UK GDPR
The core principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.
Compliance & data protection
Built to meet your legal obligations, not just your feature list.
When we build software that handles personal data, your compliance becomes part of our engineering. We design for UK data protection law from the start, so you can demonstrate accountability to your customers, your auditors and the regulator.
Legal framework
The laws and guidance we design for
Data Protection Act 2018
The UK’s implementing legislation, including its additional conditions for special category and criminal offence data.
Information Commissioner’s Office
We follow ICO guidance and codes of practice, the UK regulator’s interpretation of how the law applies in practice.
EU GDPR
Where clients serve people in the European Union, we design for the EU GDPR alongside the UK regime.
Roles & responsibilities
Data controller and data processor
Being clear about who decides and who acts is the foundation of compliant processing.
When we act as your data processor
When we host or support software that processes personal data on your behalf, you remain the controller and we meet the processor obligations of Article 28 UK GDPR, set out in a written data processing agreement. We:
- process personal data only on your documented instructions
- ensure everyone with access is bound by confidentiality
- apply appropriate technical and organisational security measures (Article 32)
- use sub-processors only with your authorisation, under equivalent terms
- help you respond to data subject requests and carry out DPIAs
- notify you without undue delay of any personal data breach
- delete or return all personal data at the end of the service
- make available the information you need to demonstrate compliance and support audits
When we act as a data controller
For our own business, such as handling enquiries and managing client relationships, we are the controller. We identify a lawful basis for each purpose, keep records of processing, and explain what we do in our privacy notice.
Privacy by design and by default
Data protection engineered into the product
Article 25 UK GDPR requires data protection to be built in, not added later. In practice that means:
- Data minimisation
- We collect only the data a feature genuinely needs, and question every field that holds personal data.
- DPIA support
- We document data flows and risks so you can complete Data Protection Impact Assessments for high-risk processing.
- Retention by design
- Retention periods are configurable and enforced automatically, so data is not kept longer than necessary.
- Data subject rights
- Built-in support for access, rectification, erasure, restriction and portability requests.
- Private by default
- The most privacy-protective settings are the default. Our apps are non-tracking by default; tracking or analytics are added only when a client specifically asks for them.
- International transfers
- Where data leaves the UK, we rely on UK adequacy regulations or appropriate safeguards such as the International Data Transfer Agreement.
Access control
Fine-grained RBAC: the right people see the right data
We typically build fine-grained role-based access control into our applications, so personal and sensitive data is visible only to the people who need it to do their job.
- Least privilege. Users start with no access and are granted only what their role requires.
- Record- and field-level rules. Permissions can be scoped by team, site, case or individual field, not just by screen.
- Segregation of duties. Sensitive actions can require separate roles, so no single account holds unchecked power.
- Auditable. Access to personal data is logged, and permissions can be reviewed and recertified regularly.
Right to erasure
Secure account deletion
When data must go, it should go completely, and you should be able to prove it.
-
01
Verified request
Deletion requests are authenticated, so data cannot be erased by someone impersonating the user.
-
02
Complete removal
Personal data is removed from every live data store, including related records, uploaded files, caches and search indexes, not just hidden from view.
-
03
Backups expire
Backups are kept on a defined rolling schedule, so deleted data ages out of them within a known period and is never restored into live systems.
-
04
Evidence of deletion
Deletions are recorded without retaining the deleted personal data, so you can demonstrate that the request was fulfilled.
Breach management
Prepared for the worst day
We maintain a documented incident response process. If a personal data breach affects data we process for a client, we notify that client without undue delay and give them the information they need to meet their own obligation to report qualifying breaches to the ICO within 72 hours.
For data we control, we assess every incident, record it, and notify the ICO and affected individuals where the law requires. Incident management is also something we build for others: see Continuity Direct.
We also build to the Web Content Accessibility Guidelines (WCAG) 2.1 AA, supporting our clients’ duties under the Equality Act 2010.
Talk to us about your compliance requirements
From data processing agreements to DPIA support, we’ll help you get the evidence you need.