This policy document sets out the policies and procedures Cavendish Family Office (London) will comply when dealing with personal data.
Personal data must be protected in accordance with the provisions of the General Data Protection Regulation679/2016. Dependence on personal data for the normal conduct of business necessitates the creation of this policy to set out the procedures and measures to protect personal data.
This policy defines rules, procedures, and measures to collect, use, and store personal data in a GDPR-compliant manner and control and prevent unauthorised access to personal data. A breach of data security can lead to regulatory fines, an inability to provide services, loss of customer confidence, physical, financial and emotional damage to the affected persons.
This policy therefore discusses:
This policy defines the Cavendish Family Office (London) overall data protection objectives and procedures that we endorse.
This embodies the principles of data protection as described in Article 5 of the GDPR, namely:
A breach of this policy could have severe consequences to Cavendish Family Office (London), its ability to provide services or maintain the integrity, confidentiality, or availability of services.
Intentional misuse of data resulting in a breach of any part of this policy will result in disciplinary action at the discretion of the senior management of Cavendish Family Office (London). Severe, deliberate or repeated breaches of the policy by any employee may be considered grounds for instant dismissal, or in the case of a Cavendish Family Office (London) vendor, termination of their contracted services. All employees and vendors are bound by these policies and are responsible for their strict enforcement.
This policy applies to all Cavendish Family Office (London) and customer data assets that exist in any processing environment of Cavendish Family Office (London), on any media during any part if its life cycle.The following entities or users are covered by this policy:Full or part-time employees of Cavendish FamilyOffice (London) who have access to Cavendish Family Office (London)'s or customer data.
This document forms part of our conditions of employment for employees , contractual agreements for vendors, suppliers, and third party processor or agents, hereafter referred to as vendors. . All parties must read this policy completely, and confirm that they understand the contents of the policy and agree to abide by it.
The security of data can be understood through the use of a data life cycle. The typical life cycle of data is collection/generation, use, storage and disposal. The following sections provide guidance as to the application of this policy through the different life cycle phases of data.
Users of data assets are personally responsible for complying with this policy. All users will be held accountable for the accuracy, integrity, and confidentiality of the information to which they have access. Data must only be used in a manner consistent with this policy.
This policy has been written with the following goals in mind:
Cavendish Family Office (London)'s processing environment that this policy applies to is comprised of:
The CEO department is responsible for:
Other departments within Cavendish Family Office (London) also have various responsibilities for ensuring compliance with this policy, such as:
The CEO is responsible for regularly evaluating the data classification schema for consistent application and use.
Other departments and related entities have responsibilities to comply with this policy, such as:
All Cavendish Family Office (London) agents, vendors, content providers, and third party providers that process customer data must have a documented data protection policy that clearly identifies those data and other resources and the controls that are being imposed upon them.
All Cavendish Family Office (London) agents, vendors, content providers, and third party providers that access the Cavendish Family Office (London) processing environment and its data or provide content to it must have a security policy that complies with and does not contradict the Cavendish Family Office(London) data protection policy.
All agents, vendors, content providers, and third party providers must agree not to bypass any of our security requirements.
Data classification is necessary to enable the allocation of resources to the protection of data assets, as well as determining the potential loss or damage from the corruption, loss or disclosure of data.
To ensure the security and integrity of all data, the default classification for all data not classified by its owner must be Confidential.
The CEO is responsible for the classification of data.
The CEO is responsible for evaluating the data classification schema and reconciling it with new data types as they enter usage. It may be necessary, as we enter new business endeavours, to develop additional data classifications.
All data found in the processing environment must fall into one of the following categorie(s):PublicCompany Data – Public company data is defined as data that any entity either internal or external toCavendish Family Office (London) can access. The disclosure, use or destruction of Public company data will have limited or no adverse effects on Cavendish Family Office (London) nor carry any significant liability. (Examples of Public company data include readily available news, stock quotes, or sporting information.)
In order to classify data, it is necessary that an owner be identified for all data assets. The owner of the data isMark Estcourt.
The owner of data is responsible for classifying their data according to the classification schema noted in this policy.
The CEO is responsible for developing, implementing, and maintaining procedures for identifying all data assets and associated owners.
Data will be collected in accordance with Article 13 and 14 of the GDPR, confirming to the transparency principle and ensuring that the data protection principles are duly observed.
Data may be collected in the following ways:Data gathered as a result of contracts between vendors andCavendish Family Office (London).
Each mode of data collection should have a specific purpose accompanied by one or more of the legal bases as defined in the GDPR.
All users that access Cavendish Family Office (London) or customer data for use must do so only in conformance to this policy. Uniquely identified, authenticated and authorised users must only access and use data.
Data should be used only for the stated purpose of its collection or generation. Any purpose outside the defined scope will be considered “misuse of data” and will entail consequences for the involved parties.
Each user must ensure that Cavendish Family Office (London) data assets under their direction or control are properly labelled and safeguarded according to their sensitivity, proprietary nature, and criticality.
Access control mechanisms must also be utilised to ensure that only authorised users can access data to which they have been granted explicit access rights.
The general premise for the data storage period is:
All users that are responsible for the secure storage of Cavendish Family Office (London) or customer data must do so only in accordance with this policy.
Where necessary, data stored must be secured with encryption. This may include the use of confidentiality and/or integrity mechanisms. Specific cryptographic mechanisms are noted in the information security policy of Cavendish Family Office (London).
Access control mechanisms must also be utilised to ensure that only authorised users can access data to which they have been granted explicit access rights.
All users that access Cavendish Family Office (London) or customer data to enable its transmission must do so only in accordance with this policy.
The media used to distribute data should be classified so that it can be identified as confidential, and if the media is sent using a courier or other delivery methods, it should be accurately tracked.
No data can be distributed in any media from a secured area without proper management approval.
The CEO must develop and implement procedures to ensure the proper disposal of various types of data.These procedures must be made available to all users with access to data that requires special disposal techniques.
Data should be disposed of in a secure manner so that it is completely destroyed and no information can be obtained from the waste.
For paper records physical paper shredders will be used.
It is the responsibility of the CEO to facilitate the review of this policy on a regular basis. This policy will be reviewed Annually. Senior management should, at a minimum, be included in the Annually review of this policy.
