Coventry 024 7531 2456 Dudley 01384 389522
info@irsgroup.co.uk
Policies & Compliance

Data Protection Policy

How IRS Group keeps personal data secure, handles data breaches and responds to requests, in line with UK GDPR and the Data Protection Act 2018.

Last updated: 23 September 2026

This policy sets out how IRS Group protects the personal data of the candidates, workers, clients and staff we deal with every day. It sits alongside our Privacy Notice, which explains to individuals what we collect and why.

1. Scope

This policy applies to both IRS Group companies, Industrial Recruitment Solutions Ltd and Industrial Recruitment Services Limited, and to everyone who handles personal data on our behalf: directors, office staff, consultants, temporary staff working in our offices and any contractor with access to our systems. It covers personal data in any form, whether on a computer, phone, paper file or spoken.

2. The law we follow

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and the Data (Use and Access) Act 2025. We are registered with the Information Commissioner's Office (ICO) as a data controller.

3. Our data protection principles

Whenever we handle personal data, we make sure it is:

  1. Used lawfully, fairly and in a way people would expect.
  2. Collected for clear, specific purposes and not used for anything unrelated.
  3. Limited to what we actually need. We do not ask for documents or information we do not need.
  4. Accurate and kept up to date.
  5. Kept no longer than necessary, in line with our retention periods.
  6. Kept secure against loss, theft, misuse and unauthorised access.

We are also responsible for being able to show that we follow these principles. We keep a record of what personal data we process, why, and the lawful basis for each purpose.

4. Responsibilities

  • The directors are ultimately responsible for data protection at IRS Group.
  • A nominated data protection lead oversees day-to-day compliance, handles requests from individuals and manages any data breaches. They can be contacted at info@irsgroup.co.uk.
  • Every member of staff must follow this policy, complete data protection training when they join and at regular intervals afterwards, and report any concern or breach straight away.

5. Sensitive information

Health information, criminal convictions and equality monitoring data need extra care. We only collect them where there is a clear legal reason or the person has given explicit consent. Access is restricted to the staff who need it, and this information is never shared with a client unless it is essential for the role and the person knows about it.

Identity and right to work documents are checked and copied only for the legal purpose they are required for. Original documents are always returned to the worker straight away. We never hold on to a worker's passport or ID.

6. Keeping data secure

  • Access to our systems is password protected and limited to the people who need it. Multi-factor authentication is used where available.
  • Screens are locked when unattended and devices are encrypted.
  • Paper records are kept in locked storage and a clear desk approach is followed at the end of each day.
  • CVs and candidate details are only sent to clients by secure methods and only for roles the candidate has agreed to be put forward for.
  • Personal data is not stored on personal devices or personal email accounts.
  • Paper records are shredded and electronic records permanently deleted at the end of their retention period.

7. Service providers

We only use service providers (such as payroll, registration form, IT and hosting providers) who can show they protect personal data properly. Each one works under a written contract that requires them to act only on our instructions and keep the data secure. Where a provider processes data outside the UK, we make sure appropriate legal safeguards are in place.

8. Retention and disposal

We keep personal data for the periods set out in our Privacy Notice. Records are reviewed regularly and securely deleted or destroyed when they are no longer needed.

9. Data breaches

A data breach is any event that leads to personal data being lost, destroyed, altered, disclosed or accessed without authorisation, whether by accident or on purpose. For example, a CV emailed to the wrong person or a lost phone.

  1. Any member of staff who discovers or suspects a breach must report it to the data protection lead immediately.
  2. We act quickly to contain the breach and recover the data where possible.
  3. We assess the risk to the people affected.
  4. Where there is a risk to people's rights and freedoms, we report the breach to the ICO within 72 hours of becoming aware of it.
  5. Where the risk is high, we tell the people affected without undue delay and explain what they can do to protect themselves.
  6. We record every breach, including those we do not need to report, and what we did to stop it happening again.

10. Requests from individuals

Anyone can ask to see the personal data we hold about them, or use their other data protection rights. A request can be made verbally or in writing, to any member of staff. Staff must pass it to the data protection lead straight away. We confirm the person's identity, then respond within one month. Where a request is complex we can extend this by up to two further months, and we tell the person why.

11. New systems and changes

Before we introduce a new system or a new way of using personal data that could create a high risk to individuals, we carry out a data protection impact assessment to identify and reduce those risks.

12. Review

This policy is reviewed at least once a year, and sooner if the law or our business changes.