Data Protection Policy

Purpose

lawful and secure processing of personal information

Scope

This policy applies to UKG personnel, contractors, subject-matter experts, assessors, decision-makers, administrators and candidates to the extent relevant to their role.

Mandatory controls

• UKG identifies purposes and lawful bases for processing.
• Only necessary data is collected and retention periods are defined.
• Data-subject rights and privacy enquiries are handled through controlled procedures.
• Processors and international transfers are assessed and contractually controlled.
• High-risk processing such as identity evidence, proctoring or AI requires additional assessment and safeguards.

Required records

• Processing records, retention schedule, vendor controls, rights requests and incidents.

Review and control

This controlled document is reviewed at least annually and whenever there is a material legal, scheme, technology, risk or accreditation change. The English master controls; translations must be reviewed after a material English change.