Technical and Organisational Security Measures

We maintain a range of technical and organisational controls to support the security of personal data. These include:

• access controls designed to ensure that personal data is available only to authorised individuals
• role-based permissions to limit access according to job responsibilities
  secure hosting and server management arrangements
• controlled handling of learner and centre data
• internal procedures for managing incidents and data breaches
• ongoing review of security arrangements to ensure they remain appropriate to the nature of the data processed

We also work to ensure that the personal data we process is limited to what is necessary for qualification administration, certification, regulatory requirements, and associated operational purposes.

Policies and Procedures

TLM maintains policies and procedures relating to data protection, privacy, information security, access management, retention, and incident handling. These are designed to support compliance and promote the secure and responsible handling of personal data across our operations.

Our Privacy Notice provides further information on how personal data is collected, used, stored, and shared:

TLM Privacy Notice

System Security

We take system security seriously and apply appropriate measures to protect the platforms and services we use in qualification delivery. Our arrangements include managed security controls, secure server management, and operational processes intended to reduce risk and maintain the integrity of our systems.

Access to personal data is restricted according to business need, and our systems and controls are reviewed periodically as part of our wider compliance and security management processes.

Cyber Essentials

TLM holds Cyber Essentials certification in relation to its server management arrangements. This supports our ongoing commitment to maintaining appropriate cyber security controls within our operational environment.

Information Security Accreditation

TLM currently holds Cyber Essentials certification. We do not currently hold ISO 27001 accreditation, although this remains under consideration as part of our ongoing development of information security governance.

Children’s Data and Age-Appropriate Design

TLM recognises the importance of protecting children’s personal data where our services may be accessed by learners under the age of 18. We consider applicable UK data protection requirements, including age-appropriate design considerations where relevant to the nature of the service provided.

Our platforms are used for defined educational and awarding purposes, such as qualification delivery, assessment, and certification. They are not designed as open social or consumer-facing platforms, and personal data is processed only for specific educational, operational, and regulatory purposes in line with our legal obligations.

Data Sharing

Where required, TLM may share limited data with relevant regulatory or public bodies in connection with qualification delivery, certification, funding, or other lawful obligations. Any such sharing is carried out in line with applicable legal and regulatory requirements and is limited to what is necessary for the relevant purpose.

Further Information

We are committed to transparency in how we manage and protect personal data. Where appropriate, additional information can be provided on areas such as data retention, access controls, incident handling, and data sharing arrangements.