Date policy issued: 01.10.2026
Date policy last reviewed: 01.10.2026
This policy will be reviewed every 12 months (as a minimum).
Review due date: 01.10.2027
Designated Safeguarding Lead Contact Details
Designated Safeguarding Lead: Billie-Jo Jarrett, Compliance Manager
Email: [email protected]
Contact number: 07495 068440
1. Purpose and Scope
1.1 Social Work Partners protects personal information used in recruitment, employment, placements and business administration.
1.2 This policy applies to directors, internal staff, consultants and anyone handling personal information on the company’s behalf. Placed professionals should also follow client data protection requirements when working in client systems.
1.3 The company must comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, as amended, including applicable changes under the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations where relevant.
1.4 “Must” identifies legal requirements. “Should” identifies company expectations.
2. Responsibility and Accountability
2.1 Company directors oversee compliance, requests, complaints and data incidents. Staff should refer these matters promptly to a director.
2.2 The company must identify its responsibilities as a controller, joint controller or processor for each activity. These responsibilities depend on the actual arrangement, rather than the label in a contract.
2.3 The company must maintain appropriate processing records, pay the ICO data protection fee unless exempt, and appoint a Data Protection Officer where legally required.
2.4 Staff should receive appropriate training, keep information confidential and access only information needed for their duties.
3. Data Protection Principles
3.1 Personal information must be:
- Used lawfully, fairly and transparently.
- Collected for specified, legitimate purposes.
- Relevant and limited to what is necessary.
- Accurate and corrected where needed.
- Kept only for as long as necessary.
- Protected against unauthorised use, loss, damage or destruction.
3.2 The company must be able to demonstrate compliance with these principles.
4. Lawful Processing and Privacy Information
4.1 Before processing personal information, the company must identify and document an appropriate lawful basis. This may include contractual necessity, legal obligation or legitimate interests, depending on the activity.
4.2 Where ordinary legitimate interests are relied upon, the company must assess necessity and balance its interests against the individual’s rights. Consent must be freely given, specific, informed and withdrawable where used; it should not be the default basis for employment processing.
4.3 Candidates, employees and other individuals must receive appropriate privacy information explaining the purposes, lawful bases, recipients, retention arrangements, rights and contact route. This policy does not replace privacy notices.
4.4 Information collected from references, public sources or third parties must also be handled lawfully, with privacy information provided within applicable deadlines unless a lawful exemption applies.
5. Sensitive Information and Recruitment Checks
5.1 Health, ethnicity and other special-category information must only be processed where both a lawful basis and an additional special-category condition apply.
5.2 Criminal-offence information, including relevant allegations and vetting information, must have a lawful basis and the additional legal authority or condition required for processing.
5.3 The company must document the applicable conditions and maintain an appropriate policy document where required by the Data Protection Act 2018.
5.4 Recruitment checks should be proportionate and relevant to the role. Criminal-record and barred-list checks must only be requested where legally permitted.
5.5 Health information should be limited to relevant fitness, support and adjustment needs. Equality-monitoring information should be separated from selection decisions where practicable.
6. Sharing Information and Safeguarding
6.1 Information must only be shared where lawful. Staff should verify recipients, share the minimum necessary information and use secure communication methods.
6.2 Candidate submissions should be agreed with the candidate. Client disclosures should be limited to information necessary for recruitment, compliance and the assignment.
6.3 Data protection law does not prevent necessary, lawful safeguarding reporting. Relevant information may be shared with safeguarding authorities, regulators, police or barring bodies where an appropriate legal basis and any additional conditions apply.
6.4 Significant or sensitive disclosures should be recorded, including what was shared, with whom and why. Allegations should be clearly distinguished from established findings.
6.5 Placed professionals should keep service-user records in authorised client systems and report client data incidents through the client’s reporting route. The company should not collect complete case files when a limited report is sufficient.
7. Security and Approved Systems
7.1 The company must use technical and organisational safeguards appropriate to the risks, including access controls, secure storage, protected transfers and recovery arrangements.
7.2 Staff should use approved systems, strong passwords and multi-factor authentication where available. Accounts should not be shared, and access should be removed promptly when no longer required.
7.3 Paper records should be kept securely. Personal information should not be stored in personal email, unapproved devices, messaging services, cloud storage or AI tools.
7.4 Staff should check recipients and attachments before sending information, lock unattended devices and avoid discussing confidential matters in public.
8. Suppliers and Overseas Transfers
8.1 Suppliers handling personal information should be assessed before appointment. Where a supplier acts as a processor, the company must have a written agreement containing the required data protection terms and use processors providing sufficient safeguards.
8.2 Where the company acts as a processor, it must follow lawful documented instructions and meet its applicable processor obligations.
8.3 Restricted international transfers, including relevant overseas access, must comply with UK transfer requirements. Approved adequacy arrangements, safeguards and assessments must be in place where required.
9. Retention and Disposal
9.1 Personal information should be retained and securely disposed of in accordance with the company’s Record Retention Policy.
9.2 Information must not be kept indefinitely without a justified purpose. Relevant records should be preserved where necessary for safeguarding, legal proceedings, regulatory investigations or binding preservation requirements.
9.3 Corrections should preserve necessary audit trails. Disposal should cover unnecessary duplicates and the secure expiry of backup copies.
10. Individual Rights
10.1 Individuals may have rights of access, correction, erasure, restriction, objection and portability, depending on the processing. They may also withdraw consent where it is relied upon.
10.2 Requests should be forwarded immediately to a director. Requests do not need to use legal terminology or a particular form.
10.3 The company must respond within applicable statutory deadlines, normally one month. Extensions or pauses may only be used where legally permitted and must be explained appropriately.
10.4 Identity checks must be proportionate. Exemptions, refusals and restrictions must be lawful and documented, with reasons and information about complaint rights provided where required.
11. Personal Data Breaches
11.1 Suspected loss, incorrect disclosure, unauthorised access, alteration or destruction of personal information should be reported immediately to a director. Staff should preserve evidence and assist containment.
11.2 The company must record breaches, assess their impact and document its response, including any decision not to notify.
11.3 Where a breach is likely to risk individuals’ rights and freedoms, the company must notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it.
11.4 Where a breach is likely to create a high risk, affected individuals must be informed without undue delay unless a lawful exception applies.
11.5 Where the company acts as a processor, it must notify the relevant controller without undue delay.
12. Marketing, Monitoring and Automated Decisions
12.1 Direct marketing and non-essential tracking must comply with applicable UK GDPR and electronic-communications rules. Marketing objections and unsubscribe requests must be respected.
12.2 Staff monitoring must be lawful, necessary, proportionate and appropriately transparent.
12.3 New technology and processing should be assessed before use. A data protection impact assessment must be completed where processing is likely to result in a high risk.
12.4 Automated decisions producing legal or similarly significant effects must comply with applicable safeguards, including information, representations, human intervention and challenge rights. Staff should not introduce automated candidate rejection without director approval and a compliance assessment.
13. Complaints and Review
13.1 Individuals may raise a data protection complaint verbally or in writing with a company director through the company’s usual contact channels. Staff should forward complaints promptly.
13.2 The company must acknowledge complaints within 30 days, make appropriate enquiries, respond without undue delay and keep the complainant informed. Individuals must be told of their right to complain to the ICO.
13.3 Breaches of this policy may lead to appropriate action under applicable employment or engagement procedures.