Data Protection and Information Governance Policy

  1. Analytics

This website collects personal information to power our site analytics, including:

  • Information about your browser, network, and device

  • Web pages you visited prior to coming to this website

  • Your IP address

This information may also include details about your use of this website, including:

  • Clicks

  • Internal links

  • Pages visited

  • Scrolling

  • Searches

  • Timestamps

We provide this information to Squarespace, our website analytics provider, to learn about site traffic and activity.

1.1 Cookies

This website uses cookies and similar technologies, which are small files or pieces of text that download to a device when a visitor accesses a website or app. For information about viewing the cookies dropped on your device, visit The cookies Squarespace uses.

1.2 For form block submissions

When you submit information to this website via webform, we collect the data requested in the webform in order to track and respond to your submissions. We provide this information to Squarespace, our website hosting provider, so that they can provide website services to us and help us manage our relationship with you.

1. 3 For website visitors

This website is hosted by Squarespace. Squarespace collects personal information when you visit this website, including:

  • Information about your browser, network and device

  • Web pages you visited prior to coming to this website

  • Web pages you view while on this website

  • Your IP address

Squarespace needs the data to run this website, and to protect and improve its platform and services. You can read more about how Squarespace uses your data (site usage information of end users) for its own purposes in their Privacy Policy.

1.4 Fonts

This website serves font files from and renders fonts using Google Fonts and Adobe Fonts. To properly display this site to you, these third parties may receive personal information about you, including:

  • Information about your browser, network, or device

  • Information about this site and the page you’re viewing on it

  • Your IP address

2. Legislative and Regulatory Framework

Draig Behaviour Consultancy processes personal data in accordance with the following legislation and professional standards:

  • UK General Data Protection Regulation (UK GDPR)

  • Data Protection Act 2018

  • Human Rights Act 1998 (Article 8 – Right to respect for private and family life)

  • Common Law Duty of Confidentiality

  • Health and Social Care (Quality and Safety) Regulations 2020 (where applicable to commissioned services)

  • Records Management Code of Practice for Health and Social Care (where applicable)

  • Safeguarding Vulnerable Groups Act 2006 (where relevant to service delivery)

This policy is underpinned by the UK GDPR principles set out in Article 5, and all processing of personal and special category data is carried out in accordance with these principles and associated legal obligations.

3. Purpose of This Policy

The purpose of this policy is to ensure that Draig Behaviour Consultancy processes personal data lawfully, fairly, transparently and securely when delivering behavioural consultancy services to residential care providers and associated organisations.

This includes ensuring compliance with statutory obligations, safeguarding individuals, and maintaining public trust in the handling of highly sensitive behavioural and health-related information.

4. Scope

This policy applies to:

  • The Director of Draig Behaviour Consultancy

  • Any associates, subcontractors or consultants engaged by the organisation

  • Any third parties processing data on behalf of the organisation

It applies to all personal data processed in both electronic and paper formats.

4. Data Protection Principles (Article 5 UK GDPR)

Draig Behaviour Consultancy complies with the six core principles of data protection:

  • Lawfulness, fairness and transparency (Art. 5(1)(a))

  • Purpose limitation (Art. 5(1)(b))

  • Data minimisation (Art. 5(1)(c))

  • Accuracy (Art. 5(1)(d))

  • Storage limitation (Art. 5(1)(e))

  • Integrity and confidentiality (Art. 5(1)(f))

The organisation also recognises its accountability obligation under Article 5(2), requiring evidence of compliance through documented policies, audits and governance controls.

5. Data Protection Governance and Responsibility

Draig Behaviour Consultancy operates a sole-director governance model.

The Director acts as the organisation’s Data Protection Officer (DPO) for operational purposes, with responsibility for:

  • Compliance with UK GDPR and the Data Protection Act 2018

  • Oversight of all data processing activities

  • Implementation of technical and organisational security measures

  • Monitoring compliance through monthly audits

  • Acting as the primary contact for data protection matters

This role reflects the size and structure of the organisation and ensures proportional governance in line with UK GDPR requirements.

6. Lawful Basis for Processing (Articles 6 & 9 UK GDPR)

Personal data is only processed where a lawful basis under Article 6 applies. In most cases, Draig Behaviour Consultancy processes data under:

  • Article 6(1)(b): Performance of a contract

  • Article 6(1)(c): Legal obligation

  • Article 6(1)(e): Public task (where acting on behalf of public sector commissioners)

  • Article 6(1)(f): Legitimate interests (service delivery and safeguarding)

Where special category data is processed (e.g. behavioural, health or disability-related information), an additional condition under Article 9 is applied, including:

  • Article 9(2)(h): Provision of health or social care or treatment

  • Article 9(2)(g): Substantial public interest (safeguarding and social care provision, Schedule 1 Data Protection Act 2018)

All special category processing is subject to an appropriate Schedule 1 condition and supporting documentation where required.

7. Types of Information Processed

Draig Behaviour Consultancy processes only the minimum data necessary to deliver safe and effective behavioural consultancy services.

This includes:

7.1 Client and Service User Information

  • Behavioural assessments and analysis

  • Positive Behaviour Support (PBS) plans

  • Incident and restraint records

  • Risk assessments

  • Care plans

  • Social services records of involvement and Case overviews

  • Statutory documents, including Deprivation of Liberty Orders

  • Assessment reports and records of involvement from other professionals

  • Health and diagnostic information (special category data)

7. 2 Professional and Organisational Information

  • Care provider staff details

  • NHS or local authority professional contact information

  • Commissioning documentation

  • Meeting notes and service correspondence

7.3 Business and Administrative Data

  • Contracts and service agreements

  • Invoices and financial records

  • Email correspondence

  • Supplier information

8. Data Collection and Minimisation

Data is obtained directly from:

  • Residential care providers

  • Local authority commissioners

  • Healthcare professionals

  • Family members

  • Direct behavioural observation and assessment

In accordance with Article 5(1)(c) UK GDPR (data minimisation), only data relevant and necessary for behavioural consultancy is collected. Unnecessary or excessive data is not retained or processed.

9. Information Use and Purpose Limitation

In accordance with Article 5(1)(b), data is only used for specified and legitimate purposes, including:

  • Delivery of behavioural consultancy services

  • Development of Behaviour Support Plans and interventions

  • Risk assessment and safeguarding support

  • Professional communication with care teams

  • Service evaluation and monitoring outcomes

  • Compliance with contractual and legal obligations

Data is not reused for unrelated purposes without further lawful basis.

10. Data Storage and Security (Article 32 UK GDPR)

Draig Behaviour Consultancy implements appropriate technical and organisational measures in line with Article 32 UK GDPR, including:

  • Microsoft OneDrive for Business cloud storage with encryption in transit and at rest

  • Multi-factor authentication for all system access

  • Role-based access controls restricting data to authorised users only

  • Password-protected devices

  • Regular software updates and antivirus protection

  • Secure disposal of digital and paper records

Monthly information governance audits are conducted to review access permissions, monitor system activity logs (where available), and confirm that no unauthorised access has occurred.

Cyber liability insurance is maintained to support organisational resilience and incident response.

11. Data Retention (Storage Limitation Principle)

In accordance with Article 5(1)(e), personal data is retained only for as long as necessary for the purposes for which it was collected.

Retention periods are determined based on:

  • Legal and regulatory requirements

  • Safeguarding considerations

  • Contractual obligations with commissioners

Typical retention periods include:

  • Client behavioural records: 8 years post-service (or longer if safeguarding requires)

  • Financial records: 6 years

  • Contractual documentation: 6 years

  • Associate records: 6 years

Records are securely destroyed using appropriate deletion or shredding methods.

12. Data Subject Rights (Articles 12–23 UK GDPR)

Individuals have the following rights under UK GDPR:

  • Right to be informed (Articles 12–14)

  • Right of access (Article 15)

  • Right to rectification (Article 16)

  • Right to erasure (Article 17)

  • Right to restrict processing (Article 18)

  • Right to data portability (Article 20)

  • Right to object (Article 21)

  • Rights relating to automated decision-making (Article 22)

Requests are managed by the Data Protection Officer and responded to within one calendar month unless legally extended.

13. Data Breach Management (Articles 33 & 34 UK GDPR)

All data breaches are reported immediately to the Data Protection Officer.

In accordance with:

  • Article 33, notifiable breaches are reported to the Information Commissioner’s Office within 72 hours where required

  • Article 34, affected individuals are notified without undue delay where there is a high risk to rights and freedoms

All breaches are recorded in an internal incident log, including root cause analysis and corrective actions.

14. Sharing of Information

Information is shared only where lawful, necessary and proportionate.

Recipients may include:

  • Residential care providers

  • Local authorities

  • NHS professionals

  • Safeguarding teams

  • Commissioners

  • Legal or regulatory bodies (where required by law)

No personal data is sold or used for marketing purposes.

15. Confidentiality and Professional Standards

All individuals working on behalf of Draig Behaviour Consultancy are bound by:

  • Confidentiality obligations under common law

  • Professional ethical standards relevant to behaviour analysis practice

  • Contractual confidentiality clauses

Confidentiality is maintained at all times unless there is a lawful safeguarding or legal disclosure requirement.

16. Data Protection by Design and Default (Article 25 UK GDPR)

The organisation applies data protection principles at the earliest stage of any new process, ensuring:

  • Minimal data collection

  • Access restriction by default

  • Secure system configuration

  • Privacy considerations embedded into service design

17. Electronic Communications

Electronic communication is managed securely:

  • Sensitive data is encrypted prior to emailing, with the password sent in a separate email in case of interception

  • Emails are restricted to necessary recipients

  • Files are shared via secure OneDrive links with access control

  • Devices are password protected and encrypted where possible

18. Training and Competence

The Director maintains ongoing awareness of UK GDPR obligations through professional development, guidance updates, and sector-specific information governance resources relevant to social care and behavioural consultancy.

19. Monitoring, Audit and Accountability

Draig Behaviour Consultancy maintains a documented audit cycle including:

  • Monthly access control reviews

  • Cloud storage security checks

  • Review of data processing activities

  • Review of incident logs and corrective actions

This supports compliance with the accountability principle (Article 5(2)).

20. Complaints and Regulatory Oversight

Complaints relating to data protection are handled internally in the first instance.

Individuals also retain the right to complain to the Information Commissioner’s Office (ICO).

21. Policy Review

This policy is reviewed annually or sooner where:

  • Legislative or regulatory changes occur

  • A significant data breach occurs

  • Service delivery changes materially affect data processing