Data privacy policy: how Sterling handles personal data, everywhere it works.

Sterling International Consulting has adopted this policy as the framework for complying with applicable data protection laws when processing personal data. It covers the personal data of clients, suppliers, employees, contractors and website visitors, and the personal data inside client documents and records that we see during engagements. The Privacy notice explains what this website specifically collects. Where applicable data protection laws impose a higher standard than this policy, the law prevails.

Sterling and its employees are required to comply with this policy, and Sterling expects its business partners, including subcontracted consultants, to adhere to it as applicable to their roles and transactions, under contractual safeguards. Senior management is responsible for enforcing compliance, maintaining an appropriate governance structure and allocating the resources compliance needs. Personnel promptly notify Sterling's privacy contact (privacy@sterling-grc.com) and management if they suspect that this policy conflicts with a local legal obligation, or that a practice violates it. Sterling implements additional procedures where needed to comply with this policy and the law.

• Lawfulness and purpose limitation: personal data is processed lawfully, fairly and only for specified, explicit and legitimate purposes, on a legal basis: consent, a contract or steps before one, a legal obligation, or a legitimate interest not outweighed by the data subject's rights. Where consent is required we obtain it, keep a record of it and make it easy to withdraw.
• Data minimisation: we process the minimum personal data the purpose needs, rely on information that does not identify people where possible, and limit access to those who need to know.
• Integrity: we keep personal data accurate, complete and up to date, and correct or erase inaccurate data without delay.
• Storage limitation: personal data is kept no longer than necessary, then deleted, destroyed or anonymised under Sterling's retention rules, as the Privacy notice describes for website information and the engagement agreement for client work.
• Confidentiality: appropriate technical and organisational measures protect personal data against unauthorised or unlawful processing and accidental loss, including encryption and pseudonymisation where applicable, and we regularly review and test them.
• Accountability: we can demonstrate compliance through privacy by design, privacy impact assessments where processing presents a high risk, privacy notices, recorded staff training and periodic reviews and audits.
• Transparency: when we collect personal data we tell people who we are, what we process, why, who receives it, where it is transferred, how long it is kept and what their rights are, including the right to complain to a data protection authority.

We consider requests for access, correction, restriction, portability, deletion, objection and withdrawal of consent under applicable law. A request can reach us in any way and need not be labelled as one; staff pass it to Sterling's privacy contact immediately. We respond as soon as possible and within the period the applicable law sets. We verify the identity of the person asking, or their authority to act for someone else, before disclosing anything. If we cannot meet a request, for example because it is manifestly unfounded or would infringe another person's rights, we explain why, in a language and format the person understands. Requests go to privacy@sterling-grc.com; you do not need to be a client to ask about your own information.

Every processing activity rests on at least one legal basis; activities without one are not carried out. Special categories of personal data are processed only where the law permits, with the additional safeguards it requires. Personal data is not stored for future use. Client engagement data, including personal data within client documents and records, is processed only as the client instructs, only for the engagement and under the confidentiality terms of each contract. In practice, that means:

• We use information only for the purpose it was shared for: an enquiry to answer the enquiry, engagement material to deliver the engagement.
• We ask for no more than the work needs, and we prefer working copies and samples to full data sets.
• Access is limited to the Sterling team members working on the enquiry or the engagement.
• Before confidential material is exchanged, we agree with the client how it will be shared, where working copies are kept and what happens to them when the work ends.
• Service providers that process information for us do so under contract and only on our instructions.

Personal data is protected under Sterling's information security management system, described in the Information security policy. Sterling's offices in the United Arab Emirates, India and the Philippines hold ISO/IEC 27001 certification for their information security management systems; current certificate details are available on request. Personnel report a suspected personal data breach immediately, and breaches are handled under Sterling's breach procedure, including telling the people affected as soon as possible and notifying the relevant data protection authority as the law requires.

We disclose personal data only where the law requires or allows it, and bind carefully selected processors by contract. We transfer personal data across borders only as applicable laws allow, with safeguards such as transfer agreements where they are needed.

Employees who process personal data are trained regularly for their role, and attendance is recorded. Privacy notices are approved by Sterling's privacy contact before use, and an exception to the duty to inform is relied on only after consulting the privacy contact. The channels through which Sterling collects personal data are kept in a list, reviewed regularly. We keep records of processing activities where the law requires them, and carry out periodic reviews and audits. Exceptions are allowed only case by case, with management approval. Breaches by personnel lead to disciplinary action, and by third parties may end the relationship. Concerns about how we responded to a request can be raised under the Complaints and feedback policy.