Skip to main content
Guidance

Data Protection

Published 27 October 2026

© Crown copyright 2026

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/policies-and-guidance-relevant-to-the-nws-supply-chain/data-protection

Policy Statement

This Data Protection policy statement sets out our commitment to complying with data protection law (UK GDPR along with the relevant amendments that the Data (Use and Access) Act 2025 has introduced and the Data Protection Act); following good practice; protecting the rights of staff, members of the public, external stakeholders and partners; being open about how we store and process individuals’ data; and protecting ourselves from the risks of a data breach. 

The scope of the Policy Statement applies to: 

  • All substantive and temporary employees of Nuclear Waste Services (NWS). 

  • Any individual, including contractors, members of the public, external stakeholders, or anybody working on behalf of NWS.

NWS commits to: We will achieve this by:
Supporting and upholding data subjects’ rights in line with UK GDPR and Data Protection Act 2018. We will ensure that data subjects are aware of their rights (listed below) and support them to be fulfilled when exercised; Right to access, Right to be informed, Right to restrict processing, Right to object, Right to rectification, Right to erasure, Right to data portability, Rights related to automated decision-making including profiling
Protecting personal data via a robust compliant approach aligned against the UK GDPR and Data Protection Act 2018. We will adhere to the UK GDPR principles and apply them consistently to personal data both within NWS and the supply chain. Lawfulness, fairness, and transparency. Purpose limitation. Data minimisation. Accuracy. Storage limitation. Integrity & Confidentiality. Accountability.
When initiating new personal data processing activities, or changing existing activities, we will ensure Data Protection by Design & Default is embedded. Data Protection by Design & Default will be achieved by performing the following; Data Protection Impact Assessments (DPIAs), Risk Management, Audit and Assurance activities, Records of Processing Activities (RoPA), Information Asset Owners (IAOs) and Information Asset Register (IAR) to enable us to map the personal data flows across the organisation and produce a reliable Data Map, Accountability Framework to provide assurance against the regulatory requirements from the ICO in line with UK GDPR, Governance fora leading to the Executive decision makers, By having an independent Data Protection Officer (DPO) in place that reports to the highest levels of the organisation, Having suitably qualified and experienced people (SQEP) in the Information Governance Team.
Data and Information used effectively and ethically. To achieve this, we will follow a data ethics approach and apply it where relevant/when appropriate by; Utilising a data ethics canvas to increase confidence and positive effect on people
Back to top