Data Protection, Data Management and Cyber Security Policy

1. Purpose and scope

Market Accents is committed to protecting personal information, confidential client materials and research data entrusted to the business.

This policy establishes the standards for collecting, managing, storing, accessing, sharing, retaining and securely disposing of information, together with measures to reduce cybersecurity risks.

It applies to all work undertaken by Market Accents, including research, consultancy, stakeholder engagement, interviews, surveys, marketing and business administration. It also applies to associates, contractors and third-party providers handling information on behalf of the business.

This policy complements Market Accents’ existing Privacy Policy and Copyright Policy.

2. Data protection responsibilities

Market Accents will process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

The Principal is responsible for overseeing data management and information security, including appropriate arrangements for project-specific research.

Market Accents will:

• Collect and process information for specified, legitimate purposes and on an appropriate lawful basis.
• Collect only the information reasonably necessary for the activity.
• Explain how personal information will be used, shared and retained.
• Maintain appropriate accuracy and confidentiality.
• Restrict access to authorised individuals.
• Respect individuals’ applicable data protection rights.
• Establish appropriate arrangements with clients, associates and third-party processors.

Where Market Accents processes information on behalf of a client, the respective data protection responsibilities will be established in the contractual arrangements.

3. Research data management

For research assignments, Market Accents will adopt proportionate data management procedures covering the full research lifecycle.

These include:

• Research planning: Identifying the information required, its intended use, lawful basis and any particular risks.
• Participant information and consent: Providing appropriate information to research participants and obtaining informed consent to participation and recording where required.
• Data collection: Using appropriate methods for interviews, surveys and stakeholder engagement, with particular care for vulnerable participants.
• Data separation: Where practicable, separating identifying information from research responses and using anonymisation or pseudonymisation.
• Analysis and reporting: Presenting findings in aggregated or anonymised form unless identification has been explicitly authorised and is appropriate.
• Retention and disposal: Establishing retention periods appropriate to contractual, research and legal requirements, followed by secure deletion or disposal.

Research will follow relevant professional standards, including the Market Research Society Code of Conduct where applicable.

4. Information security and cybersecurity

Market Accents will maintain security measures proportionate to the sensitivity of the information processed and the risks associated with its activities.

The following controls form the organisation’s minimum security standard:

• Access controls: Business information and research records will be accessible only to individuals who require them for authorised work.
• Account security: Strong, unique passwords and multi-factor authentication will be used where supported, particularly for email, cloud storage and accounts containing sensitive information.
• Device security: Devices used for business purposes will be protected through appropriate access controls, supported software, security updates and malware protection.
• Secure storage and transmission: Confidential and personal information will be stored and shared using appropriately secured systems, with encryption where warranted by the risks.
• Backups and recovery: Important business and project information will be backed up appropriately, with arrangements to recover information following loss or disruption.
• Third-party services: Providers handling personal or confidential information will be assessed for appropriate data protection and security arrangements.
• Remote working: Reasonable precautions will be taken to prevent unauthorised access to information when working remotely or travelling.

5. Confidentiality and information sharing

Client documents, commercial information, interview records and unpublished research will be treated as confidential unless otherwise agreed.

Information will be shared only with authorised recipients and for legitimate project or business purposes.

Associates and contractors will be expected to comply with relevant confidentiality, data protection and information security requirements.

External publication or disclosure of identifiable research information will require appropriate authorisation.

6. Data incidents and breaches

Any suspected loss, unauthorised disclosure, misuse or compromise of personal or confidential information must be reported promptly to the Principal.

Market Accents will:

• Take reasonable steps to contain the incident and protect affected information.
• Assess the nature, scale and potential consequences of the incident.
• Document the incident, actions taken and remedial measures.
• Notify relevant clients, regulators or affected individuals where legally or contractually required.
• Review controls and procedures to reduce the likelihood of recurrence.

Where a personal data breach is reportable under UK GDPR, the applicable notification requirements and timescales will be followed.

7. Data retention and secure disposal

Personal and research information will not be retained longer than necessary for its legitimate purpose, subject to applicable legal and contractual obligations.

Retention periods will be established according to the type of information and the requirements of each assignment.

At the end of the retention period, information will be securely deleted, destroyed or anonymised, as appropriate.

8. Compliance, review and continuous improvement

The Principal will oversee the implementation and periodic review of this policy.

Data management and cybersecurity arrangements will be reviewed when new technologies, working practices, research methods or regulatory requirements introduce material changes in risk.

Any external cybersecurity certifications held by Market Accents will be identified separately. Adoption of this policy does not itself constitute independent cybersecurity certification.

Approved by: Noreen Burroughes Cesareo
Date: June 1^st, 2026