Data Protection Policy Template

Purpose and Scope

This policy outlines how [Organisation Name] protects personal data and details the rules all personnel must follow when handling it.

This policy applies to:

• All employees, workers, contractors, and volunteers.
• All personal data processed by the organisation regarding customers, staff, suppliers, or other individuals.
• All processing formats, including digital systems and paper records.

Working through related paperwork at the same time? See also our UK Data Breach Response Procedure Template, US Data Breach Response Procedure Template and UK Data Retention & Disposal Policy Template.

Policy Statement

[Organisation Name] processes personal data lawfully, fairly, and transparently. We collect only what we need, keep records accurate and secure, and dispose of data when it is no longer required. Failing to follow this policy, whether deliberately or through negligence, may result in disciplinary action under our disciplinary procedure.

Definitions

• Personal Data: Information relating to an identifiable living person, such as a name, email address, photograph, CCTV image, or identification number.
• Special Category Data: Sensitive data requiring extra protection. This includes health records, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometrics, sex life, or sexual orientation.
• Processing: Any action performed on personal data, such as collecting, storing, viewing, sharing, or deleting.
• Personal Data Breach: A security failure leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

Responsibilities

• Senior Owner ([Role]): Accountable for overall policy governance and securing adequate resources for compliance.
• Data Protection Lead ([Role] / [Data Protection Officer Role]): Serves as the main contact for inquiries, rights requests, and breach notifications. Maintains training and processing records.
• Managers: Ensure teams complete required training and verify that new tools or processing activities involving personal data are approved prior to use.
• All Staff: Follow handling rules and report data protection concerns or mistakes immediately.

Data Protection Principles

• Lawfulness, Fairness, and Transparency: Establish a valid legal basis before processing data and explain data use clearly through privacy notices.
• Purpose Limitation: Collect data only for specified, explicit reasons. Do not reuse it for incompatible secondary reasons.
• Data Minimisation: Limit data collection strictly to what is necessary for the task.
• Accuracy: Keep records accurate and correct errors promptly upon discovery.
• Storage Limitation: Hold personal data only as long as specified in the retention schedule, then dispose of it securely.
• Integrity and Confidentiality: Use technical and operational security controls to protect data against unauthorised access, loss, or damage.
• Accountability: Maintain documentation, including policies, training records, and breach logs, to prove operational compliance.

Day-to-Day Data Handling Rules

• Access only the personal data you need for your assigned duties. Never share login credentials.
• Verify external recipient details and file attachments before sending personal data.
• Use [BCC/Secure Share Method] when emailing groups of external recipients.
• Never forward personal data to personal email accounts or transfer it to non-work devices or personal drives.
• Lock your computer screen whenever you step away from your workstation.
• Store physical records in [Locked Storage Location] and clear your desk of sensitive paperwork overnight.
• Process personal data using only software, applications, spreadsheets, and tools approved by [Role].
• Restrict special category data handling to authorised personnel, and store it strictly in [Restricted Location/System].

Procedure for Handling Rights Requests

1. Receive the request from an individual through any channel.
2. Forward the request to [Role] on the working day you receive it.
3. [Role] processes the request and issues a formal response within one calendar month.

Procedure for Handling Personal Data Breaches

1. Identify any suspected or confirmed breach.
2. Report it to [Role] immediately, regardless of scale.
3. [Role] evaluates the incident to determine whether to notify the Information Commissioner’s Office (ICO) within the statutory 72-hour window.
4. Log the incident in the breach log and take corrective action per the data breach response procedure.

Training, Records, and Review

• Training: New personnel must complete data protection training before handling personal data. All staff complete refresher training [Frequency].
• Records: Maintain training logs, breach logs, and processing activity records in [System/Location].
• Review Cycle: Review this policy [Frequency], following any data breach or near miss, and whenever system or operational changes occur.

Policy Owner: [Role] Next Review Date: [Date]