We maintain strict controls to ensure that personal data relating to service users, families, staff and professionals is processed securely and only by authorised personnel. Measures include:

• Role-based access controls to electronic records and systems, ensuring staff can only access information necessary for their role.
• Password-protected devices, multi-factor authentication where available, encrypted email systems, and secure cloud-based storage solutions.
• Anti-virus software, firewalls, endpoint protection, and routine software updates across all company devices.
• Secure backup and disaster recovery arrangements to ensure continuity of access to care records and operational systems.
• Secure retention and disposal procedures for both electronic and paper records, including confidential shredding.
• Business continuity and cyber incident response procedures to minimise disruption and ensure resilience of services.

All staff receive mandatory data protection, confidentiality, cyber security, and information governance training during induction and through annual refresher training. Staff are also required to sign confidentiality agreements as part of their employment.