Data Protection Responsibilities

Personal data must not be disclosed to unauthorized third parties.
Personal data must be retained according to Glow Telecom's data retention schedule.
Queries regarding data protection should be directed to the Managing Director.
Data protection breaches must be reported to and dealt with by the Managing Director.
In cases of uncertainty regarding data protection, advice must be sought from the Managing Director.

When external companies process personal data for Glow Telecom, Glow Telecom retains responsibility for its security.
Data processors must provide guarantees about their security measures.
A written contract must detail the personal data being processed and the purpose of processing.

Personal data must be returned or securely destroyed upon the completion of work.
Glow Telecom is responsible for the data use by contractors/consultants.
Managers must ensure personal data is processed securely and confidentially.
Personal data should not be stored or processed outside the UK without written consent.
Only essential personal data should be accessible to contractors and consultants for their work.

Data subjects have the right to receive copies of their personal data held by Glow Telecom.
Individuals are entitled to information regarding the processing of their personal data, including:
- Categories of personal data being processed
- Recipients/categories of recipients
- Retention periods
- Information about their rights
- Right to complain to the ICO
- Relevant safeguards for data outside the EEA
- Source of the personal data
Disclosure of personal data must not occur without proper authorization.
Requests for access to personal data should not result in alterations or destruction of that data.

Personal data breaches must be reported to the Information Commissioner's Office (ICO) if there is a risk to data subjects.
High-risk breaches require notification to data subjects unless security measures mitigate the risk.
Public communication may be required in such cases to inform data subjects.

Security Measures and Compliance

Personal data must be processed securely through appropriate technical and organizational measures.
Risk analysis and organizational policies should guide security measures and decision-making.
Regular reviews of information security policies and practices are necessary for continued compliance.
All actions must ensure the confidentiality, integrity, and availability of personal data.

Policies on personal data retention and justification for the duration must be in place.
An examination of data processing risks informs the required security level.
Basic technical controls should comply with established frameworks (e.g., Cyber Essentials).
Regular testing and reviews of security measures must be conducted to highlight areas for improvement.
Backup processes should be established to restore access to personal data when needed.