Discretion is essential in HR.

My commitment to confidential work

I recognise the need to handle HR and recruitment information carefully, respectfully and proportionately. I aim to limit information sharing to those with a legitimate work-related need and to avoid unnecessary disclosure of employee, candidate or client details.

Confidentiality is not absolute: information may sometimes have to be shared to comply with law, protect individuals, handle a valid request, manage a legal claim or fulfil an expressly agreed professional duty.

Correspondence and confidentiality: The Sheffield address displayed on this site is used for ordinary business post. Sensitive HR, employee or candidate records should not be sent there without first agreeing appropriate secure handling directly with me. My consultancy is operated primarily from East Riding of Yorkshire.

Before a confidential assignment begins

For sensitive assignments I will agree the scope, reporting line, access permissions, document-sharing method and responsibilities for data protection before receiving detailed case files. The contract or statement of work should identify whether each party acts as controller or processor for relevant information and include a compliant data processing agreement where one is required.

How to share sensitive documents

Please do not send employee medical details, witness statements, allegations, payroll records, identity documents, CVs or other confidential material through the general website enquiry form.

Instead, contact me at andrew@piecebypiecehr.co.uk to discuss your needs without identifying individuals. We can then agree a suitable secure means of sharing material and who should have access.

Information handling and access

My intended working controls include restricting access to relevant case information, using strong authentication on business accounts, taking care with recipients and attachments, keeping appropriate records of disclosure, and reviewing data for retention or deletion when it is no longer needed. Safeguards must be applied proportionately to the sensitivity of the assignment.

Independent investigations and conflicts

Before accepting an investigation, I will consider independence and potential conflicts of interest. My role is to establish and document relevant facts within the agreed terms of reference; the commissioning employer normally retains responsibility for making its own management decisions.

Specialist boundaries and incidents

My services concern HR practice and employment-related information governance. They should not be treated as a substitute for regulated legal services, specialist cybersecurity engineering, or formal statutory Data Protection Officer services unless specifically agreed with an appropriately qualified specialist.

Suspected loss or unauthorised disclosure of personal information should be investigated promptly, recorded and assessed for any legal notification requirements. Reportable personal data breaches generally must be notified to the ICO within 72 hours of awareness.

More information

See the Privacy Notice, Candidate Privacy Notice and Data Protection Complaints Procedure for further information. Specific client confidentiality terms are set out in the relevant engagement agreement.