GDPR Data Protection Policy

HC Digital Accessibility
Policy owner: Harrison Chambers
Version 1.1 | Prepared 11 October 2026

This policy sets out how HC Digital Accessibility must collect, use, store, share and dispose of personal information. It applies to consultancy, accessibility audits and snapshots, inclusive design, document work, training and any disabled user testing services when introduced. It is an internal policy and does not replace the separate privacy information given to individuals.

Responsibility and scope

Harrison Chambers is responsible for implementing and reviewing this policy. It applies to personal information in emails, digital files, project systems, recordings and paper records, and to anyone authorised to handle that information for the business. It supports compliance with the UK GDPR and the Data Protection Act 2018, as amended.

Before adoption, confirm the business’s legal identity, actual processing activities, supplier arrangements, retention periods and security controls. Requirements in this policy must be implemented in practice; the document alone does not demonstrate compliance.

Data protection principles

Personal information must be handled lawfully, fairly and transparently, for specified and legitimate purposes. Collect only what is needed, keep it accurate, and retain it only for as long as necessary. Protect it against unauthorised access, loss and damage. Keep records showing how these principles are met.

Controller and processor roles

For its own enquiries, client administration and business records, HC Digital Accessibility normally acts as a controller. Where client information is processed solely on the client’s instructions, agree the processor role and an Article 28 data processing agreement before work begins. Follow those instructions and promptly raise any instruction believed to breach data protection law.