Introduction and Purpose
This Data Protection Policy (the “Policy”) sets out the commitment of DBSG Academy Ltd to protecting the privacy and rights of individuals in relation to their personal data. This Policy details our approach to data protection and the legal conditions that must be satisfied when collecting, handling, processing, and storing personal data. This Policy applies to all staff, contractors, and agents of DBSG Academy Ltd.Scope
This Policy covers all personal data and special categories of personal data processed by DBSG Academy Ltd, regardless of where that data is held (e.g., electronic files, paper records, or other formats).Principles of Data Processing
DBSG Academy Ltd adheres to the following principles when processing personal data:- Lawfulness, Fairness, and Transparency Data must be processed lawfully, fairly, and in a transparent manner in relation to the data subject.
- Purpose Limitation Data must be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
- Data Minimisation Data must be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.
- Accuracy Data must be accurate and, where necessary, kept up to date. Every reasonable step must be taken to ensure that inaccurate personal data are erased or rectified without delay.
- Storage Limitation Data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
- Integrity and Confidentiality (Security) Data must be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures.
- Accountability DBSG Academy Ltd is responsible for, and must be able to demonstrate compliance with, the above principles.
Legal Basis for Processing
All personal data processing by DBSG Academy Ltd must have a lawful basis. This includes, but is not limited to:
- The data subject has given consent to the processing for one or more specific purposes.
- Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
- Processing is necessary for compliance with a legal obligation to which DBSG Academy Ltd is subject.
- Processing is necessary to protect the vital interests of the data subject or of another natural person.
- Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in DBSG Academy Ltd.
- Processing is necessary for the purposes of the legitimate interests pursued by DBSG Academy Ltd or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.
Data Subject Rights
Data subjects have the following rights concerning their personal data:| Right | Description |
|---|---|
| Right to be informed | Data subjects have the right to be informed about the collection and use of their personal data. |
| Right of access | The right to request a copy of the personal data held about them. |
| Right to rectification | The right to have inaccurate personal data corrected or completed. |
| Right to erasure | The right to request the deletion or removal of personal data where there is no compelling reason for its continued processing (also known as the “right to be forgotten”). |
| Right to restrict processing | The right to “block” or suppress the processing of personal data. |
| Right to data portability | The right to obtain and reuse their personal data for their own purposes across different services. |
| Right to object | The right to object to processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling), and direct marketing. |
| Rights related to automated decision-making | Rights in relation to automated decision-making and profiling, including the right not to be subject to a decision based solely on automated processing. |
Data Security and Confidentiality
DBSG Academy Ltd will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:- Encryption and pseudonymisation of personal data where appropriate.
- The ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services.
- The ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.
- A process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
Data Breach Reporting
In the event of a personal data breach (a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed), DBSG Academy Ltd will:- Immediately assess the severity and risks.
- Report the breach to the relevant supervisory authority within 72 hours of becoming aware of it, where required.
- Communicate the breach to the affected data subjects without undue delay, where required.
All suspected or actual data breaches must be reported immediately to the Data Protection Officer.
Training and Review
All employees handling personal data will receive mandatory data protection training. The Data Protection Officer will review this policy annually, or as necessary, to ensure ongoing compliance with legal and regulatory requirements.| Version | Review Date | Revision Date |
|---|---|---|
| 001 | 01/01/27 | — |