Live Chat
1. Introduction
1.1 This policy explains how the Architects Registration Board (ARB) handles Personal Data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025 and, where relevant, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).
1.2 This policy applies to all ARB employees, Board members, Associates and third parties who have access to ARB’s systems or information. Everyone within scope must comply with this policy and seek advice from the DPO where they are unsure how it applies.
1.3 ARB is committed to protecting individuals’ rights and freedoms and processing Personal Data lawfully, fairly, transparently and only where there is an appropriate lawful basis. Consent is only one possible lawful basis and should be relied on only where appropriate.
1.4 ARB must apply data protection by design and default. Privacy and data protection requirements must be considered when designing or changing systems, services, projects and processes. Personal Data must be limited to what is necessary for each specified purpose.
1.5 Failure to comply with this policy may expose individuals and ARB to harm, regulatory action, financial penalties, legal claims and reputational damage. A failure to comply may also result in disciplinary action, up to and including dismissal.
2. Data Protection Principles
2.1 ARB is committed to processing data in accordance with its responsibilities under data protection legislation.
2.2 UK GDPR sets out the following principles that govern the processing of Personal Data:
a. Lawfulness, fairness and transparency: Personal Data shall be processed lawfully, fairly and in a transparent manner in relation to individuals;
b. Purpose limitation: Personal Data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes;
c. Data minimisation: Personal Data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
d. Accuracy: Personal Data shall be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that Personal Data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
e. Storage limitation: Personal Data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the Personal Data are processed; Personal Data may be stored for longer periods insofar as the Personal Data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the UK GDPR in order to safeguard the rights and freedoms of individuals; and
f. Integrity and confidentiality: Personal Data shall be processed in a manner that ensures appropriate security of the Personal Data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
3. Data Protection Officer (DPO)
3.1 ARB has appointed a DPO to advise on and monitor compliance with data protection law and to act as a contact point for individuals and the ICO. Responsibility for compliance remains with ARB and the relevant business owners. The DPO is Alice Pun, alicep@arb.org.uk.
3.2 The DPO must:
a. inform and advise ARB and its employees about their obligations under the UK GDPR and other data protection laws;
b. respond to enquiries from data subjects in a timely manner;
c. monitor compliance with the UK GDPR and other data protection laws;
d. maintain a programme to monitor compliance with this policy;
e. maintain a data protection training and awareness programme;
f. not be responsible for decisions on how ARB processes Personal Data on a day-to-day basis (so as to maintain independent scrutiny of those processes);
g. coordinate ARB’s handling of Data Subject rights requests and requests under FOIA;
h. advise ARB on whether a Personal Data Breach must be reported to the ICO or affected individuals and support any required notification;
i. advise on and monitor data protection impact assessments;
j. cooperate with and be the first point of contact for the ICO; and
k. be provided with information, resources and support by the SLG to assist in the discharge of these responsibilities.
3.3 The DPO will oversee and monitor ARB’s data protection compliance framework, including overseeing the maintenance of the following records and documentation:
a. Register of Data Processing Activities (ROPA);
b. Register of Data Subject right requests, data protection complaints and requests for information under FOIA;
c. Register of Data Protection Impact Assessments;
d. Register of Personal Data Breaches; and
e. Retention and Destruction Policy.
3.4 Relevant business owners are responsible for providing accurate and timely information to enable these records to be maintained and kept up to date.
The DPO will support ARB in ensuring that it pays the required data protection fee and that its ICO registration details remain accurate and up to date.
3.5 Contact details of the DPO shall be made publicly available and provided to the ICO.
4. Lawful, fair and transparent processing
4.1 It is the responsibility of all ARB staff, Board members and Service Providers to ensure that Personal Data is processed lawfully, and in line with the Data Protection Principles.
4.2 ARB must identify and document an appropriate lawful basis before processing Personal Data. The available lawful bases are consent, contract, legal obligation, vital interests, public task and legitimate interests. The appropriate basis depends on the purpose and context of the processing.
4.3 As a statutory body, ARB will commonly rely on legal obligation or public task. Contract, legitimate interests, vital interests or consent may apply in other circumstances. Staff must not assume that consent is required or appropriate.
4.4 Where ARB relies on consent, it must be freely given, specific, informed and unambiguous, and evidenced by a clear affirmative action. ARB must keep a record of consent and make it as easy to withdraw as to give. Withdrawal must be actioned promptly. Marketing communications must also comply with PECR where applicable.
Register of Processing Activities
4.5 ARB must maintain an accurate and up-to-date ROPA containing the information required by data protection law. Relevant business owners must provide the DPO with the information needed to maintain the ROPA and must notify the DPO before starting or materially changing any processing activity so that the lawful basis, privacy information, contracts, security requirements and any need for a DPIA can be considered. Processing must cease where there is no longer a lawful basis.
4.6 Data must only be retained for the period as defined within the Retention & Destruction policy.
Special Category Data
4.7 Special category data is Personal Data which is more sensitive, and so needs more protection. The types of special category data identified by GDPR are information revealing or concerning:
a. racial or
b. ethnic origin;
c. political opinions;
d. religious or philosophical beliefs;
e. trade union membership;
f. genetic data;
g. biometric data (where used for ID purposes);
h. health;
i. a person’s sex life; or
j. a person’s sexual orientation.
4.8 ARB must identify an Article 6 lawful basis and a condition under Article 9 UK GDPR before processing Special Category Data. Where required, ARB must also meet a condition in Schedule 1 to the Data Protection Act 2018 and have an Appropriate Policy Document in place. Relevant Article 9 conditions may include1:
a. the individual’s explicit consent;
b. required for compliance with employment, social security or social protection law;
c. processing is vital for the interests of the data subject or another person and they are incapable of giving consent;
d. the Personal Data has already been made public by the data subject;
e. processing is necessary for the establishment, exercise or defence of a legal claim;
f. necessary for the reason of substantial public interest (on the basis of UK law); or
g. necessary for archiving purposes in the public interest.
4.9 Criminal offence data may only be processed where ARB has an Article 6 lawful basis and legal authority under Article 10 UK GDPR and the Data Protection Act 2018. Where required, ARB must also have an Appropriate Policy Document in place.
Retention & Destruction policy
4.10 ARB must maintain a Retention & Destruction policy, with a schedule detailing standard periods for holding different types of information to meet the operational and statutory obligations of the organisation and to comply with legal and other requirements. This must be reviewed regularly to check it meets all necessary requirements and updated quickly when a change is required.
4.11 To meet the requirements of UK GDPR, the data must be held no longer than is necessary. Deeming how long it will be necessary to retain information will depend on a number of factors, including:
a. statutory requirements and limitation periods;
b. known industry best-practice and regulatory requirements;
c. the operational needs of ARB;
d. the difficulty of ensuring that the information remains accurate; and
e. the costs, risks and liabilities of data retention.
4.12 Personal Data must be securely deleted or destroyed in accordance with the Retention and Destruction Policy. Where immediate deletion from backup systems is not technically feasible, the information must be put beyond operational use and overwritten or deleted in accordance with the applicable backup cycle.
Privacy Notices
4.13 ARB must provide clear and accessible privacy information when Personal Data is collected and, where Personal Data is obtained from another source, within the period required by data protection law. Privacy information must be kept under review and updated where processing changes.
4.14 Privacy information must contain the information required by data protection law and must clearly explain how and why ARB processes Personal Data, who it may be shared with, how long it is retained, and the rights available to individuals.
5. Data Security
5.1 ARB must protect Personal Data against unauthorised or unlawful processing and accidental loss, destruction or damage by implementing appropriate technical and organisational measures.
5.2 Staff must only access, use or disclose Personal Data where necessary for their role. Personal Data must only be shared with individuals or organisations who are authorised to receive it and where there is a legitimate business need to do so.
Security measures must be appropriate to the risk, taking account of the nature, scope, context and purposes of processing, the likelihood and severity of harm, available technology and implementation costs.
5.3 Those security measures must be reviewed periodically to ensure they remain effective and commensurate with the risks of processing. Any updates must be communicated to the relevant teams and/or individuals.
5.4 The greatest risk to data security at ARB comes not from technological factors, but from human error. All staff must receive training appropriate to their role in handling data on the requirements of data protection legislation, the importance of data security, and the risks involved in their own data processing.
5.5 ARB staff should pay particular care when processing Personal Data outside of the office. They must follow guidance provided to them in the IT Usage policy.
5.6 Staff must use approved systems and methods when sharing or transferring Personal Data and seek advice from the DPO and IT where appropriate. Restricted international transfers must comply with section 6.3.
5.7 Personal Data must be securely deleted or destroyed in accordance with ARB’s Retention and Destruction Policy and approved IT processes. Physical records must be securely shredded or destroyed by an appropriately vetted provider.
6. Sharing of data
6.1 ARB may appoint third parties to carry out functions on its behalf. Where necessary, this may involve sharing Personal Data with those third parties.
6.2 Before appointing a third party to process Personal Data on ARB’s behalf, ARB must carry out proportionate due diligence and put in place a written contract meeting Article 28 UK GDPR. ARB must use only processors that provide sufficient guarantees regarding appropriate technical and organisational measures. For support with contractual arrangements or reviews, please reach out to Alice Pun, ARB’s Data Protection Officer.
6.3 ARB must not make a restricted transfer of Personal Data outside the UK unless the transfer is covered by UK adequacy regulations, appropriate safeguards or an applicable exception. Where appropriate safeguards are used, ARB must complete any required data protection test or transfer risk assessment and put in place the UK International Data Transfer Agreement, UK Addendum or other approved mechanism. The DPO must be consulted before any new restricted transfer is made.
7. Data Requests
Subject Access Requests
7.1 Under UK GDPR, all individuals have a right to know whether ARB holds any of their Personal Data, and access to that Personal Data. Requests for access to that Personal Data are known as Subject Access Requests (SARs).
7.2 SARs can be recognised as requests from an individual about information held about them. These requests can be made in writing (including via social media) or verbally. The requests will pertain to information held both by ARB as Data Controller, and by any Data Processors ARB has shared their Personal Data with.
7.3 All SARs must be passed to the DPO immediately, regardless of how they are received. Staff must preserve potentially relevant information and must not delete, alter or conceal information because a request has been made.
7.4 ARB will respond to a SAR without undue delay and normally within one month of receipt. The DPO will coordinate any necessary identity checks, clarification, searches, application of exemptions and extension of time. A fee may be charged or a request refused only where permitted by law.
Other Data Requests
7.5 Individuals may also have rights to rectification, erasure, restriction, data portability and objection, to withdraw consent, and rights relating to automated decision-making. The availability of a right depends on the circumstances and lawful basis. All such requests must be referred to the DPO immediately and handled within the applicable statutory timeframe.
Freedom of Information Act (FOIA) Requests
7.6 FOIA gives a general right of access to all types of recorded information held by public authorities, sets out exemptions from that right, and places a number of obligations on those authorities. Subject to any exemptions, anyone who makes a request to ARB for information must be informed whether ARB holds that information. If it does, that information must be supplied, subject to certain conditions.
7.7 ARB is required to adopt and maintain a publication scheme, setting out how it will publish the different classes of information it holds. ARB’s publication scheme is posted on the website.
7.8 Routine requests may be answered in the ordinary course of business where the requested information can be provided promptly. Any request that cannot be dealt with routinely, or which may engage FOIA, must be referred to the DPO without delay. A request does not need to mention FOIA to be valid.
7.9 Where the information requested is not publicly available, then the request shall be passed to the DPO, who will provide a response in line with ARB’s procedure for dealing with requests for information and the ICO’s FOIA guidance.
8. Data Breaches
8.1 A Personal Data Breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.
8.2 Anyone who becomes aware of an actual or suspected Personal Data Breach must report it immediately to the DPO using ARB’s approved reporting route. If the DPO is unavailable, it must be reported to a member of the SLG. Staff must not delay reporting while investigating the incident and should report any uncertainty.
8.3 ARB will notify the ICO and affected individuals where required by data protection law. Any required notification to the ICO must be made without undue delay and, where feasible, within 72 hours of ARB becoming aware of the breach.
8.4 The DPO will coordinate prompt containment, investigation and risk assessment with the relevant teams. ARB will document all Personal Data Breaches, including their facts, effects, decisions and remedial action.
9. Data Protection Impact Assessments (DPIA)
9.1 A DPIA is a process used to identify, assess and mitigate data protection risks arising from a project, system, process or change involving Personal Data.
9.2 A DPIA screening must be completed for any new or materially changed project, system or process involving Personal Data. Staff must contact the DPO at an early stage where a project may involve new uses of Personal Data, significant changes to existing processing, new technologies, large volumes of Personal Data, Special Category Data or other processing that could present a heightened risk to individuals.
9.3 A full DPIA must be completed where processing is likely to result in a high risk to the rights and freedoms of individuals. The DPO will advise whether a full DPIA is required. Where a full DPIA is not required, the reasons must be documented.
9.4 A DPIA will typically:
a. describe the proposed processing and its purpose;
b. assess whether the processing is necessary and proportionate;
c. identify and assess risks to individuals;
d. set out measures to mitigate those risks;
e. record advice received from the DPO; and
f. assess any remaining risks following implementation of mitigation measures
9.5 The relevant business owner is responsible for completing and implementing the DPIA with support and advice from the DPO. Completed DPIAs must be provided to the DPO and recorded in the DPIA Register. Where a high residual risk cannot be mitigated, ARB must consult the ICO before commencing the relevant processing.
10. Training and awareness
10.1 All employees, Board members, Associates and third-parties who handle Personal Data on behalf of ARB must receive appropriate data protection training during induction and refresher training at least every two years. Additional role-specific training must be provided where appropriate.
10.2 Training should cover the data protection principles and the contents and application of this policy.
10.3 ARB will maintain records of data protection training provided to employees, including the topics covered, attendees, and dates of training. These records will assist in demonstrating compliance with data protection obligations and may be subject to review by supervisory authorities or external auditors.
10.4 It is the responsibility of all ARB employees, Associates and third-party personnel to comply with data protection principles, policies and procedures, including when using third-parties acting on ARB’s behalf.
10.5 The effectiveness of the training and awareness program will be regularly evaluated by the DPO and SLG, and feedback from employees will be sought to identify areas for improvement. The policy will be updated as necessary to reflect changes in data protection laws and emerging best practices.
11. Complaints
11.1 Despite implementing appropriate data protection policies and controls, ARB may from time to time receive concerns or complaints from individuals regarding its collection, use, disclosure or other processing of their Personal Data.
11.2 ARB must:
a. provide individuals with a way to raise concerns or complaints about how we handle their Personal Data;
b. acknowledge receipt of a complaint as soon as reasonably practicable and in any event within 30 days;
c. take appropriate steps to investigate and respond to the issues raised, keep the individual informed of progress where appropriate; and
d. communicate the outcome of the complaint without undue delay.
11.3 ARB must inform individuals how to make a data protection complaint, including in relevant privacy information and responses to requests to exercise data protection rights.
11.4 If you receive a data protection complaint, you must forward it to the DPO without delay, preserve relevant records and avoid attempting to resolve it without the DPO’s involvement. ARB will maintain a record of the complaint, enquiries made, relevant communications and the outcome.
12. Artificial Intelligence
12.1 ARB may use approved artificial intelligence (AI) tools to support its operations and statutory functions. AI use must comply with applicable law, ARB policies and any conditions attached to approval.
12.2 AI must not be used to make a decision based solely on automated processing that produces legal or similarly significant effects unless the use has been specifically approved, is permitted by law and includes all required safeguards. Meaningful human oversight must be maintained where decisions may affect individuals.
12.3 Proposed AI uses involving Personal Data must be assessed for lawful basis, transparency, necessity, accuracy, fairness, security, retention, supplier access, international transfers and the need for a DPIA.
12.4 Employees, Board members, Associates and third-party personnel must not input or upload Personal Data, confidential information or other non-public ARB information into an AI tool unless the tool and the proposed use have been approved by the SLG, following consultation with the DPO and IT as appropriate, and appropriate safeguards are in place.
12. Glossary
“ARB” – Architects Registration Board
“Associates” – non-employees appointed by ARB to deliver services and carry out statutory obligations on its behalf
“Data Controller” – any person or entity which determines the purposes and manner in which any Personal Data is processed
“Data Processor” – any person who processes data on behalf of the Data Controller
“Data Protection Impact Assessment” – an assessment to identify and minimise data protection risks where processing is likely to result in high risk to individuals’ interests
“Data Subject” – the individual who is the subject of Personal Data
“DPO” – the Data Protection Officer appointed under the UK GDPR to advise on and monitor internal compliance and act as a contact point for individuals and the ICO
“Data Subject” – the individual who is the subject of Personal Data
“FOIA” – Freedom of Information Act 2000
“ICO” – Information Commissioner’s Office
“Personal Data” – any information relating to an identified or identifiable natural person
“Personal Data Breach” – a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed
“Service Provider” – any person or company employed by ARB to carry out a function on its behalf
“SLG” – ARB’s Senior Leadership Group
“UK GDPR” – the United Kingdom General Data Protection Regulation