Security Policy

● Protecting PKB systems, locations and information against unauthorised access.

● Protecting the Confidentiality, Integrity and Availability of the information we process in accordance with legislation, regulation, contractual requirements, and industry best practice. 

● Ensuring training, raising awareness and policy requirements are communicated to and provided to all employees. 

● Applying PKB security standards to our supplier and delivery partners.

● Ensuring actual or suspected breaches of information security are reported, assessed and investigated. 

● Ensuring security risks are identified and managed through the appropriate channels.

● Assessing and measuring the maturity of information security controls and delivering on continuous improvement measures. 

● Are clear about how personal information must be processed and our expectations for all those who process personal information on our behalf. 

● Comply with data protection legislation and apply good data privacy practices in our business areas. 

● Protect PKB’s reputation by ensuring the personal information entrusted to us is processed in accordance with individual subject rights. 

● Protect PKB from risks of personal data breaches and other breaches of data protection legislation. 

5.1 Executive Team 

PKB’s Executive team have a responsibility to define the organisation’s policy in respect of information security and data privacy and to ensure that sufficient resources are provided to support the requirements of this policy. 

5.2 Senior Information Risk Owner (SIRO)

The Chief Technology Officer and Senior Information Risk Owner has responsibility for the management and mitigation of information risk and advises the Executive team on the effectiveness of information risk management across the organisation. 

5.3 Data Protection Officer (DPO) 

The Data Protection Officer provides PKB with independent risk-based advice to support its decision-making in the appropriateness of processing personal and special category information within the principles and individual subject rights of the Data Protection Legislation together with managing responses to the Information Commissioner’s Office. 

5.4 Managers Responsibility 

Managers who are responsible for supervising staff undertaking work which involves the processing of personal information must ensure that staff are aware of and are applying PKB policies. Managers have a responsibility to: 

● Apply PKB policies in their business areas. 

● Ensure their teams are aware of the information security and data privacy requirements. 

● Ensure information security and data privacy initiatives are proactively supported within their business areas. 

● Ensure all staff within their business areas have undergone information security and data privacy training in accordance with PKB requirements. 

● Where requested by the Information Governance (IG) Team, help to document and maintain all processing of personal information within their business areas in accordance with guidance provided by the IG team. 

● Alert the IG team when they become aware of and assist with the investigation of any information security and data privacy incidents. 

● Ensure that the IG team are notified of any new processing activities or use of personal information for purposes it was not originally obtained so that the processing of the personal information register can be updated. 

● Where the processing of personal information is on behalf of a customer, the PKB member of staff leading the engagement with the customer is responsible for ensuring that personal information is only processed in accordance with the customer’s instructions and the contractual arrangements in place between PKB and the customer with any non-compliances escalated to the IG team. 

● Engage with the IG team, where it is necessary to appoint a third-party sub-processor of personal information in order to onboard the new supplier. 

5.5 Information Security (IS) Team 

The Information Security Team have a responsibility to: 

● Ensure information risks are identified, managed and mitigated. 

● Ensure only authorised users can access and share information in order to perform their roles. 

● Ensure technical, procedural and physical controls support agreed security measures. 

● Ensure our contractual and legal obligations relating to information security are met through the implementation of relevant information security standards and industry best practices. 

● Ensure incidents affecting our information assets are resolved and learnt from to improve our controls. 

● Ensure that individuals, including any third parties, are aware of their information security responsibilities. 

5.6 Information Governance (IG) Team 

The Information Governance Team have a responsibility to: 

● Ensure the maintenance of this and other PKB policies, procedures and standards meet information security and Data Protection legislative and regulatory requirements. 

● Provide advice and guidance to all business areas on data privacy matters. ● Ensure training and awareness materials are in place and are available for all staff. 

● Audit the register of processing activities in each business area for accuracy and lawfulness. 

● Manage responses to information security and data protection breaches.

● Maintain and report on the IG Improvement Plan. 

● Monitor and test our compliance status against our legal obligations. 

5.7 All Staff Responsibilities 

All staff, including permanent, temporary and contractor resources, that process personal information have a responsibility to ensure: 

● They report all suspected or actual information security and data privacy incidents to the support desk team, support@patientsknowbest.com in the first instance.

● They assist the IG team in investigating and resolving such incidents.

● All personal information is used in accordance with PKB policies, procedures and standards. 

● That advice is sought from the IG team where there is uncertainty around information security or data privacy matter. 

● All communications of personal information, verbally or in writing, are only disclosed to authorised persons who are entitled to receive that information. 

● Any queries relating to information security and data privacy are promptly directed to the IG team in the first instance. 

Personal Data means any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his/her physical, physiological, mental, economic, cultural or social identity. 

Special Categories of Personal Data (previously known as sensitive personal data) relate to racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. 

Examples of Personal Data and Special Category Data items are shown in the below table. 

(a) lawfulness, fairness and transparency - processed lawfully, fairly and in a transparent manner in relation to individuals. 

(b) purpose limitation - collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. 

(c) data minimisation - adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. 

(d) accuracy - accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay. 

(e) storage limitation - kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. 

(f) integrity and confidentiality - processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures. 

(g) accountability - there must be appropriate measures and records in place to be able to demonstrate compliance with all of the principles.