Does it ring alarm bells with you when a contractor is unable to provide you with basic information about their data protection practices? A company that is working on your behalf but unable to tell you how they use the personal information you provide. It does with me. Even more so if they have no idea what I am talking about when I request a data protection policy. 
Recently one of my clients was talking to a company that operates their CCTV. I had asked for some information about their data protection practices. They went to my client to ask why we needed to see this evidence of compliance. They told my client they were a highly respected company, that they worked with the Home Office and various Police Forces. That may be the case, but that doesn’t mean they are handling the personal information they obtain in accordance with data protection legislation. We asked the company to provide their data protection policy. Two weeks later, it has still not arrived. For a company whose contract with my client states that the client is responsible for data protection compliance, it’s a disappointing lack of response.
If a company already has a data protection policy in place they should be able to provide that on request. A time delay, such as mentioned above, could imply that they do not have one and are creating one. Or worse, they don’t know where to start with data protection compliance and the personal information shared with them.
It’s not always the case that a contractor is evasive. There have been times where the contractor has been very honest about not knowing what they needed to do. On those occasions we have helped that company comply with data protection requirements. After all, it’s in our clients interest to make sure that those handling their business information know what they need to do.
If you are struggling with understanding what you should have in place, give us a call.