Last Updated: June 2026

​

Internal Data Protection Policy & Data Breach Plan

Business Name: [Insert Business Name]

Data Protection Lead: [Insert Your Name]

Date of Adoption: [Insert Date]

1. Purpose of this Policy

This policy outlines how I, as a self-employed Chartered Architectural Technologist and OCDEA, handle personal data internally to maintain compliance with UK GDPR and the Data Protection Act 2018.

2. Our Core Data Principles

I commit to the six mandatory UK GDPR principles. Data must be:

1. Processed lawfully, fairly, and transparently.

2. Collected only for specific, explicit, and legitimate purposes (e.g., executing architectural contracts or energy lodgements).

3. Adequate, relevant, and limited to what is necessary.

4. Accurate and kept up to date.

5. Retained only for as long as necessary.

6. Processed securely using appropriate technical measures.

3. Lawful Basis for Processing Data

Under UK GDPR, I rely on the following legal grounds to handle client data:

• Contractual Necessity: To carry out architectural drawings, produce SAP calculations, and complete structural designs as requested by the client.

• Legal Obligation: To lodge legal documents (EPCs) on the central government register via my accreditation scheme.

• Legitimate Interests: To maintain normal business invoicing, project track records, and professional communication.

4. Operational Data Security Measures

To keep architectural data, floor plans, and client contact information safe, I will enforce the following controls:

• Device Security: All laptops, tablets, and smartphones used for business operations must be password-protected and utilize biometric login or strong encryption where possible.

• Software Protection: CAD/BIM software, SAP calculation tools, and business emails must be accessed via secure, licensed platforms using unique passwords.

• Physical Security: Any printed blueprints, site survey notes, or signed physical contracts must be kept in a secure, locked filing location when not in use.

• Secure File Transfer: Large files, site images, and architectural specifications should be shared with developers or local authorities using password-protected cloud storage or secure email channels.

5. Third-Party Data Disclosures

I will only share data with relevant third parties strictly required to deliver my services:

• Energy Accreditation Schemes (e.g., Elmhurst) for lodging EPCs.

• Local Authority Building Control & Planning Departments for submission of structural or sustainability packages.

• HMRC & Accountants for standard business financial auditing.

6. Retention & Data Erasure

• Active Project Data: Retained for the duration of the design and assessment process.

• Archived Technical Files: Because architectural liability and professional indemnity insurance policies often feature extended claims windows, project files, drawings, and SAP records will be securely archived for 10 years following project completion, after which digital files will be permanently deleted and paper records shredded.

7. Handling Subject Access Requests (SARs)

If a client requests to see, amend, or delete the data I hold on them, I will:

1. Verify their identity to prevent unauthorized data exposure.

2. Provide the data free of charge.

3. Respond and fulfill the request within the statutory one calendar month deadline.

8. Data Breach Response Plan (Schedule A)

A personal data breach is any security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data (e.g., a stolen work phone, an unencrypted laptop theft, or a malware/ransomware attack on your CAD/SAP files).

If a data breach occurs or is strongly suspected, I will execute the following four steps immediately:

Step 1: Containment and Recovery

• Action: Take immediate technical steps to stop the breach from worsening.

• Examples: Remotely wipe a lost/stolen device, disconnect an infected computer from the internet, change all cloud and software passwords immediately, or request that an incorrectly addressed email be deleted by the recipient.

Step 2: Risk Assessment

• Evaluate what data was exposed and determine if there is a "risk to the rights and freedoms" of the individuals affected (e.g., could it lead to identity theft, financial loss, or fraud?).

• Low Risk: An encrypted laptop is lost. No action is required to notify the ICO because the data cannot be read.

• Medium/High Risk: Unencrypted client phone numbers, home addresses, and bank details are accessed by a hacker. This must be reported.

Step 3: ICO Notification (The 72-Hour Rule)

• If the risk assessment reveals a likelihood of risk to individuals, I am legally required to report the breach to the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it.

• How to Report: Submit a data breach report online through the ICO portal (ico.org.uk) or call their helpline at 0303 123 1113.

• Information to Provide:

  1. The nature of the breach (what happened).

  2. The categories and approximate number of individuals/records affected.

  3. The likely consequences of the breach.

  4. The measures taken or proposed to fix and mitigate the damage.

Step 4: Notifying Affected Individuals

• If the breach presents a high risk to individuals (e.g., direct banking details or passwords are leaked), I must notify the affected individuals directly and without undue delay.

• The notice must be written in clear, plain language and explain what happened, what data was involved, and what actions they should take to protect themselves (e.g., changing passwords or monitoring bank statements).

Step 5: Documenting the Log

• I will maintain an internal data breach log. All breaches—even minor ones that do not meet the threshold for reporting to the ICO—must be documented in writing, detailing the facts, its effects, and the corrective actions taken.