GDPR Compliance & Website Rebuild for Supply Supply Ltd
How DLC Tech Solutions delivered a full UK GDPR baseline and rebuilt supplysupply.co.uk for a fast-growing recruitment business handling sensitive safeguarding data.
Overview
Supply Supply Ltd is a growing recruitment and staffing business operating in a sector that handles some of the most sensitive personal data imaginable, including DBS checks, safeguarding records, and candidate information for roles working with children and vulnerable adults. As the business scaled, compliance infrastructure hadn't kept pace. There were no formal data policies in place, no documented processes, and limited evidence that data was being handled in line with UK GDPR requirements.
DLC Tech Solutions was brought in to conduct a full GDPR discovery audit and deliver a baseline compliance package, giving Supply Supply Ltd the documentation, processes, and confidence to operate safely and demonstrate accountability to clients, regulators, and the schools it works with.
The Challenge
When Dave (Director) completed the DLC GDPR discovery questionnaire, the findings painted a familiar picture for a fast-growing business: the day-to-day operation was running well, but the compliance foundations simply hadn't been built yet.
Key Gaps Identified
- ●No formal Data Protection Policy in place
- ●No Privacy Notices for website visitors or candidates
- ●No documented Data Retention Policy
- ●No Subject Access Request (SAR) process
- ●No Data Breach Response Procedure
- ●No Record of Processing Activities (data mapping)
- ●Undocumented third-party data sharing with schools, payroll providers and DBS processors
Why This Mattered More for Supply Supply Ltd
Handling DBS checks and safeguarding-related data places any business into a higher-risk category under UK GDPR. Schools and public sector clients expect, and increasingly require, demonstrable compliance as a condition of working together. Without the right controls in place, a single complaint or data incident could trigger an ICO investigation at a time when there was no documented evidence of compliance to fall back on.
The Risk Landscape
To understand the stakes, it's worth putting the regulatory exposure in context. Under UK GDPR, the ICO has the power to issue fines of up to £17.5 million or 4% of annual global turnover, whichever is higher, for serious violations. Even lower-tier enforcement actions routinely result in fines of £1,000 to £50,000 or more.
But for a business like Supply Supply Ltd, the financial risk is arguably secondary to the reputational one. Schools and safeguarding-focused clients operate in an environment of heightened scrutiny and trust. A data breach, a complaint to the ICO, or simply being unable to evidence compliance during a procurement process could mean the loss of contracts that are fundamental to the business.
The Solution
DLC Tech Solutions delivered a structured, fixed-fee GDPR compliance package, practical, defensible, and built specifically around how Supply Supply Ltd actually operates.
Documentation Delivered
Data Protection Policy
Setting out the business's commitment and legal basis for processing.
Privacy Notices
For the website and for candidates going through the recruitment process.
Data Retention Policy
Defining how long different categories of data are held and when they are deleted.
Subject Access Request (SAR) Process
A clear, step-by-step procedure for handling requests from individuals.
Data Breach Response Procedure
An actionable plan for identifying, containing and reporting incidents.
Record of Processing Activities
A full data map covering what data is collected, why, how it is stored, and who it is shared with.
Third-Party Data Sharing Review
Documented data flows with schools, payroll and DBS processors, with DPAs in place where required.
"We knew we were handling sensitive data but hadn't got round to formalising how we manage it. DLC made the process straightforward, they explained where the risks were, didn't overcomplicate it, and gave us everything we needed to demonstrate we take compliance seriously. It was exactly what the business needed at this stage."
Dave Cummins, Director — Supply Supply Ltd
Website Rebuild
Alongside the GDPR compliance work, DLC Tech Solutions completed a full rebuild of supplysupply.co.uk. The new site was designed to reflect the professionalism and specialist focus of the business, while ensuring it met its obligations under UK GDPR from the ground up.
What Was Delivered
- Complete redesign and rebuild of supplysupply.co.uk
- GDPR-compliant cookie consent banner integrated from launch
- Candidate-facing and website privacy notices published
- Contact and enquiry forms built with compliant data handling
- Clean, professional design appropriate for school and public sector clients
Compliance Built In, Not Bolted On
One of the advantages of running the GDPR audit and the website rebuild in parallel was that compliance wasn't an afterthought. Cookie consent, privacy notices, and compliant data collection forms were integral to the new site from day one, not added later as a patch.
The Outcome
Supply Supply Ltd now has a complete, defensible compliance position under UK GDPR. If the ICO were to investigate, following a complaint, a breach, or a routine enquiry, there is now a documented paper trail demonstrating that the business takes data protection seriously and has the policies and procedures to back it up.
More practically, Dave and the team can now go into conversations with schools and public sector clients confident that, if asked about data protection, they have the right answers and the right documentation.
Project Summary
Ready to Get Started?
Contact us to discuss how we can support your organisation with practical, outcome-focused cyber security.
Get in Touch