Skip to main content
Komos Solutions IT and cyber security consultancy

Data protection and UK GDPR policy

Owner: the Director

Last reviewed: November 2026

Review cycle: at least annually

Download as PDF

Purpose

This policy sets out how Komos Solutions Ltd (“the Company”) complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

Scope

This policy applies to all personal data processed by the Company, whether the Company is acting as a controller (for example, enquiries and client contacts) or as a processor (for example, when handling personal data on behalf of a client during a project). It applies to the Director, anyone working for the Company, and associates and partners engaged by the Company.

Responsibilities

The Director is responsible for data protection compliance. The Company is not required to appoint a Data Protection Officer; data protection questions should be sent to hello@komossolutions.com.

Data protection principles

The Company processes personal data in line with the UK GDPR principles. Personal data is:

  • processed lawfully, fairly and transparently
  • collected for specified, explicit and legitimate purposes
  • adequate, relevant and limited to what is necessary
  • accurate and kept up to date
  • kept for no longer than necessary
  • processed securely

The Company is accountable for, and can demonstrate, compliance with these principles.

Lawful basis and transparency

The Company identifies a lawful basis before processing personal data and explains its processing in privacy notices, including the website and enquiries privacy notice.

Acting as a processor

When the Company processes personal data on behalf of a client, it does so under a written contract that meets the requirements of Article 28 of UK GDPR. The Company processes the data only on the client's documented instructions, keeps it confidential and secure, uses sub-processors only with the client's authorisation, assists the client with data subject requests and impact assessments, and deletes or returns the data at the end of the engagement.

Data protection by design

Data protection is considered from the start of every project. The Company minimises the personal data it handles and, where a project is likely to result in a high risk to individuals, supports the client with a data protection impact assessment.

Security

Personal data is protected by the measures set out in the information security policy.

International transfers

Personal data is not transferred outside the UK unless appropriate safeguards are in place, such as a UK adequacy regulation or the International Data Transfer Agreement or Addendum.

Individuals' rights

The Company respects the rights of individuals, including the rights of access, rectification, erasure, restriction, objection and data portability. Requests are handled without undue delay and within one month, as required by law.

Personal data breaches

Personal data breaches are reported to the Director immediately. Where a breach is likely to result in a risk to individuals, the Company notifies the Information Commissioner's Office within 72 hours of becoming aware of it, and informs affected individuals where the risk is high. Where the Company acts as a processor, it notifies the client without undue delay. All breaches are recorded.

Retention

Personal data is kept only for as long as needed for the purpose it was collected for, or as required by law, and is then securely deleted.

Review

This policy is reviewed at least annually and whenever the law or the Company's processing changes significantly.

Komos Solutions Ltd, registered in England and Wales, company number 09084109. Registered office: 3 Westmead Drive, Newbury, Berkshire, RG14 7DJ.