General Data Protection Regulation
The purpose of this GDPR Policy is to explain how HR Care Services collects, stores, processes, and protects personal information. We are committed to handling all personal data fairly, lawfully, and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This policy ensures that personal information belonging to our clients, employees, job applicants, and business partners is handled responsibly and securely. Our aim is to maintain confidentiality, protect individual privacy, and build trust through safe and ethical data management practices.
2.1 Internal Roles
This policy applies to all directors, managers, employees, care workers, agency staff, contractors, volunteers, and temporary workers employed by or working on behalf of HR Care Services.Every individual working within our organisation is responsible for protecting confidential information and ensuring compliance with UK GDPR requirements.
2.2 Individuals Covered
This policy covers all personal information relating to:
- Clients
- Family members
- Employees
- Job applicants
- Contractors
- Healthcare professionals
- Business partners
- Suppliers
We ensure that all personal data is processed securely and only for legitimate business purposes.
2.3 External Stakeholders
Any third-party organisation processing information on behalf of HR Care Services, including payroll providers, recruitment agencies, IT providers, healthcare partners, and local authorities, must comply with applicable data protection legislation and maintain appropriate confidentiality standards.
The objectives of this policy are to:
- Protect personal information from misuse or unauthorised disclosure.
- Ensure compliance with UK GDPR and the Data Protection Act 2018.
- Promote transparency when collecting and processing personal data.
- Maintain accurate, secure, and up-to-date records.
- Reduce the risk of data breaches.
- Protect the rights and freedoms of individuals.
- Ensure staff understand their responsibilities regarding confidential information.
- Maintain the trust and confidence of clients and their families.
The UK General Data Protection Regulation (UK GDPR) provides a legal framework governing how organisations collect, process, store, and share personal information.
HR Care Services recognises that protecting personal data is essential to maintaining trust and delivering safe, high-quality care services. We process personal information only where there is a lawful basis, ensuring that it is used fairly, securely, and only for specified purposes.
We regularly review our policies, procedures, and security measures to ensure ongoing compliance with current legislation and industry best practices.
Every employee at HR Care Services is responsible for maintaining confidentiality and protecting personal information.
Staff members must:
- Complete mandatory GDPR and confidentiality training.
- Handle personal information responsibly.
- Access information only when required for their role.
- Keep all client records accurate and secure.
- Report any suspected data breaches immediately.
- Follow all company policies relating to confidentiality and information security.
Failure to comply with this policy may result in disciplinary action and, where appropriate, legal action.
HR Care Services adopts a proactive and responsible approach to data protection by ensuring that all personal information is processed in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We recognise that personal data is entrusted to us by our clients, employees, and partners, and we are committed to protecting it at every stage of its lifecycle.
Our approach focuses on transparency, accountability, confidentiality, and continuous improvement. Personal information is collected only where necessary, processed for legitimate purposes, stored securely, and retained only for the period required by law or business necessity. Access to personal data is restricted to authorised individuals who require the information to perform their duties.
We regularly review our policies, procedures, and technical security measures to ensure they remain effective and compliant with current legislation. Staff receive ongoing training to ensure they understand their responsibilities and maintain the highest standards of confidentiality.
By embedding data protection into our daily operations, HR Care Services aims to build trust, protect individual rights, and deliver safe, professional care services.
HR Care Services collects and processes personal information only where it is necessary to provide safe, effective, and high-quality care services.
Personal information we may process includes:
- Full name
- Date of birth
- Home address
- Telephone number
- Email address
- Emergency contact details
- NHS number (where applicable)
- Medical history
- Care assessments
- Care plans
- Medication records
- Employment information
- Financial information required for invoicing
- Recruitment documentation
- Training records
All personal information is processed lawfully, accurately, and confidentially. We implement appropriate organisational and technical safeguards to protect data against loss, unauthorised access, misuse, or disclosure.
Personal information is retained only for as long as necessary to fulfil legal, contractual, or regulatory obligations before being securely destroyed.
HR Care Services promotes GDPR compliance through a structured framework of policies, procedures, staff training, monitoring, and continuous improvement.
Our compliance measures include:
- Mandatory GDPR and confidentiality training for all staff.
- Secure electronic and paper record management.
- Regular policy reviews and internal audits.
- Confidentiality agreements for employees and contractors.
- Controlled access to personal information.
- Secure password management and IT security.
- Incident reporting and investigation procedures.
- Continuous monitoring of regulatory changes.
Managers are responsible for ensuring that staff understand their obligations and comply with all data protection requirements. Any breach of confidentiality or misuse of personal information is investigated promptly and managed in accordance with our internal procedures.
HR Care Services follows the seven key principles of the UK General Data Protection Regulation.
These principles require that personal data is:
- Processed lawfully, fairly, and transparently.
- Collected only for specified, legitimate purposes.
- Limited to what is necessary.
- Accurate and kept up to date.
- Retained only for as long as required.
- Protected through appropriate security measures.
- Processed in a way that demonstrates accountability.
Supporting documents include:
- Privacy Policy
- Confidentiality Policy
- Information Security Policy
- Data Retention Policy
- Data Breach Procedure
- Staff Code of Conduct
- Recruitment Policy
- Complaints Policy
These documents work together to ensure consistent and effective data protection throughout the organisation.
HR Care Services is committed to achieving and maintaining full compliance with UK GDPR requirements.
Compliance is achieved through:
- Staff awareness and mandatory training.
- Secure handling of personal information.
- Regular internal audits.
- Ongoing policy reviews.
- Risk assessments.
- Secure information technology systems.
- Confidentiality agreements.
- Effective incident reporting procedures.
We regularly assess our practices to identify opportunities for improvement and ensure our services continue to meet legal and regulatory standards.
Any identified non-compliance is addressed promptly through corrective actions, additional staff training, or process improvements.
HR Care Services has established clear procedures to ensure that personal information is handled safely and consistently.
These procedures include:
- Collecting information fairly and transparently.
- Verifying the lawful basis for processing.
- Secure storage of electronic and paper records.
- Restricting access to authorised personnel only.
- Secure sharing of information with healthcare professionals where appropriate.
- Managing Subject Access Requests.
- Reporting and investigating data breaches.
- Secure destruction of confidential records when retention periods expire.
Regular monitoring ensures these procedures remain effective and compliant with legal requirements.
To ensure a clear understanding of this policy, the following definitions apply:
Personal Data
Any information relating to an identified or identifiable individual. This includes names, addresses, telephone numbers, email addresses, dates of birth, NHS numbers, medical records, employment records, financial information, and any other data that can identify a person.
Special Category Data
Information that requires additional protection due to its sensitive nature. This includes health records, medical conditions, disability information, biometric data, racial or ethnic origin, religious beliefs, and other information protected under UK GDPR.
Data Subject
The individual whose personal information is being collected, processed, stored, or shared by HR Care Services.
Data Controller
HR Care Services acts as the Data Controller, determining the purposes and means of processing personal information.
Data Processor
A third-party organisation or individual who processes personal data on behalf of HR Care Services, such as payroll providers, IT service providers, or secure cloud storage providers.
Processing
Any activity involving personal data, including collecting, recording, organising, storing, updating, retrieving, using, sharing, transferring, restricting, or securely deleting information.
Data Breach
A security incident resulting in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal information.
Understanding these terms helps ensure that everyone working with HR Care Services follows consistent data protection practices and complies with UK GDPR requirements.
HR Care Services encourages all employees and stakeholders to familiarise themselves with relevant legislation, guidance, and organisational policies to support good data protection practices.
Additional guidance can be found in:
- UK General Data Protection Regulation (UK GDPR)
- Data Protection Act 2018
- Information Commissioner’s Office (ICO) Guidance
- HR Care Services Privacy Policy
- Confidentiality Policy
- Information Security Policy
- Records Management Policy
- Data Retention Policy
- Data Breach Response Procedure
- Staff Code of Conduct
- Safeguarding Policies and Procedures
Employees are encouraged to seek advice from their manager whenever they are unsure about the correct handling of personal information. Keeping up to date with legislation and organisational guidance helps ensure compliance and supports the delivery of safe, confidential, and professional care services.
At HR Care Services, protecting personal information is an integral part of delivering safe, compassionate, and professional care. We are committed to maintaining the highest standards of confidentiality, integrity, and accountability in everything we do.
Our organisation promotes a culture where privacy and data protection are everyone’s responsibility. Through regular staff training, robust security measures, policy reviews, and continuous improvement, we strive to exceed regulatory requirements and maintain the trust of our clients, their families, employees, and partner organisations.
We regularly monitor our data protection practices to identify opportunities for improvement, strengthen information security, and ensure compliance with UK GDPR and the Data Protection Act 2018.
By embedding privacy into our daily operations, HR Care Services demonstrates its commitment to providing high-quality care while respecting the rights, dignity, and confidentiality of every individual whose information we hold.