JOINT
EMPLOYMENT

POLICY DOCUMENT LIBRARY

Company Policy Documents

Acceptable use of AI Adoption, surrogacy and adoption appointments Agency Workers Regulations (AWR) Compliance Annual Leave for Irregular-Hours and Part-Year Workers Annual leave for regular-hours workers Anti-Bribery and Anti-Corruption Anti-Slavery and Human Trafficking API & Integration Security Assignment endings, notice, redundancy and termination Assignment Rate Integrity Bank Account Change & Verification Bring Your Own Device (BYOD)Business Continuity & Disaster Recovery Code of Conduct Complaints Handling Conflict of Interest Contractor Onboarding Compliance Cookie Cyber Security Data Breach Notification Procedure Data Incident Response Data Protection and Privacy Data Protection and Privacy Data Retention Disciplinary, capability, suspension and appeals Drug & Alcohol Employment Status Determination Equality, bullying, harassment, sexual harassment and professional dress Equal Opportunities & Anti-Discrimination Ethics, anti-bribery, tax evasion, fraud and conflicts of interest Flexible working, occupational health, reasonable adjustments and menopause GDPR Statement Gender Pay Gap & Statement Grievance, complaints and workplace resolution Health and safety at PGS premises and client sites HMRC Enquiry & Investigation Response Holiday Pay Calculation & Accrual How We Use Your Data & Your Rights Under GDPR Inclusion & Equal Opportunities Information Security Insolvency Protection & Business Continuity Internet, Email & Social Media Use IT, communications, social media, artificial intelligence, monitoring and BYOD Joint Employment Model Joint & Several Liability (JSL) Mitigation Key Information Document (KID) Governance Learning, CPD, professional registration and competence Maternity, pregnancy and antenatal appointments Maternity, pregnancy and antenatal appointments Modern Slavery & Human Trafficking Modern Slavery Statement MSP Visibility & Data Access OCR & Automated Data Extraction Overpayment & Clawback Parental, neonatal, bereavement, caring and dependant leave Paternity and Bereaved Partner’s Paternity Leave PAYE Reconciliation & HMRC Alignment Payroll Fraud Prevention and Detection Payslip Accuracy & Validation Portal governance, review and no separate acknowledgement Privacy, confidentiality, intellectual property, company property and records Privacy Public duties, trade union rights and special leave Race & Disability Pay Gap Reporting Real-Time Payroll Data Transparency Referral & Introducer Transparency Remote & Hybrid Working Right to Work Check Process (UK)Safeguarding Shared Parental Leave — birth and adoption Sickness absence, Statutory Sick Pay, Company Sick Pay and Return Supply Chain Due Diligence Sustainability & Environmental, Social and Governance (ESG)Transparent Pay & Deductions Whistleblowing, Fair Work Agency and external reporting Whistleblowing Working time, attendance, rest, night work and opt-out Workplace Health & Safety Zero Tolerance Non-Compliance

People Group Services Limited
Company Number: 11570329

Data Breach Notification Procedure

Purpose

This document defines the operational process for reporting and managing a personal data breach in compliance with UK GDPR.

What is a Data Breach

A personal data breach is defined as:

A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

Examples include:

Sending payroll information to the wrong person
Unauthorised access to contractor records
Lost laptop containing personal data
Cyber-attack exposing system databases

Immediate Action

If a data breach is suspected:

Stop the incident if possible
Secure the affected system
Preserve evidence
Report immediately

Reporting Timeline

Employees must report a suspected breach immediately.

The organisation must assess and, if required, notify the Information Commissioner's Office within 72 hours.

Internal Escalation

The following individuals must be notified:

Compliance Officer / Data Protection Lead
IT Security Lead
Senior Management

If the incident involves client data, the relevant client may also need to be notified.

Breach Assessment

The following factors are assessed:

Type of data involved
Number of individuals affected
Sensitivity of data
Likelihood of harm to individuals
Whether the data was encrypted

ICO Notification

If the breach poses risk to individuals, notification will include:

Nature of the breach
Categories of data affected
Approximate number of individuals impacted
Measures taken to mitigate damage

Notification to Individuals

Individuals will be notified where the breach may result in:

Identity theft
Financial loss
Confidentiality compromise

Notifications will explain:

What happened
What information was involved
Actions taken
Advice to protect themselves

Incident Register

All breaches must be recorded in the company’s Data Breach Register.

This record includes:

Date and time
Nature of breach
Investigation findings
Corrective actions

Declaration

This Policy is approved by the Board of Directors of: People Group Services Limited Company Number: 11570329

Last updated: 10th March 2026