Technical and Organisational Measures (TOMs)

Organisational Security Measures

Governance & Compliance

  • Our company operates a formal Data Protection and Information Security Framework aligned with GDPR and ISO27001.
  • We are in the process of attaining ISO27001 certification (Stage 1 audit complete, awaiting Stage 2).
  • A Data Protection Officer (DPO) is appointed to oversee compliance with data protection laws.
  • Regular internal and external audits are conducted to assess compliance with GDPR and security policies.
  • Staff undergo mandatory Data Protection and Cybersecurity training at least annually.

Data Processing & Minimisation

  • We process minimal personal data, limited to business contact details of client personnel.
  • We do not allow client data to be imported or stored on our systems.
  • We only process client data based on a contract or legitimate business need.
  • A Data Protection Impact Assessment (DPIA) is conducted for any high-risk processing activities.
  • Data Processing Agreements (DPAs) are signed with clients where required.

Technical Security Measures

Infrastructure & System Security

  • We use SaaS-based services (Microsoft 365, PipeDrive, Xero, etc.), reducing on-premise infrastructure risks.
  • Staff laptops are managed centrally through Microsoft Intune, ensuring security controls, updates, and remote management.
  • All devices have endpoint protection, including antivirus, firewalls, and threat detection.
  • Laptops are encrypted using BitLocker to protect data at rest.

Access Controls & Authentication

  • Role-based access control (RBAC) is enforced for all systems, ensuring least privilege access.
  • Multi-Factor Authentication (MFA) is required for all staff accessing company systems.
  • Single Sign-On (SSO) is implemented for supported SaaS applications.
  • Access to client systems (e.g., OneTrust) is restricted to authorised personnel.
  • Employee access is reviewed regularly, and access is revoked immediately upon role change or termination.

Data Transmission & Storage Security

Data is transmitted securely using TLS encryption for email and web services.

  • We do not store client data in our systems beyond necessary business communications.
  • Passwords are managed using a company-approved password manager, enforcing strong password policies.
  • Personal data is never shared via unencrypted channels (e.g., emails, public cloud storage).

Operational Security Measures

Incident Response & Business Continuity

  • A formal Incident Response Plan is in place for handling security incidents and data breaches.
  • Any data breach is reported in accordance with GDPR Article 33 & 34 timelines.
  • Employees are trained on security incident recognition and reporting.
  • Regular backups of key business systems are conducted, ensuring business continuity.

Third-Party Risk Management

  • All third-party service providers (e.g., SaaS platforms) undergo a security and compliance assessment before use.
  • Data Processing Agreements (DPAs) are in place with relevant third parties.
  • Vendor security and compliance are reviewed periodically to ensure ongoing protection.

Employee Awareness & Security Culture

  • Employees receive regular security awareness training to mitigate phishing, social engineering, and insider threats.
  • A strict Acceptable Use Policy is enforced to prevent misuse of company devices and data.
  • Leavers’ access is revoked immediately upon exit to prevent unauthorised access.