Data Protection, Legal & Compliance Considerations

Forteau's operations will follow UK GDPR and data protection best practice:

• Register with the ICO (if required) and maintain a data processing register.
• Sign a Data Processing Agreement (DPA) with every client when handling personal data.
• Use GD‑compliant platforms (Breathe, Ciphr, Workable, etc.) and restrict access by role.
• Maintain secure backups and password policies (use enterprise SSO where possible).
• Provide audit logs and regular reports that can support a sponsor licence application.