Our Compliance and Security

We are Firebird Data Protection Consultancy Limited, a data protection and privacy management consultancy company helping organisations meet their legal obligations under the UK data protection and privacy legislation when handling personal data .

We are a company registered in England and Wales (10841251). Our registered address is  20-22 Wenlock Road, London N1 7GU. We are registered with the UK Information Commissioner's Office under ZA288370.

Our Data Protection Director is Amber Badley. If you have any queries regarding our company's handling of personal data or the services we provide, please email dpo@firebirdltd.co.uk or call 01392 344392.

You can find out how we handle personal data under the privacy notice section of this website.

 Firebird is Cyber Essentials certified. Our current certification was awarded on 8 October 2026 and provides independent assurance that fundamental cyber security controls are in place. A copy of our certificate is available on request. 

We have policies and procedures which cover topics such as data protection, working remotely, passwords, confidentiality, handling data protection requests, personal data breach management, cyber security, retention, disposal, security and business continuity. These are communicated to our employees and business associates during their on-boarding and when revisions are made. All employees and associates must read and abide by these policies and procedures. 

Our employees and associates receive mandatory data protection and security awareness training during their on-boarding and refresher training. Training is supported by regular awareness raising communications and team discussions. 

We have appropriate security in place to protect personal data against unauthorised or accidental access, disclosure, loss, destruction or damage and hold the Cyber Essentials Certification.

Here are some examples of the organisational security measures we have in place to protect our data and our customers’ data: 

• Recruitment procedures include DBS vetting checks and confidentiality clauses in contracts.
• Data protection and security awareness training is provided to employees and associates.
• Policies and guidance are communicated to employees and associates.
• Data protection and security compliance is regularly discussed. 
• Appropriate equipment, policies and guidance are provided to employees.
• Personal data is held within approved digital systems with appropriate encryption and access controls applied, according to the nature and risk of the information.
• Appropriate physical and remote-working security controls are in place to protect devices and information.

We carry out due diligence on the processors we use and only appoint suppliers that provide a high level of assurance that personal data will be handled securely and in line with data protection requirements.  We keep our processor arrangements under review and have written contracts in place that include the required Article 28 UK GDPR provisions. 

Where Firebird acts as a processor for our customers, our contracts also include the required Article 28 UK GDPR provisions, covering confidentiality, security, sub-processors, support with individual rights and DPIAs, breach notification, deletion or return of data, and the information needed to demonstrate compliance. 

Employees and associates are provided with training and guidance on how to recognise requests from data subjects exercising their data protection rights. We have a comprehensive Data Protection Request Handling Procedure and recording procedures to manage and monitor requests. If a request is received from one of our customers’ data subjects, we will ask the data subject to make their request directly to our customer or seek their consent to forward their request to the customer.

We maintain documented procedures for identifying, investigating, containing and recording security incidents and personal data breaches. Where we process personal data on behalf of a customer, our contracts require us to notify the customer without undue delay if we become aware of a personal data breach affecting their information.

Our core business records are stored within the UK or EEA. Where suppliers process information outside the UK, we assess the transfer arrangements and ensure appropriate safeguards are in place where required. 

We maintain business continuity and recovery arrangements designed to help us continue providing services and protect customer information in the event of disruption. 

We maintain controls around the use of AI within Firebird, including approved-use requirements, staff guidance, data protection considerations and risk assessment of new AI tools before they are used with personal or confidential information.  

Compliance information last reviewed October 2026