This policy sets out how Baker Stuart manages personal data and the responsibilities of employees and contractors when handling that data. It ensures we meet our obligations under the UK GDPR and Data Protection Act 2018.
This policy applies to all personal data processed by Baker Stuart, including data relating to:
• clients and customers
• suppliers and contractors
• employees, workers and job applicants
• website users
It applies to all employees, contractors and third parties working on our behalf.
Baker Stuart is the data controller. The Operations Manager acts as the Data Protection Officer (DPO) and is responsible for oversight of this policy.
All employees and contractors must:
• handle personal data in line with this policy
• maintain confidentiality at all times
• only access data where required for their role
• report any actual or suspected data breaches immediately
We process personal data in line with UK GDPR principles. Data must be:
• processed lawfully, fairly and transparently
• collected for specific, legitimate purposes
• limited to what is necessary
• accurate and kept up to date
• retained only for as long as necessary
• kept secure at all times
Personal data must only be processed where a lawful basis applies. These include:
• consent
• contract
• legal obligation
• legitimate interests
The appropriate lawful basis must be identified before processing begins.
Personal data must:
• only be used for the purpose it was collected
• not be shared without a valid reason
• not be retained unnecessarily
• be handled in a way that protects confidentiality
We protect personal data through appropriate technical and organisational measures, including:
• secure systems and controlled access
• multi-factor authentication and password management
• regular system updates and monitoring
• staff training and awareness
Personal data must not be stored on unsecured devices or shared through unapproved channels.
Personal data must only be retained for as long as necessary to meet business, legal and regulatory requirements.
Retention periods are determined based on the type of data and the purpose for which it is used. As a guide:
• client and project data may be retained for up to 6–7 years
• employee data is retained in line with legal and HR requirements
Data must be securely deleted or anonymised when no longer required.
Personal data must only be shared where necessary and with appropriate safeguards in place.
Where third parties process data on our behalf, they must:
• act on our instructions
• maintain confidentiality
• implement appropriate security measures
Personal data must not be transferred outside the UK without appropriate legal safeguards. Approval must be obtained from the Operations Manager before any such transfer.
Any actual or suspected data breach must be reported immediately to the Operations Manager.
We will assess all breaches and take appropriate action, including notification where required.
Individuals have rights under UK GDPR, including access, correction, erasure and objection.
Any request relating to personal data must be passed to the Operations Manager without delay.
All employees and contractors will receive appropriate data protection training and are expected to remain aware of their responsibilities.
This policy is reviewed regularly to ensure it remains effective and compliant with legal requirements.
This policy statement has been approved and authorised by:
Name: Wayne Spiller
Position: Managing Director
Date: 7th May 2026
Signature:
"*" indicates required fields
