Data Protection and Records Retention Statement

Last updated: 23 June 2026

1. Introduction

Albion Awards is being developed as a specialist awarding organisation focused on professional qualifications in governance, risk, assurance, cyber governance, board practice and organisational resilience.

This statement explains how Albion Awards intends to protect personal information, manage organisational records and retain information for appropriate periods.

Albion Awards is currently preparing for Ofqual recognition. The website, platform, qualification records, centre records and policy documents are being used for development, demonstration and recognition-readiness purposes. Albion Awards is not yet recognised by Ofqual and does not currently offer Ofqual-regulated qualifications.

2. Purpose of This Statement

The purpose of this statement is to provide a public summary of Albion Awards’ approach to:

data protection;
privacy;
records management;
records retention;
secure storage;
access control;
audit trails;
deletion and disposal;
regulatory evidence;
learner, centre and stakeholder information.

The full Data Protection and Records Retention Policy is retained as a controlled internal governance and regulatory evidence document.

3. Data Protection Commitment

Albion Awards is committed to handling personal information lawfully, fairly, transparently and securely.

We will seek to ensure that personal information is:

collected only where there is a clear purpose;
used only for appropriate and lawful purposes;
relevant and limited to what is necessary;
kept accurate and up to date where required;
retained only for as long as needed;
protected against unauthorised access, loss, damage or misuse;
handled in accordance with individual rights;
managed through clear responsibilities, records and accountability.

4. Types of Information We May Hold

Albion Awards may hold information relating to:

website visitors and enquiries;
learners and prospective learners;
approved and applicant centres;
centre staff;
assessors;
internal quality assurers;
external quality assurers;
contractors and consultants;
governance board members;
reviewers and advisers;
employers and stakeholders;
complaints, appeals and investigations;
reasonable adjustments and special considerations;
learner registration, assessment and certification;
platform users and audit records.

Information may include names, contact details, organisation details, role information, learner records, assessment records, centre approval records, quality assurance records, certification records, complaints records, appeals records, conflict declarations and platform activity records.

5. Special Category and Sensitive Information

Albion Awards may occasionally process special category or sensitive information where it is necessary and proportionate.

This may include:

disability, health or accessibility information for reasonable adjustment or special consideration requests;
equality and diversity monitoring information;
information connected with complaints, appeals, malpractice or maladministration investigations;
safeguarding, conduct or risk-related information where relevant;
conflict of interest declarations;
due diligence information for centre approval or governance purposes.

Access to sensitive information will be restricted to authorised individuals who need it for a legitimate purpose.

6. Lawful and Fair Processing

Albion Awards will only process personal information where there is an appropriate lawful basis.

Depending on the activity, this may include:

contract;
legal obligation;
legitimate interests;
consent;
substantial public interest where applicable;
other lawful bases where relevant to regulatory, quality assurance, learner protection or legal requirements.

Where consent is used, individuals will be told what they are consenting to and how they can withdraw consent.

7. Records Management

Albion Awards will maintain controlled records to support accountability, quality assurance and regulatory readiness.

Records may include:

governance records;
policy approval records;
risk registers;
conflict declarations;
centre approval records;
centre agreements;
qualification development records;
module records;
assessment approval records;
learner registration records;
assessment and results records;
certification records;
certificate verification records;
complaints records;
appeals records;
malpractice and maladministration records;
reasonable adjustment and special consideration records;
EQA reports;
standardisation records;
audit trail records;
platform test and security records;
regulatory evidence mapping records.

Records will be organised so that they can be located, reviewed, audited and retained appropriately.

8. Retention Principles

Albion Awards will not keep personal information or organisational records for longer than necessary.

Retention periods will be based on:

legal requirements;
regulatory requirements;
contractual requirements;
learner protection needs;
certificate verification needs;
audit and quality assurance requirements;
limitation periods for complaints, appeals or legal claims;
operational need;
risk and public interest considerations;
Ofqual recognition and evidence requirements where applicable.

Where records are no longer required, they will be securely deleted, destroyed, anonymised or archived, depending on the record type and purpose.

9. Indicative Retention Categories

Albion Awards will maintain a detailed retention schedule. The examples below indicate the types of records and the reasons they may need to be retained.

Record type	Indicative retention approach
Website enquiries	Retained only as long as needed to respond and maintain a reasonable contact record.
Centre applications	Retained for the application process and for a defined period afterwards for audit and due diligence purposes.
Approved centre records	Retained during the centre relationship and for a defined period after approval ends.
Centre agreements	Retained for the duration of the agreement and for a defined period afterwards.
Learner registration records	Retained to support learner identification, assessment, certification, appeals and verification.
Assessment and results records	Retained to support quality assurance, appeals, certification and regulatory evidence.
Certification records	Retained for an extended period to support certificate verification and replacement certificate requests.
Complaints and appeals	Retained for audit, investigation, quality assurance and legal or regulatory purposes.
Malpractice and maladministration records	Retained for investigation, risk, sanctions, regulatory evidence and future safeguarding of standards.
Reasonable adjustment and special consideration records	Retained to support audit, fairness, appeals and monitoring, with sensitive information protected.
Governance records	Retained to demonstrate accountability, oversight and decision-making.
Risk and conflict records	Retained to evidence governance, independence and control.
Platform audit trails	Retained to support security, traceability, investigation and regulatory evidence.
Financial and contractual records	Retained in line with legal, accounting and contractual requirements.

Specific retention periods will be confirmed in the Albion Awards records retention schedule and reviewed regularly.

10. Storage and Security

Albion Awards will store records securely using appropriate organisational and technical controls.

These may include:

role-based access controls;
password-protected systems;
restricted user permissions;
secure hosting arrangements;
backups;
access logs and audit trails;
controlled document storage;
version control;
confidentiality agreements;
secure deletion procedures;
data protection awareness for relevant personnel.

Records containing sensitive or special category information will be subject to additional access restrictions where appropriate.

11. Access Control

Access to records will be based on role, responsibility and legitimate need.

For example:

centre users should only access information relevant to their centre;
assessment personnel should only access assessment records relevant to their role;
EQA personnel should access centre and quality assurance records required for monitoring;
certification personnel should access learner achievement and certificate records required for certification;
governance and regulatory personnel should access evidence required for oversight and reporting;
public users should only access information intended for publication.

Access permissions will be reviewed as part of platform governance and system security controls.

12. Audit Trails

Albion Awards’ platform and document control arrangements are intended to support audit trails for key activities.

Audit trail records may show:

who created a record;
who changed a record;
when a change was made;
what approval status applies;
who approved or rejected a record;
when certification or verification activity occurred;
when complaints, appeals or actions were updated;
when centre or assessment records were reviewed.

Audit trails support accountability, traceability, quality assurance and regulatory readiness.

13. Accuracy and Review

Albion Awards will take reasonable steps to keep personal information and organisational records accurate and up to date.

This may include:

asking centres to maintain current contact details;
reviewing centre approval and staffing records;
checking learner identity information before certification;
reviewing assessment and results records before award;
updating policy records when reviewed;
maintaining version control for qualification and assessment documents;
correcting inaccurate records when identified.

Individuals may request correction of inaccurate personal information in accordance with the Albion Awards Privacy Notice.

14. Secure Disposal

Where records are no longer required, Albion Awards will dispose of them securely.

This may include:

secure deletion from digital systems;
deletion from backups in line with backup cycles;
secure destruction of paper records;
anonymisation where individual identification is no longer required;
controlled archiving where retention remains necessary.

Disposal decisions will take account of legal, regulatory, contractual, learner protection and audit requirements.

15. Data Breaches and Incidents

Albion Awards will maintain arrangements for identifying, recording, assessing and responding to data protection incidents.

Where a personal data breach occurs, Albion Awards will assess:

what happened;
what information was affected;
who may be affected;
the likely risk to individuals;
what containment action is required;
whether notification to affected individuals is required;
whether notification to the Information Commissioner’s Office is required;
what corrective action is needed.

Incidents will be recorded and reviewed to support learning and improvement.

16. Individual Rights

Individuals have rights in relation to their personal information.

These may include:

the right to be informed;
the right of access;
the right to rectification;
the right to erasure;
the right to restrict processing;
the right to object;
the right to data portability;
rights relating to automated decision-making;
the right to withdraw consent where processing is based on consent.

Further details are provided in the Albion Awards Privacy Notice.

Requests about personal information should be sent to:

info@AlbionAwards.org.uk

17. Sharing Records and Information

Albion Awards may share information where necessary and lawful.

This may include sharing information with:

approved centres;
assessors;
internal quality assurers;
external quality assurers;
service providers;
professional advisers;
regulators or public authorities where required;
employers or third parties for certificate verification where appropriate;
parties involved in complaints, appeals, malpractice or investigations.

Information will only be shared where there is a legitimate purpose and appropriate safeguards are in place.

Albion Awards will not sell personal information.

18. International Transfers

Where Albion Awards or its service providers process personal information outside the United Kingdom, appropriate safeguards will be considered and applied where required.

This may include contractual controls, supplier due diligence, transfer risk assessment or other recognised safeguards.

19. Public Records and Published Information

Some Albion Awards information may be published on the website, including:

public qualification information;
public module information;
approved centre information;
certificate verification information;
policy summaries;
recognition-status statements.

Albion Awards will ensure that public information is limited to what is appropriate and does not expose unnecessary personal information.

20. Responsibilities

Governing Body

Provides oversight of data protection, records governance, risk and accountability.

Responsible Officer

Ensures that data protection and records retention arrangements support regulatory readiness, learner protection and organisational accountability.

Data Protection Lead

Where appointed, provides operational oversight of data protection matters, incidents, rights requests and policy maintenance.

Staff and Contractors

Must handle information securely, follow Albion Awards policies and report concerns or incidents.

Centres

Must handle learner and assessment information securely and comply with Albion Awards data protection and records requirements.

System Users

Must use platform access responsibly and protect account credentials.

21. Review and Continuous Improvement

This statement will be reviewed at least annually, or earlier where required by:

legal or regulatory change;
changes to Albion Awards’ recognition status;
platform or system changes;
data protection incidents;
audit findings;
stakeholder feedback;
changes to records retention requirements;
updates to qualification, centre, assessment or certification processes.

22. Related Documents

This statement should be read alongside:

Privacy Notice;
Cookie Policy;
Website Terms of Use;
Data Protection and Records Retention Policy;
System Security and Backup Statement;
Platform Security and Audit Trail Statement;
Complaints Policy;
Appeals Policy;
Centre Agreement;
Centre Handbook;
Certification Procedure;
Governance Statement;
Responsible Officer Statement.

23. Contact

For questions about data protection, records retention or individual rights, contact:

Albion Awards
United Kingdom
Email: info@AlbionAwards.org.uk