¶ Standard 2 — Data Security Policy
To define the responsibilities of all staff in protecting the confidentiality, integrity, and availability of personal confidential data and organisational information. This policy supports DSPT Standard 2 (Staff Responsibilities) and complements the Access Control Policy (Standard 1).
Applies to all employees, contractors, temporary workers, and third-party users who handle or have access to data within Veripath Limited.
- Every staff member is personally responsible for protecting the data they access.
- Data must not be disclosed to unauthorised persons, either verbally, electronically, or in hard copy.
- Staff must not use data for any purpose other than their legitimate work duties.
- Personal confidential data must be stored securely (locked cabinets, encrypted devices, password-protected systems).
- Unattended screens must be locked or logged off.
- Conversations containing sensitive information must be held in private spaces.
- Staff must not modify, delete, or create data without proper authorisation.
- All data entry must be accurate and timely.
- Suspicious changes or inconsistencies must be reported immediately.
- Staff must follow the organisation's business continuity and backup procedures to ensure critical data remains accessible during incidents.
- Any loss of access or system failure must be reported to IT support.
- Organisation-issued equipment and accounts are for business use only.
- Personal devices may only be used for work purposes with prior approval and appropriate security controls (e.g., encryption, antivirus).
- Software installation or modification is prohibited without IT authorisation.
- Any actual or suspected data breach (loss, theft, unauthorised access) must be reported to the Data Protection Officer within one hour.
- Staff must not attempt to investigate or remediate breaches themselves.
- The incident response procedure (Standard 6) will be followed.
¶ 7. Training and Awareness
- All staff must complete annual data security awareness training (Standard 3).
- Managers must ensure new starters receive induction on data security before being granted system access.
- Non-compliance with this policy may lead to disciplinary action, up to and including dismissal, and/or referral to relevant authorities.
- Data Protection Officer: Policy ownership, review, and enforcement.
- Line Managers: Ensuring staff understand and comply.
- All Staff: Adhering to the policy and reporting concerns.
All staff must read and acknowledge this policy. Signed acknowledgements are retained as evidence for DSPT Standard 2.
STAFF ACKNOWLEDGEMENT — DATA SECURITY POLICY (STANDARD 2)
I, _____________________________ (print name), confirm that I have read and
understood the Data Security Policy (Standard 2) and agree to comply with its
requirements. I understand that my data security responsibilities include:
- Protecting personal confidential data from unauthorised access or disclosure
- Maintaining the integrity and accuracy of data I handle
- Reporting any actual or suspected breaches immediately
- Completing annual data security awareness training
- Using organisation systems and data only for legitimate work purposes
I understand that non-compliance may result in disciplinary action.
Signature: ___________________________
Date: _______________________________
Line Manager (if applicable):
I confirm this individual has received appropriate induction on data security.
Manager Signature: ___________________ Date: _____________
Maintain a central log with the following columns:
| Staff Name |
Job Title |
Date of Acknowledgement |
Signed on File (Yes/No) |
Review Date |
|
|
|
|
|
- Each new joiner signs the acknowledgement prior to gaining system access.
- A copy is filed in the staff personnel record.
- The log is maintained by the DPO or HR.
- Existing staff reaffirm commitment annually (can be combined with data security training from Standard 3).
This policy will be reviewed annually or after any significant change to systems or data processing.