Data protection policy
Issue 10 · March 2026 · Approved by Reza Najafi, Managing Director, 08/04/2026 · Next review 01/04/2027
Introduction
KEY HEALTH (Key Health Solutions) is committed to protecting the rights and freedoms of data subjects and ensuring that their personal data is processed safely, securely, and in accordance with all legal obligations under UK GDPR and the Data Protection Act 2018.
We hold personal data about our employees, clients, suppliers, and other individuals for a variety of business purposes.
This policy sets out how we protect personal data and ensures that all staff understand the rules governing the use of the personal data to which they have access during their work. Staff must consult the Data Protection Manager (DPM) before any significant new data-processing activity is initiated to ensure all compliance measures are addressed.
Definitions
Business purposes
Use of personal data for personnel, administrative, financial, regulatory, payroll, operational, and business development purposes. Examples include:
- Compliance with legal, regulatory, and corporate governance obligations
- Investigations by regulatory bodies or in connection with legal proceedings
- Ensuring adherence to company policies
- Operational needs such as recording transactions, training, quality control, and security vetting
- Handling complaints
- Reference checking, safe working practices, monitoring systems access, and managing absences
- Monitoring staff conduct and disciplinary processes
- Marketing KEY HEALTH services
- Improving services
Personal data
Any information relating to an identified or identifiable natural person. Includes phone numbers, email addresses, pay details, qualifications, marital status, nationality, job titles, CV information, etc.
Special categories of personal data
Sensitive data requiring additional protection, including race, ethnic origin, political views, religion, trade union membership, genetics, biometrics (for identification), health data, sexual orientation, and criminal offence data.
Data controller
KEY HEALTH determines the purposes and means of processing personal data.
Data processor
Third parties processing data on behalf of KEY HEALTH.
Processing
Any operation on personal data, including collection, storage, retrieval, use, sharing, restriction, erasure, and destruction.
Supervisory authority
The UK Information Commissioner’s Office (ICO).
Scope
This policy applies to all KEY HEALTH staff. It supplements KEY HEALTH policies relating to email, internet usage, security, and confidentiality.
Reza Najafi is appointed as Data Protection Manager (DPM). Contact: reza.najafi@keyhealth.uk
The principles of UK GDPR
KEY HEALTH complies with the principles of UK GDPR:
- Lawfulness, fairness, transparency
- Purpose limitation
- Data minimisation
- Accuracy
- Storage limitation
- Integrity and confidentiality
We maintain accountability for demonstrating compliance.
Accountability and documentation
KEY HEALTH maintains:
- Appropriate technical and organisational measures
- Up-to-date documentation of processing activities
- Data Protection Impact Assessments (where required)
- Security and privacy-by-design measures
- The KEY HEALTH ‘GDPR_Data Inventory’ as our retention schedule and processing register
KEY HEALTH maintains these measures in order to be able to demonstrate compliance with UK GDPR, in line with the accountability principle.
Fair and lawful processing
KEY HEALTH processes personal data under the following lawful bases:
- Contractual necessity
- Legal obligation
- Legitimate interests
- Consent, only where freely given and appropriate
Control and processing roles
KEY HEALTH is the Data Controller. Third-party processors may be used only with DPM approval and must have a compliant Data Processing Agreement (DPA).
Special category data
Processing requires a lawful condition under UK GDPR and an additional condition under Article 9, such as employment law obligations, health and safety requirements, or explicit consent where required. Processing must cease if no lawful basis exists.
Responsibilities
KEY HEALTH responsibilities
- Maintain documentation
- Verify lawful bases
- Ensure valid consent procedures
- Detect and report breaches
- Ensure secure data storage
- Assess risk relating to individual rights
Staff responsibilities
- Understand obligations
- Process data only lawfully
- Avoid careless or unauthorised disclosure
- Follow all security procedures
- Report breaches within 24 hours
DPM responsibilities
- Oversee compliance and training
- Review policies
- Respond to data queries
- Manage contracts with processors
- Handle access and erasure requests
Accuracy and relevance
Data must be accurate, relevant, and limited to what is necessary. Individuals may request corrections.
Data security
Staff must secure data at all times, following rules for:
- Password protection
- Secure storage
- Encryption of removable media
- DPM-approved cloud platforms
- Secure server and backup procedures
Data retention
KEY HEALTH follows the retention periods set out in the KEY HEALTH GDPR_Data Inventory. Data is not kept longer than necessary.
International transfers
KEY HEALTH may use cloud-based or external systems (such as PeopleHR, TripLog, and Microsoft 365) which may involve international data transfers. KEY HEALTH ensures:
- Transfers to UK Adequacy Decision countries are permitted
- Transfers to other countries use the UK Addendum to EU Standard Contractual Clauses or the International Data Transfer Agreement (IDTA)
- Cloud providers must have appropriate safeguards
- Staff must not adopt new cloud tools without DPM approval
No new systems, applications, or suppliers involving personal data may be introduced without prior approval from the Data Protection Manager.
Rights of individuals
All UK GDPR rights are supported:
- Right to be informed
- Access
- Rectification
- Erasure
- Restriction
- Portability
- Objection
- Rights relating to automated decision-making and profiling
Privacy notices
Privacy notices must be provided at the point of data collection or within one month if data is obtained indirectly.
Subject access requests
KEY HEALTH responds within one month (extendable to two months with DPM approval). Data must not be altered after a SAR is received.
Third parties and contracts
All processors require:
- Written agreements
- Security commitments
- Confidentiality
- Assistance with SARs and breach management
- Deletion or return of data at the end of contract
Criminal offence data
Handled only when legally justified and authorised by the DPM.
Audits, monitoring and training
KEY HEALTH will audit data processing, monitor compliance, and provide staff training as required.
Breach reporting
Staff must report any breach as soon as practicable and in any event within 24 hours of discovery. KEY HEALTH must notify the ICO within 72 hours if required.
Failure to comply
Failure to adhere to this policy may result in disciplinary action, up to and including dismissal.
