Data Protection Policy
A practical standard for handling personal information responsibly.
Purpose and scope
This policy sets the standard for personal information handled for KFC through paper files, branches, field work, email, the website and approved suppliers. It applies to directors, staff and anyone processing information on KFC’s instructions. The Privacy Notice explains how the standard relates to customers and other people whose information is used.
Keep collection proportionate
Before collecting information, record why it is needed, the lawful ground, who can use it and the retention rule. Collect the smallest useful set for that purpose. Check accuracy when information affects a lending decision or a customer’s rights. New uses require a fresh assessment rather than an assumption that the original enquiry permitted them.
Protect access and sharing
Use authorised accounts and access based on duties. Avoid personal storage accounts and uncontrolled exports of customer records. Limit paper-file access and maintain transfer records where appropriate. Supplier instructions, confidentiality, security responsibilities, deletion arrangements and incident reporting belong in written agreements.
Handle requests fairly
A request should be logged, its scope clarified and the requester’s identity checked using proportionate means. Search relevant systems, assess lawful exemptions, obtain approval where needed and send the response safely. Record the decision and applicable deadline. A refusal must have a reason and must explain the available complaint route.
Assess change before launch
Review new forms, analytics, scoring methods, partner integrations and overseas hosting before they receive personal information. Assess whether a data protection impact assessment, registration or specialist oversight is required. Do not advertise approvals, registrations or controls until the underlying evidence has been checked.
Respond and improve
Staff must promptly escalate loss, misdirected email, unauthorised access or other suspected exposure. Preserve evidence and assess notification obligations without waiting for a complete investigation. Review access, supplier compliance and overdue actions. Retain evidence that approved controls operate, rather than treating a published policy as proof of compliance.