Last updated: 21 October 2026

About these terms

These terms apply when Taylor Baines Ltd processes personal data on behalf of a client while delivering consulting or audit services. In that work the client is the controller and we are a processor. The terms form part of our contract with each client and are intended to meet Article 28 of the UK General Data Protection Regulation (UK GDPR), and of the EU GDPR where it applies.

If a client asks us to sign its own data processing agreement and we agree it in writing, that agreement takes precedence where the two differ. A signed copy of these terms is available on request from dpo@taylorbaines.co.uk.

Terms such as controller, processor, personal data, processing, and personal data breach have the meanings given in the UK GDPR. How we handle personal data as a controller (for example our own client contact details) is explained in our privacy and cookie policy.

1. Details of the processing

• Subject matter and purpose: delivering the consulting, audit, or assessment services described in our proposal or statement of work, such as reviewing policies, records, systems, and evidence, and reporting our findings.
• Duration: the length of the engagement, and then until the personal data is returned or deleted under section 10.
• Nature of the processing: viewing, receiving, storing, analysing, and referring to personal data in our working papers and reports, only as far as the services need.
• Types of personal data: business contact details of the client’s staff, and personal data contained in the records, logs, documents, and evidence we are given access to. We do not expect to process special category or criminal offence data. If an engagement needs it, we will agree this with the client in writing first.
• Categories of data subjects: the client’s employees, contractors, customers, suppliers, and other people whose details appear in the material we review.

Any details specific to an engagement are recorded in the proposal or statement of work.

2. Acting on the client’s instructions

We process the client’s personal data only on its documented instructions, including in relation to international transfers, unless the law requires us to do otherwise. In that case we will tell the client before processing, unless the law prohibits this. Our contract, proposal, and statement of work, and any further written instructions the client gives, are the client’s documented instructions. We will tell the client straight away if we think an instruction breaks data protection law.

3. Confidentiality

Everyone at Taylor Baines Ltd who can access the client’s personal data is bound by a duty of confidentiality, and has access only where they need it for the engagement.

4. Security

As information security professionals, we apply the same standards to our own business that we recommend to our clients. We take appropriate technical and organisational measures under Article 32 of the UK GDPR, including:

• reviewing personal data in the client’s own systems where we can, rather than taking copies, and keeping any copies to the minimum needed;
• encrypting devices and stored data, and protecting data in transit;
• multi-factor authentication and access limited to those who need it;
• keeping systems patched, protected against malware, and backed up; and
• securely deleting working copies when they are no longer needed.

5. Sub-processors

The client gives general authorisation for us to use the following sub-processors:

• Microsoft (Microsoft 365): email, calendar, and business documents.
• Dropbox: storing working files, including client working documents.
• Associate consultants or auditors: only where named in the proposal or statement of work, or agreed with the client in writing.

We will tell clients in advance about any intended addition or replacement, by updating this page and contacting clients with a current engagement, and the client may object on reasonable grounds. We put the same data protection obligations as in these terms on each sub-processor by contract, and we remain responsible to the client for their performance.

6. International transfers

We transfer the client’s personal data outside the UK only where the transfer is protected by UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework, where the recipient is certified), or by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

7. Helping the client meet its obligations

Taking into account the nature of the processing and the information available to us, we will help the client:

• respond to requests from people exercising their data protection rights, and pass on any request we receive directly without responding to it ourselves;
• keep the personal data secure;
• deal with personal data breaches; and
• carry out data protection impact assessments and any prior consultation with the regulator.

8. Personal data breaches

We will tell the client without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting its personal data. We will give the information we have about the breach, its likely consequences, and the measures taken or proposed, and keep the client updated as we learn more.

9. Records

We keep a record of the processing we carry out for clients, as required by Article 30 of the UK GDPR.

10. Return or deletion at the end of the engagement

At the end of the engagement, and at the client’s choice, we will return or delete the client’s personal data within 30 days, unless the law requires us to keep it. Our final report and the working papers we must keep as evidence for an audit may contain limited personal data. We keep these securely for as long as our contract or professional obligations require, and then delete them. We will confirm deletion in writing on request.

11. Information and audits

We will make available the information the client reasonably needs to show that these terms are being met. We will also allow and contribute to audits, including inspections, by the client or an auditor it appoints, with reasonable notice and at the client’s cost, normally no more than once a year unless there has been a personal data breach.

12. Liability and changes

Each party’s liability under these terms is as set out in our contract with the client. We may update these terms to reflect changes in law or in how we work. The version in force when an engagement starts applies to it unless we agree otherwise in writing.

13. Contact

For questions about these terms, or to request a signed copy, contact our Data Protection Officer at dpo@taylorbaines.co.uk.