UK GDPR & DPA 2018
Requirements under UK data protection law are considered from discovery onwards, not retrofitted before launch.
GDPR & security
Security, privacy & responsible development
The systems we build may process operational data, staff records, customer information and, in some cases, clinical information about patients. Health data is special category personal data under the UK GDPR and attracts additional obligations and safeguards.
We treat data protection as a design activity. Before development begins we establish what personal data a system will process, whether any of it falls into a special category, who acts as controller and who acts as processor, what lawful basis applies and how long records need to be retained. Those answers shape the build rather than being documented afterwards.
What we build in
From our Digital Solutions catalogue, applied to every project.
Privacy by design
Systems are designed to collect the minimum necessary and to make privacy the default position.
Security by design
Authentication, permissions and protective controls form part of the architecture rather than an add-on.
Data minimisation
Every field is justified. If a system does not need it, the system should not ask for it.
Access controls
Role-based permissions so users see what their role requires and no more.
Authentication
Secure sign-in, with multi-factor authentication available where the risk profile warrants it.
Auditability
Logging of significant access and change, supporting investigation and governance.
Encryption
Encryption in transit as standard, with appropriate controls applied to stored data.
Backups & continuity
Backup arrangements and business continuity considerations agreed as part of deployment.
Retention & deletion
Defined retention periods with a controlled route to deletion when they expire.
Secure hosting
Hosting options discussed openly, including data residency where that matters to you.
DPIAs where appropriate
Where processing is likely to be high risk, we will say so and recommend an assessment.
The data involved
What these systems may hold
Different solutions touch different kinds of information. Knowing which applies shapes the access rules, the retention periods and whether a DPIA is recommended.
- Staff recordsProfiles, qualifications, professional registrations, DBS information, training history, competencies and supporting documents.
- Clinical recordsPatient demographics, history, examination, observations, treatment, disposition and handover. Health information is special category data under UK GDPR.
- Client & booking informationEnquiries, quotations, confirmations, event documentation and invoicing for the organisations you serve.
- Operational logsTimestamped incidents, deployments, decisions and resource changes, which may need to stand as an evidential record.
- Fleet, equipment & stockVehicle checks, defects, servicing dates, batch numbers and expiry dates. Usually not personal data, but still attributable to the person who recorded it.
UK GDPR in brief
The seven principles
UK GDPR sets seven principles for handling personal data. This is how each one shows up in the systems we build.
- Lawful, fair & transparentEach use of personal data has a lawful basis that you identify, and people are told what happens to their information.
- Purpose limitationData collected for one purpose is not quietly reused for another.
- Data minimisationOnly what is needed. In our builds, every field is justified.
- AccuracyRecords can be corrected, with expiry warnings and prompts to keep details up to date.
- Storage limitationRetention periods are defined, so records are not kept indefinitely by default.
- Integrity & confidentialityRole-based access, secure authentication, encryption in transit and audit logging.
- AccountabilityBeing able to show how you comply: documented specifications, audit trails and exportable reports.
Through the project
Where it happens in the build
Data protection runs through the same six stages as the rest of the project. Each stage produces something you can see and agree before the next begins.
- DiscoveryWhat personal data is involved, whose it is and why it is needed. Whether a DPIA is recommended.
- SpecificationFields, users, roles and permissions agreed and documented, alongside retention and deletion arrangements.
- DesignDifferent interfaces for managers, clinicians, control staff, administrators and clients, so people see only what their role needs.
- DevelopmentAuthentication, encryption in transit and audit logging built in as the platform is built.
- TestingPermissions and workflows tested against the specification, including by the people who will use them.
- Deployment & supportHosting, backup and ongoing support arrangements agreed in advance and set out in writing.
Questions worth asking any supplier
Including us.
- Where will our data be hosted, and in which country?
- Who can access it, and how is that access recorded?
- How is it backed up, and how long is each record kept?
- What happens to our data if we stop using the system?
- Is multi-factor authentication available for our users?
- Do we need a Data Protection Impact Assessment for this?
- What does the written agreement say about each party's responsibilities?
- Are you claiming a certification, and can you show it?
This page describes our approach and is not legal advice. Final functionality, hosting, integrations and data protection arrangements are agreed during consultation and depend on the individual project specification. For guidance on your organisation's own obligations, see the Information Commissioner's Office.
Talk it through before you build.
Tell us what data your service handles and we will set out how a system would protect it.