Revised: September 2025
During the course of our activities we, Lightways (Contractors) Ltd, will collect, use, transfer or store personal information about our employees, clients, customers and suppliers, for example their names and home addresses. The UK’s data protection legislation, including the UK General Data Protection Regulation (UK GDPR) contains strict principles and legal conditions which must be followed before and during any processing of any personal information.
The purpose of this policy is to ensure that all employees are aware that everyone has a responsibility to comply with the principles and legal conditions provided by the data protection legislation, including the UK GDPR, and that failure to meet those responsibilities is likely to lead to serious consequences.
A serious breach of data protection is likely to be a disciplinary offence and will be dealt with under the company’s disciplinary procedure. If an employee accesses another employee’s personnel records or any sensitive personal information without authority, this may be considered a gross misconduct offence and could lead to summary dismissal.
Additionally, if an employee knowingly or recklessly discloses personal data in breach of the data protection legislation, including the UK GDPR, they may be held personally criminally accountable for any such breach.
Breach of the data protection legislation, including the UK GDPR rules, can cause distress to the individuals affected by the breach and is likely to leave the company at risk of serious financial consequences.
If there is any doubt about what can or cannot be disclosed and to whom, the information should not be disclosed until the employee has obtained further advice from the company’s Data Protection Officer, Ian Young.
It is mandatory that all employees, workers, and contractors must read, understand and comply with the content of this policy, and may be required to attend associated training relating to its content and operation. Failure to adhere to this policy is likely to be regarded as a serious disciplinary matter and will be dealt with under the company’s disciplinary rules and procedures.
Under the UK GDPR Principles, the company is considered a data controller. This means that the company is required by law to ensure that everyone who processes personal data and special categories of personal data during the course of their work does so in accordance with the data protection legislation, including the UK GDPR principles.
In brief, the principles say that:
Other rules under the UK GDPR state that:
The company and all employees must comply with these principles and rules at all times in their information-handling practices. We are committed to ensuring that these principles and rules are followed, as we take the security and protection of data very seriously.
Employees must inform the company immediately if they become aware that any of these principles or rules have been breached or are likely to be breached.
Whilst carrying out work activities, employees are likely to process personal data. The company will only expect its employees to process personal data where the business has a lawful basis (or bases) to process that information.
The lawful basis may be any one of the following reasons or a combination of:
There are other rare occasions where you may need to process the data subject’s personal information. These include:
Employees must ensure that a documentary inventory of the legal basis, or bases, which are being relied on in respect of each processing activity they perform.
Personal data must be processed in a lawful, fair and transparent way.
Before beginning collecting or processing personal data directly from a data subject, the data subject must be issued with an appropriate privacy notice.
Different notices are used for employment and commercial purposes. The content of the privacy notice must provide accurate, transparent and unambiguous details of the lawful and fair reason for why the company is processing the data. It must also explain how, when and for how long we propose to process the data subject’s personal information. Information should also be included about the data subject’s rights and, most importantly, the notice should also explain how the company will ensure the information’s security and protection against unauthorised use.
Where the data is to be collected indirectly from a third party or public source (e.g. the Electoral Register), the data subject must be issued with a privacy notice within a reasonable period of obtaining the personal data, and no later than one month after. If the data is used to communicate with the individual, then at the latest, the privacy notice should be issued when the first communication takes place or, if disclosure to someone else is envisaged, a privacy notice should be issued, at the latest, when the data is disclosed.
Data that is collected indirectly must only be used if the company has evidence that it has been collected in accordance with the UK GDPR principles.
In all circumstances employees must check that they are using the most up-to-date version of the company’s privacy notice, and it is being used in accordance with the company’s guidelines.
The purpose for which the personal information is collected must be specific, explicit and legitimate.
When collecting personal information it should be set out in the privacy notice how that information will be used. If it becomes necessary to use that information for a reason other than the reason which has previously been identified, employees must usually stop processing that information.
However, in limited circumstances the information can continue to be processed provided that the new reason for processing the personal information remains compatible with the original lawful purpose (unless the original lawful basis was ‘consent’).
The collected personal data must be adequate and relevant to meet the identified purpose.
Personal data must only be processed where the employee has been authorised to do so because it relates to their work or they have been delegated temporary responsibility to process the information.
Employees must not collect, store or use unnecessary personal data and must ensure that personal data is deleted, erased or removed within the company’s retention guidelines.
Personal data must not be processed or used for non-work related purposes.
The company will review its records and in particular employees’ personnel files on a regular basis to ensure they do not contain a backlog of out-of-date or irrelevant information and to check there are lawful reasons requiring information to continue to be held.
The information must be accurate and kept up-to-date.
If an employee’s personal information changes, for example changing address or getting married and changing surname, they must inform their line manager as soon as practicable so that the company’s records can be updated.
The company will not be responsible for any inaccurate personal data held on its systems where its employees have failed to notify it of the relevant change in circumstances.
The personal data should not be kept in a form which permits identification of a data subject for longer than is necessary for the purposes for which it is used.
Different categories of personal data will be retained for different periods of time, depending on legal, operational and financial requirements. Any data which the company decides it does not need to hold for a particular period of time will be destroyed in accordance with its retention of data policy.
The personal data must be kept confidential and secure and only processed by authorised personnel.
To achieve this, these steps must be followed:
The company has network back-up procedures to ensure that data on computers cannot be accidentally lost or destroyed. More information on the company’s security policies can be obtained by contacting Ian Young.
Transfer of personal data to countries or organisations outside of the UK should only take place if appropriate safeguarding measures are in place to protect the security of that data.
The company does not generally have a need to transfer data outside of the UK. However, if a request is made to transfer personal data to a country or organisation outside of the UK, no transfer should be made unless there are in place safeguards to ensure this is done in a legally compliant manner.
Before transferring personal data outside of the UK, employees must speak with Ian Young, Data Protection Officer.
The data subject must be permitted to exercise their rights in relation to their personal data.
Under the UK GDPR, subject to certain legal limitations, data subjects have available a number of legal rights regarding how their personal data is processed. At any time, a data subject can request that the company should take any of the following actions, subject to certain legal limitations, with regard to their personal data:
There are different rules and timeframes that apply to each of these rights. The company’s policies and procedures must be followed whenever any of its employees receive or process a request in relation to any of the above rights.
The company’s data subject access procedure, which details how to deal with requests and describes the circumstances where a fee may be charged, must be followed.
The procedure includes the following:
During the course of their employment, employees may be required to process personal data which falls into different categories, general personal data, and special categories of personal data.
All data should be processed in accordance with the privacy notice and at all times in a confidential manner.
However, where that data is classed as a special category, extra care should be taken to ensure the privacy and security of it. This means that a high level of security should be maintained and the data should only be shared with those who are also authorised to process it.
In the context of employee relations, the scenarios when you may be required to process special categories information may arise for one or more of the following reasons:
The company may also require its employees to process special categories of information in connection with customers and other third parties.
In limited circumstances employees may need consent from a data subject in order to process personal data or special categories of data. To do so, employees may be provided with training and details of in which circumstances consent is needed and the type of consent that should be sought.
In some circumstances it may be necessary to request a data subject to provide written consent to allow the processing of special categories of personal data. Employees may be provided with training and details of in which circumstances consent is needed, and the type of consent that should be sought. For example, in an employment context you should request the data subject’s written consent to instruct a medical practitioner to prepare a medical report.
If it becomes necessary to request consent to process special categories of personal data, the data subject must be provided with details of the information that will be required and why it is needed, so that they can make an informed decision as to whether they wish to provide consent.
Employees must not compel a data subject to provide written consent. Giving consent will always be a decision made by free will and choice and is not a contractual condition. Consent can be withdrawn at any time without any reason provided. A data subject must not experience detriment or be subject to sanctions as a consequence of withdrawing consent. To inflict this on someone would be considered a serious disciplinary issue.
In limited circumstances there are certain categories of personal data that are exempt from the UK GDPR regime.
In an employment context, these include:
A personal data breach will arise whenever:
In the event of a security incident or breach, the company’s Data Breach Policy must be followed, which includes immediately informing Ian Young, so that steps can be taken to:
Within 72 hours, the Data Protection Officer will determine the seriousness of the breach and if the Information Commissioner’s Office (ICO) and/or data subjects need to be notified of the breach.
There may also be circumstances where employees with authorisation to do so are asked to process this type of information in relation to assisting the company with legal claims, or to protect a data subject’s interests, or those of someone else.
Employees may be asked to process information in relation to criminal convictions. This should be processed with the highest degree of confidentiality and in accordance with any data protection legislation and privacy notices that are in force in the business.
Any employees who are unsure about how to process general personal data or special categories of personal data should contact Ian Young with their questions.
As the company has fewer than 250 employees, it only needs to document processing activities that:
All employees that handle personal information of individuals must have a basic understanding of the data protection legislation, including the UK GDPR. Staff with duties such as computer and internet security, marketing, and database management, may need specialist training to make them aware of particular data protection requirements in their work area.
The company will provide continuous updates on how to process personal data in a secure and confidential manner and in accordance with the spirit of the data protection legislation, including the UK GDPR.
Employees may also be required to attend training provided by the company, as well as keep themselves informed and aware of any changes made to privacy notices, consent procedures, and any other policies and procedures associated with our internal processing of personal data.
All employees must regularly review their data processing activities and ensure that they are acting in accordance with the most current best practice and legal obligations in relation to data security and confidentiality.
From time to time, the company may use computer programmes to process data and make automated decisions. Separate notice of when and how this happens will be provided to employees. Where automated processing or decision-making does take place and the effect of that processing impacts on the freedoms and legitimate interests of the data subject, in certain circumstances the data subject can request for human intervention. This means that they can ask for a human to review the machine-made outcome or decision.
Personal data may be shared internally as necessary. Employees must always ensure that personal data is only shared with authorised persons and is shared in accordance with the purposes stated in any privacy notice or consents. Extra care and security must be taken when sharing special categories of data or transferring data outside of the company to a third party.
The company is subject to specific rules under the UK GDPR in relation to marketing our services. Data subjects have the right to reject direct marketing and we must ensure that data subjects are given this option at the first point of contact. When a data subject exercises their right to reject marketing, the employee must immediately cease sending further communications.
If any employee feels that this policy has been breached, or wants to exercise all relevant rights, queries or complaints in the first instance should be directed to Ian Young.
We use cookies to shed a little light on how our site's used. Nothing is set unless you accept, and you can change your mind any time.