BUSINESS CONTINUITY AND DISASTER RECOVERY POLICY
This policy was approved by the Committee of Management on 22 July 2026 It should be reviewed again no later than 30 June 2029, or earlier following any significant incident, test exercise, legislative change or material change to WGHC’s operating arrangements.
The policy has been assessed through the organisational impact assessment process. We can, if requested, produce this document in different formats such as larger print or audioformat We can also translate the document into various languages, as appropriate.
SCOTTISH
HOUSING
STANDARD 1
The governing body leads and directs the RSL to achieve REGULATOR good outcomes for its tenants and other service users. STANDARDS
STANDARD 2
The RSL is open about and accountable for what it does. It understands and takes account of the needs and priorities of its tenants, service users and stakeholders. Its primary focus is the sustainable achievement of these priorities.
STANDARD
3
The RSL manages its resources to ensure its financial well-being, while maintaining rents at a level that tenants can afford to pay.
STANDARD 4
The Governing body bases its decisions on good quality information and advice and identifies and mitigates risks to the organisation’s purpose.
STANDARD 5
The RSL conducts its affairs with honesty and integrity.
STANDARD 6
The Governing body and senior officers have the skills and knowledge they need to be effective.
1.0 INTRODUCTION
WGHC recognises that serious disruption to services, systems, premises, staffing or supply chains can affect its ability to deliver essential services to tenants, service users, staff, contractors and other stakeholders.
This Policy sets out WGHC’s approach to business continuity and disaster recovery so that the organisation can prepare for, respond to, manage and recover from disruptive incidents in a controlled and effective manner.
This Policy is intended to support compliance with relevant statutory, regulatory and bestpractice requirements, including the Scottish Housing Regulator’s Regulatory Framework and Notifiable Events guidance, the Health and Safety at Work etc. Act 1974, fire safety and emergency planning duties, UK GDPR and the Data Protection Act 2018, equality and human rights duties, and recognised business continuity good practice including the principles of ISO 22301.
The Policy supports good governance, risk management and organisational resilience by ensuring that critical activities are identified, recovery arrangements are documented, responsibilities are clear, and plans are tested and reviewed regularly.
This policy should be read in conjunction with:
WGHC’s Fire Safety Policy 2025,
Risk Management Policy and Risk Register V1.0 2026,
Information Security, Communications & Technology, including cardholder data, Policy:
On Call, Call Out and Out of Hours Working Policy 2025,
Emergencies and Disaster, Business Continuity Impact 2026, and
WGHC Gas Safety Policy and Procedures, 2025
The aims of this Policy are to ensure that WGHC can maintain or restore essential services within acceptable timescales following a disruptive incident and protect;
tenants,
service users,
staff,
assets,
data and reputation;
and minimise financial, operational and regulatory impacts;
and support effective communication with stakeholders during and after an incident.
The objectives are to define roles and responsibilities; establish clear escalation and decisionmaking arrangements; identify critical activities, systems, premises and suppliers; maintain disaster recovery and business continuity plans; and ensure lessons learned are captured after incidents, tests and exercises
Document Name: Created:
Owner:
Version: Version Date:
2.0 SCOPE
This Policy applies to all WGHC services, staff, Committee members, contractors, consultants and third-party providers who support the delivery of WGHC’s activities. It covers disruption affecting people, premises, information technology, communications, data, key suppliers, utilities, finance, governance and tenant-facing services.
It applies to incidents that interrupt, or could reasonably be expected to interrupt, WGHC’s ability to operate from the office, manage the estate, communicate with tenants and stakeholders, access ICT systems, instruct contractors, manage emergencies or provide essential services.
It is supported by procedures that cover loss or interruption of water, gas, electricity, broadband, telephone lines, server access, cloud-hosted systems, office fire, denial of access to the office or estate, and external events outside WGHC’s control such as major road closures, severe weather, emergency service cordons or utility provider failures.
3.0 ESSENTIAL BUSINESS ACTIVITIES
For business continuity purposes, WGHC’s essential activities are those which must be maintained or restored as quickly as reasonably practicable to protect tenants, staff, assets, income, governance and statutory compliance.
These include:
emergency repairs,
emergency scenarios, i.e. fire / flood,
tenant safety and welfare contact,
communications,
rent and finance functions,
payroll,
ICT access,
data protection,
contractor instruction,
insurance notifications,
Committee reporting and
regulatory notifications where required
Each essential activity should be supported by a proportionate business impact assessment identifying key dependencies, minimum service levels, maximum tolerable period of disruption, recovery time objective, recovery point objective where data is involved, responsible lead officer, deputy arrangements and priority recovery actions.
Non-essential activities may be paused, reduced or rescheduled during an incident where this is necessary to protect people, maintain critical services or focus resources on recovery. Any suspension of normal services should be approved by the Incident Lead and recorded in the incident log.
Document Name: Created:
Owner:
David Mills / WGHC
David Mills / WGHC
Version:
4.0 RESPONSIBILITIES
The Committee of Management has overall responsibility for ensuring that WGHC has appropriate disaster recovery and business continuity arrangements in place. The CEO / COO and Senior Management Team are responsible for implementing this Policy, maintaining plans, allocating resources, and reporting significant risks, incidents and assurance information to the Committee.
Managers are responsible for identifying critical activities within their service areas, maintaining local recovery arrangements, ensuring staff understand their roles, and supporting testing and review. All staff must comply with this Policy, follow instructions during an incident, report risks or disruptions promptly, and maintain awareness of relevant continuity procedures.
5.0 ACTIVATION AND COMMAND STRUCTURE
The Chief Executive, or the Chief Operating Officer or most senior available manager may activate the procedures where delay could increase risk to people, homes, services, systems or assets.
For the purposes of this Policy, the Incident Lead is the senior officer responsible for overall incident direction, decisions and communications. The Incident Controller coordinates the immediate operational response and reports to the Incident Lead. Where the same person performs both roles, this must be recorded in the incident log. Deputies should be identified for the Chief Executive Officer, Chief Operating Officer, ICT Lead, Property and Maintenance Lead, Finance Lead and Communication Lead.
Role Responsibility
Governing Body
Chief Executive Officer
Chief Operating Officer
Incident Controller
Fire Marshals
Departmental Teams
ICT Lead
All Employees
Contractors and Visitors
Approve the policy, provide resources and oversee organisational resilience.
Assess impact, activate procedures, chair incident meetings, approve communications, maintain decision log and authorise recovery actions. Communications liaison with Press / SHR etc.
Own the policy, ensure business continuity arrangements are maintained and authorise major recovery decisions.
Coordinate the immediate incident response, make escalation decisions and liaise with emergency services where required.
Support evacuation, sweep designated areas where safe, report to the assembly point coordinator and prevent re-entry until authorised.
Maintain local continuity plans, identify critical activities and ensure staff understand emergency arrangements.
Coordinate estate inspections, emergency repairs, contractor attendance, utility liaison, make-safe works and tenant safety actions.
Assess ICT impact, liaise with ICT providers, prioritise restoration, protect data, arrange alternative access and advise staff on workarounds.
Follow emergency procedures, participate in training and drills, report hazards and comply with instructions during incidents.
Follow site rules, evacuation instructions and directions from authorised staff.
6.0 INCIDENT RESPONSE PRINCIPLES
Protect life, health and safety first.
Follow emergency service instructions and do not re-enter unsafe premises.
Escalate through the On Call, Call Out and Out of Hours Working Policy 2025 when incidents occur outside normal working hours.
Use the Risk Management Policy and Risk Register V1.0 2026 to assess likelihood, impact, controls and residual risk.
Maintain a written incident log recording times, decisions, actions, owners, communications and evidence.
Protect personal data and confidential information in line with the Information Security, Communications & Technology, including cardholder data, Policy and data protection requirements.
Prioritise critical services to tenants, emergency repairs, safeguarding, payments, communications and statutory duties.
Do not resume normal operations, allow re-entry or reopen an affected location until the Incident Lead is satisfied that serious danger no longer remains and any required competent advice has been obtained.
Consider at the earliest opportunity whether the incident may require notification to the Scottish Housing Regulator, insurers, funders, emergency services, the Information Commissioner’s Office, contractors, local authority or other relevant bodies.
7.0 RISK MANAGEMENT POLICY AND RISK REGISTER
This Policy should be read in conjunction with the WGHC Risk Management Policy and the WGHC Risk Register. Disaster recovery and business continuity risks, including risks relating to service disruption, cyber security, loss of premises, staffing pressures, supplier failure, data loss, financial impact and reputational damage, should be identified, assessed, recorded and monitored through WGHC’s established risk management arrangements.
Where significant business continuity or disaster recovery risks are identified, these should be escalated in line with the WGHC Risk Management Policy and, where appropriate, included or updated within the WGHC Risk Register.
The Risk Register should be used to record the nature of the risk, existing controls, further actions required, responsible officers, target dates and review arrangements. Outcomes from incidents, tests, exercises and reviews should also be considered when updating the Risk Register.
8.0 BUSINESS CONTINUITY ARRANGEMENTS
WGHC will maintain Business Continuity Plans that identify critical services, key contacts, dependencies, alternative working arrangements, communications requirements, recovery priorities and escalation arrangements. Plans will include arrangements for loss of premises, loss of IT or telephony, cyber incident, severe weather, utility failure, supplier failure, staff shortage, major health and safety incident, and other events that could materially disrupt services.
Version:
Business Continuity Plans should also include current emergency contact lists, staff cascade arrangements, contractor and supplier contacts, manual workarounds, incident log templates, decision log templates, situation report templates, communication templates and arrangements for staff welfare during prolonged incidents.
Key suppliers and contractors should be assessed according to their importance to critical services. WGHC should maintain alternative supplier options where reasonably practicable and seek assurance that critical suppliers have appropriate continuity, escalation and emergency contact arrangements.
Finance and payment continuity arrangements should cover urgent payments, payroll, banking access, card/payment security, delegated authorities, invoice processing, rent accounting and manual reconciliation where systems are unavailable.
9.0 DISASTER RECOVERY ARRANGEMENTS
WGHC will maintain disaster recovery arrangements for its IT systems, applications, data, networks and communications. These arrangements will include backup processes, restoration procedures, system priorities, recovery time objectives, recovery point objectives, cyber incident escalation, supplier contacts and responsibilities for authorising recovery actions.
Recovery priorities should be agreed in advance for critical systems and data. Backups and restoration arrangements must be tested periodically, with evidence retained of the outcome, issues identified and actions taken to address any gaps between planned and actual recovery capability.
10.0 STAKEHOLDER COMMUNICATIONS
WGHC will communicate with tenants, staff, Committee members, contractors, regulators, funders and other stakeholders as appropriate during a disruption. Communications will be timely, accurate, accessible and proportionate to the incident. Where normal communication channels are unavailable, alternative channels will be used where practicable.
11.0 LOSS OR INTERRUPTION TO WATER SUPPLY
Where water supply to the WGHC office or estate is interrupted, staff must establish whether the issue is internal, property-specific, estate-wide or due to the external water network.
The Property and Maintenance Lead will contact the relevant utility provider, arrange inspections if or where necessary and prioritise vulnerable tenants, hygiene, sanitation, fire safety systems and any plant or equipment dependent on water.
Confirm the affected location, start time, scale and likely duration.
Notify tenants and staff where disruption affects health, hygiene, access to services or office opening arrangements.
Arrange bottled water, welfare checks or alternative facilities where required, prioritising vulnerable tenants and staff.
Where office welfare facilities are unavailable, consider temporary closure, remote working or relocation to alternative premises.
Document Name: Created:
Owner:
12.0 LOSS OR INTERRUPTION TO GAS SUPPLY
Gas supply interruption may affect heating, hot water, cooking, plant, tenant welfare and office working conditions.
If a gas escape, suspected leak or carbon monoxide risk is reported, staff must treat this as an emergency, advise evacuation where appropriate, contact emergency services or the gas emergency service and arrange competent contractor attendance.
Do not operate electrical switches or create ignition sources where a leak is suspected.
Ensure affected persons move to a safe location and follow emergency service advice.
Confirm whether the issue affects the office, individual properties or wider estate.
Arrange emergency heating, temporary decant, welfare contact or alternative accommodation where required.
Use out-of-hours call-out arrangements for urgent tenant safety, heating or hot water issues.
Please refer to WGHC Gas Safety Policy and Procedures, 2025.
13.0 LOSS OR INTERRUPTION TO ELECTRICITY SUPPLY
Electricity loss may affect office access, lighting, heating, alarms, fire safety systems, lifts, door entry, tenant communications, ICT equipment and remote access.
The Incident Lead will determine whether the office should remain open, close temporarily, move to remote working or relocate to alternative premises.
Check staff and tenant safety and confirm whether emergency lighting, alarms and access systems are operating.
Contact the electricity network provider, landlord, factor or contractor as appropriate.
Prioritise vulnerable tenants, medical equipment dependency, lift failures, door entry failures and sheltered or higher-risk properties.
Use mobile phones, laptops, battery packs and alternative working locations where safe and available.
If power loss affects ICT or security, follow ICT incident steps and ensure data is protected.
14.0 ICT, BROADBAND, TELEPHONE & CLOUD SERVICE INTERRUPTION
ICT disruption includes loss of broadband, telephone lines, server access, cloud-hosted systems, Microsoft 365, Outlook, shared drives, housing management systems, cyber incidents or supplier outages.
The ICT Lead will liaise with either the CEO / COO and assess the impact, contact ICT support providers and prioritise restoration of email, telephony, tenant communication, repairs reporting, finance, payroll, data access and Committee reporting.
Confirm whether the issue affects one user, the office network, telephone lines, remote users, hosted systems or a supplier platform.
Use approved alternative communication channels such as mobile phones, redirected calls, text messaging, website updates or agreed social media posts.
Do not use unapproved personal accounts or unsecure storage for WGHC data.
Where Microsoft 365, Outlook or cloud services are unavailable, use pre-agreed offline contact lists, paper forms and manual logs until systems are restored.
Record all manual transactions for later entry and reconciliation once systems return.
Where an ICT or cyber incident involves personal data, immediately escalate to the responsible officer for data protection so that the incident can be contained, logged, riskassessed and, where required, reported to the Information Commissioner’s Office within 72 hours of WGHC becoming aware of the breach. Affected individuals must be informed without undue delay where there is a high risk to their rights and freedoms.
Escalate suspected cyber incidents immediately and preserve evidence.
15.0 OFFICE FIRE
All fire-related actions must follow the Fire Safety Policy 2025. Staff must raise the alarm, evacuate immediately, call the emergency services where required and proceed to the designated assembly point. No person should re-enter the building until authorised by the emergency services or competent person.
Raise the alarm immediately and call the Fire and Rescue Service where required.
Evacuate by the nearest safe route using clearly marked escape routes and exits.
Do not use lifts during a fire evacuation unless specifically designated and authorised for evacuation use.
Close doors behind you (where safe to do so) to help limit fire and smoke spread.
Proceed directly to the designated assembly point and remain there until instructed otherwise.
Managers, fire wardens or nominated staff should account for staff, visitors and contractors using signing-in records, diaries or known attendance information.
Visitors, contractors and anyone requiring assistance must be supported in line with local evacuation arrangements and any Personal Emergency Evacuation Plan.
No person may re-enter the building until authorised by the Fire and Rescue Service or another competent person.
WGHC must ensure that escape routes remain unobstructed, emergency exits open easily, emergency lighting and signage are maintained where required, and staff are trained in fire evacuation arrangements. Fire drills and evacuation learning should be recorded and any issues acted upon promptly.
Where the premises are shared or neighbouring premises may be affected, WGHC should coordinate with the landlord, managing agent, neighbouring occupiers and emergency services to support a safe and controlled evacuation and recovery.
15.1 Small office fire:
Where a minor office fire has been contained, there is minimal damage to the property and staff are not required to work from alternative offices, WGHC should first confirm that all staff, visitors and contractors are safe and that the Fire and Rescue Service, or another competent person has confirmed when the premises can be re-entered.
Version: Version Date:
The Incident Lead should arrange a prompt inspection of the affected area, assess smoke, soot, water, electrical, ICT, heating, alarm, security and fire safety impacts, and instruct any urgent make-safe, cleaning or minor remedial works needed before normal office use resumes.
If the office needs to remain closed for a short period, or if air quality, cleaning, equipment checks or contractor access affects safe occupation, staff may be instructed to work from home temporarily using approved systems and communication channels while essential tenant services continue.
WGHC should notify staff, Committee members, insurers, contractors and key service partners where appropriate, protect records and equipment, record all decisions, costs and actions in the incident log, update fire safety and risk records, and stand down the incident once the premises are safe, systems are operating and any follow-up actions are allocated.
15.2 Significant office fire:
Where a fire causes smoke, water, electrical, ICT or structural damage and the office is unsafe, inaccessible or unsuitable for occupation, WGHC should treat the incident as a priority business continuity event.
The Incident Lead should confirm that all staff, visitors and contractors are safe, prevent reentry until authorised by the Fire and Rescue Service or another competent person, secure the premises where possible, isolate or check utilities and arrange urgent make-safe, cleaning, damage assessment and specialist inspections.
Staff should be instructed to work from home temporarily using approved ICT systems, telephone arrangements and secure communication channels while essential tenant services, emergency repairs, finance, governance and communications continue.
The Incident Lead should assess the likely duration of disruption, activate arrangements for suitable alternative office working space as soon as practicable, prioritise recovery of critical equipment and records where safe, liaise with insurers, landlords, contractors, ICT support, Committee members and key service partners, record all decisions, costs and actions in the incident log, update risk and fire safety records, and consider Scottish Housing Regulator notification (notifiable event) where the incident is material or likely to affect service continuity, governance assurance, tenant safety or WGHC’s reputation.
Following any fire, the Incident Lead must arrange a post-incident review covering evacuation effectiveness, alarm activation, fire warden response, accounting for staff and visitors, assistance for people requiring support, emergency service feedback, communications, damage, insurance, ICT impact and whether alternative premises or remote working arrangements should continue.
16.0 TENANT HOME / VOID PROPERTY FIRE
All fire-related actions must follow the Fire Safety Policy 2025. The tenant or neighbours should raise the alarm, evacuate immediately, call the emergency services where required and proceed to a place of safety (that will not impede the working area of any of the attending emergency services). No person should re-enter the building until authorised by the emergency services or competent person.
Raise the alarm immediately and call the Fire and Rescue Service where required.
Evacuate by the nearest safe route.
Close doors behind you (where safe to do so) to help limit fire and smoke spread.
Proceed directly to a place of safety and remain there until instructed otherwise.
WGHC staff / tenant / neighbours should account for persons who may be within the property
Anyone requiring assistance must be supported in line with local evacuation arrangements and any Personal Emergency Evacuation Plan.
No person may re-enter the building until authorised by the Fire and Rescue Service or another competent person.
Tenants must ensure that escape routes remain unobstructed and that all windows, doors or gates open easily. Any fire related problem or potential health & safety issues should be recorded and acted upon promptly.
16.1 Small home fire:
Where a minor fire has been contained, there is minimal damage to the property and the tenant does not require temporary or permanent rehousing, WGHC should first confirm that all occupants are safe and that the Fire and Rescue Service, or another competent person, has confirmed the property can be re-entered.
The Incident Lead should arrange a prompt inspection of the affected area, assess any smoke, soot, water, electrical, gas, heating, security or fire safety impacts, and instruct any urgent make-safe or minor remedial works required to ensure the home remains safe, secure and habitable.
WGHC should maintain clear communication with the tenant, provide advice on reporting any further concerns, consider vulnerability or support needs, record all decisions and actions in the incident log, notify insurers or contractors where appropriate, and update repair, compliance and risk records before standing down the incident once all necessary follow-up actions are complete.
16.2 Significant home fire:
Where a fire causes serious smoke, water, electrical or structural damage and the property is unsafe, uninhabitable or cannot be occupied while investigations or works are completed, WGHC should treat the incident as a priority tenant-safety and business continuity event.
The Incident Lead should confirm that all occupants are safe, prevent re-entry until authorised by the Fire and Rescue Service or another competent person, arrange urgent make-safe works, isolate or check utilities, secure the property and protect neighbouring homes where required.
WGHC should carry out an immediate welfare assessment, consider vulnerability, household size, accessibility, pets, medical equipment and support needs, and arrange suitable temporary decant accommodation or permanent rehousing in line with its allocations, decant and homelessness prevention arrangements.
WGHC should maintain regular communication with the tenant, support recovery of essential belongings where safe, notify insurers, contractors and relevant agencies, agree repair, reinstatement or disposal options, record all decisions and costs in the incident log, and consider Committee, funder, insurer and Scottish Housing Regulator notification where the impact is material or likely to affect service continuity, tenant safety, reputation or governance assurance.
Following any fire, the Incident Lead must arrange a post-incident review covering evacuation effectiveness, alarm activation, fire warden response, accounting for staff and visitors, assistance for people requiring support, emergency service feedback, communications, damage, insurance, ICT impact and whether alternative premises or remote working arrangements should continue.
17.0 ALTERNATIVE PREMISES AND REMOTE WORKING
If the WGHC office cannot be used, the Incident Lead will decide whether services can continue through remote working, temporary alternative premises, shared partner facilities, contractor premises, community facilities or a combination of these. The decision will consider staff safety, ICT access, confidentiality, accessibility for tenants, insurance, travel, communications and duration of disruption.
Confirm which critical services must continue immediately and which can be temporarily reduced or deferred.
Notify staff of working arrangements, contact routes, reporting times and expected service priorities.
Redirect telephone lines, update voicemail and publish tenant contact arrangements.
Ensure alternative locations protect confidentiality and are accessible where face-toface contact is essential.
Maintain a central record of staff location, availability, equipment and welfare needs.
18.0 EXTERNAL EVENTS AND LOSS OF ACCESS
Events outside WGHC’s control, such as major traffic incidents, road closures, emergency service cordons, severe weather, civil disruption, public transport failure or utility works, may prevent access to the WGHC office or estate. WGHC will prioritise safety, tenant communication and continuity of critical services while recognising that some response times may be affected by external restrictions.
Gather verified information from emergency services, local authority, utility providers, transport updates and contractors.
Advise staff not to travel into unsafe or restricted areas.
Use remote working and telephone-based service delivery where physical access is restricted.
Re-prioritise repairs and visits according to risk, vulnerability and accessibility.
Record access restrictions, decisions, tenant contacts and contractor updates.
19.0 INCIDENT COMMUNICATIONS
Clear, timely and accurate communication is essential. Messages must be approved by the Incident Lead unless delay would increase risk. Communications should explain what has happened, who is affected, what WGHC is doing, what tenants or staff should do, how to get help, and when the next update will be issued.
Communication channels may include telephone, mobile, text, email, website, social media, letters, notices, contractor contact, Committee updates and Scottish Housing Regulator notifications. Alternative formats and translation support must be considered where required.
Communication plans should identify who approves messages, who issues them, which audiences must be contacted, which alternative channels will be used if normal systems fail, and how accessible formats, translation, digital exclusion and tenant vulnerability will be addressed.
20.0 RECOVERY, STAND-DOWN AND LESSONS LEARNED
The Incident Lead will stand down the incident response when immediate risks have been controlled, critical services are stable and recovery actions are allocated.
A recovery plan must identify outstanding repairs, ICT restoration, tenant follow-up, communications, insurance claims, contractor performance, costs, data reconciliation and governance reporting.
A “lessons learned” review should be completed after any significant incident or test exercise. Findings should be used to update these procedures, the Risk Register, contact lists, ICT arrangements, fire safety controls, out-of-hours arrangements and staff training.
21.0 TRAINING, TESTING AND REVIEW
Staff involved in incident response must receive appropriate information, instruction and training so that they understand activation, escalation, evacuation, communication, ICT workarounds, data protection, tenant vulnerability considerations and out-of-hours arrangements. Training should be refreshed when procedures change or following relevant incidents. An annual test should be undertaken (via Internal Auditor?) to test various elements of the plan.
As a minimum, emergency contact lists and staff cascade arrangements should be checked at least quarterly; a desktop business continuity exercise should be completed at least annually; ICT recovery and backup restoration should be tested at least annually; and the Policy should be reviewed every three years, or earlier following a significant incident, test exercise, legislative or regulatory change, or material change to WGHC’s operations.
Testing should include realistic scenarios such as office fire, loss of utilities, loss of ICT, loss of telephone services, denial of access to the office, estate access restrictions and out-of-hours incidents. Results must be recorded, reviewed by senior management and used to improve procedures, contact lists, supplier arrangements and risk controls.
Owner:
Version:
Version Date: Review Due:
22.0 APPEALS AND COMPLAINTS
WGHC is committed to valuing complaints and ensures that the organisation benefits from feedback to identify areas for change and improvement.
If anyone is dissatisfied with the service they have received because of this Policy, they will be encouraged to use our Complaints Procedure. Similarly, any individuals dissatisfied with decisions made in the operation of the Policy are entitled to appeal against these.
The WGHC Complaints Policy details the way in which complaints can be made, the timescales for responding and the appeals process.
Anyone dissatisfied with the outcome of their complaint having exhausted WGHC’s complaint procedure has the right to refer the matter to the Scottish Public Services Ombudsman.
23.0 EQUALITY, DIVERSITY AND INCLUSION
WGHC will ensure that in implementing this Policy it will not unfairly discriminate against any individual, household or group on the grounds of sex or marital status, on race grounds, or on the grounds of disability, age, sexual orientation, language or social origin, other personal attributes, including beliefs or opinions such as religious beliefs or political opinions. (See Section 25.0 for an Equalities Impact Assessment)
24.0 UK GDPR (GENERAL DATA PROTECTION REGULATION)
WGHC will treat all personal data in line with its obligations under the current UK General Data Protection Regulation and The Data Protection Act 2018.
Information regarding how data will be used and the basis for processing data is provided within the WGHC Privacy Notices (available on the WGHC website, or, upon request).
All suspected personal data breaches must be reported internally without delay, recorded in a breach log, investigated and risk assessed. Where a breach is likely to result in a risk to individuals’ rights and freedoms, WGHC must notify the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to individuals, affected individuals must also be informed without undue delay.
