract that meets the requirements of the data protection laws.

30. Security procedures include:

  • any desk or cupboard containing confidential information must be kept locked;
  • computers must be locked with a strong password and multi-factor authentication where available, and locked or shut down when left unattended, and discretion must be used when viewing personal data on a screen so that it is not visible to others;
  • removable media such as USB drives must be encrypted or password protected and locked away securely when not in use, and must only be used where authorised;
  • the Compliance Team must approve any cloud service used to store data;
  • personal data must never be saved directly to personal devices, and company laptops, tablets and smartphones must be encrypted and managed;
  • all servers containing sensitive personal data must be approved and protected by security software, and kept in a secure location away from general office space; and
  • data must be regularly backed up in line with the Company’s back-up procedure.

31. Telephone precautions. Particular care must be taken by Staff who deal with telephone enquiries to avoid inappropriate disclosure of information. In particular:

  • the identity of any caller must be verified before any personal data is disclosed;
  • if the caller’s identity cannot be verified satisfactorily, they should be asked to put their query in writing;
  • do not allow callers to pressure you into disclosing information; and
  • in case of any problem or uncertainty, contact the Compliance Team.

32. Methods of disposal. Copies of personal data, whether on paper or on any physical storage device, must be physically destroyed when they are no longer needed. Paper documents should be shredded, and storage devices must be securely erased or rendered permanently unreadable.

33. Use of artificial intelligence (AI) tools. Staff must only use AI tools that the Company has approved. Do not enter personal data, client data, credentials or confidential business information into any unapproved or consumer AI tool, browser extension or AI meeting notetaker. Check AI output for accuracy before relying on it or sharing it, and tell the Compliance Team if you think personal data has been entered into an AI tool by mistake. No-one will be penalised for reporting a mistake promptly and in good faith.

34. Additional measures to ensure data security are set out in our IT and acceptable use policies and in your employment contract.

Data protection impact assessments

35. Some of the processing that the Company carries out may result in risks to privacy.

36. Where processing would result in a high risk to the rights and freedoms of individuals, the Company will carry out a data protection impact assessment to determine the necessity and proportionality of the processing. This will include considering the purposes for which the activity is carried out, the risks for individuals and the measures that can be put in place to mitigate those risks.

Data breaches

37. Any suspected or actual personal data breach, including loss of a device, a misdirected email, unauthorised access, or data entered into an unapproved tool, must be reported to the Compliance Team immediately.

38. If we discover that there has been a breach of personal data that poses a risk to the rights and freedoms of individuals, we will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it. Where we are acting as a processor for a client, we will notify the client without undue delay.

39. We will record all data breaches regardless of their effect, in accordance with our breach response policy.

40. If the breach is likely to result in a high risk to your rights and freedoms, we will tell affected individuals that there has been a breach and give them more information about its likely consequences and the mitigation measures we have taken.

International data transfers

41. In the course of carrying out our business, we may need to transfer personal data to a country outside the United Kingdom, including to a group company or to another person with whom we have a business relationship.

42. Personal data will only be transferred outside the United Kingdom if there are adequate protections in place, such as UK adequacy regulations, the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. We have put in place appropriate procedures with the third parties we share personal data with, to ensure it is treated in a way that is consistent with, and respects, the law on data protection.

43. If you wish to know more about international transfers of your personal data, you may contact the Compliance Team.

Individual responsibilities

44. Staff are responsible for helping the Company keep their personal data up to date.

45. Staff should let the Company know if the personal data they have provided changes, for example if you move house or change your bank details.

46. You may have access to the personal data of other Staff and of our customers in the course of your employment. Where this is the case, the Company relies on Staff to help meet its data protection obligations to Staff and to customers.

47. Individuals who have access to personal data are required:

  • to access only personal data that they have authority to access, and only for authorised purposes;
  • not to disclose personal data except to individuals (inside or outside the Company) who have appropriate authorisation;
  • to keep personal data secure, for example by complying with rules on access to premises, computer access (including password protection and multi-factor authentication) and secure file storage and destruction;
  • not to remove personal data, or devices containing or that can be used to access personal data, from the Company’s premises without adopting appropriate security measures (such as encryption or password protection) to secure the data and the device; and
  • not to store personal data on local drives or on personal devices that are used for work purposes.

Training

48. We will provide training to all individuals about their data protection responsibilities as part of the induction process and at regular intervals afterwards.

49. Individuals whose roles require regular access to personal data, or who are responsible for implementing this policy or responding to subject access requests under it, will receive additional training to help them understand their duties and how to comply with them.

Contact

For any question about this policy, to make a request, or to raise a concern, email compliance@abcom.co.uk or telephone 01444 871200.