The data protection policy template #
Fill in each grey prompt in plain words, and delete any section that does not apply to you. The ICO says the scope and detail of a policy depend on what you do with personal data, so a six person office needs a shorter policy than a clinic holding health records. This is a starting document, not legal advice, and it only works if it describes what your organisation really does.
Click anything in brackets to type over it, then copy, print or download the result. Nothing you type leaves this page.
Data protection policy
1. About this policy
| Organisation | [Registered name] |
|---|---|
| Applies to | [Everyone who handles personal information for us: staff, volunteers, contractors] |
| Approved by | [Name and role] |
| Date approved | [Date] |
This policy sets out how we collect, use, store, share and delete personal information so that we meet the UK GDPR and the Data Protection Act 2018. Our privacy notice tells the people whose information we hold what we do with it; this policy tells our own people how to handle it.
2. Who is responsible
| Person responsible for data protection | [Name and role] |
|---|---|
| Data protection officer (if appointed) | [Name and contact details, or delete] |
| Who to ask | [Email or extension] |
Everyone covered by this policy is responsible for following it in their own work.
3. What we hold, and why
Our record of processing lists every kind of personal information we hold. In summary:
| Whose information | What we hold | Why | Lawful basis |
|---|---|---|---|
[Any special category information (health, for example) and the condition we rely on, or "None"]
4. How long we keep it
| Information | How long | How it is deleted |
|---|---|---|
5. Keeping it secure
| Devices and accounts | [For example passwords, screen locks, two step sign in, who has access to what] |
|---|---|
| Paper records | [Where they are kept, who can reach them, how they are shredded] |
| Working away from the office | [What may and may not be taken or accessed off site] |
| Leavers | [How access is removed when someone leaves] |
6. Suppliers who handle it for us
Any supplier that handles personal information on our behalf has a written contract with us before it starts. Current suppliers: [List, or point to where the list is kept]
7. New systems and changes
Before we start a new process, system or supplier that uses personal information, we check whether it is likely to be high risk, and if it is we carry out a data protection impact assessment before it goes ahead. Who decides: [Name or role]
8. Training
[Who is trained, when (on joining and how often after), and where it is recorded]
9. Requests from individuals
Anyone who receives a request from a person about their own information (a copy of it, a correction, deletion, or an objection) passes it the same day to [Name or role], who logs it and replies within the time limit.
10. Breaches
Anyone who suspects personal information has been lost, sent to the wrong person, accessed without permission or destroyed tells [Name or role] at once. Every breach is logged. Where it is likely to put people at risk, it is reported to the ICO within 72 hours of us becoming aware of it, and where the risk is high, the people affected are told.
11. Review
| Next review | [Date, or the change that triggers one] |
|---|---|
| Checked by | [Name and role] |
Is a data protection policy a legal requirement? #
Not in every case. Article 24 of the UK GDPR requires an organisation to put appropriate measures in place to ensure and demonstrate that it complies, and says those measures include data protection policies where that is proportionate to the processing. The ICO's accountability guide says the same: policies where proportionate, more robust where you handle large volumes or special category data, and a smaller scale approach for a smaller organisation.
In practice a written policy is the simplest way to show what you do, which is the point of accountability. The template above is short on purpose.
A policy and a privacy notice are different documents #
The policy is for your own people and says how they handle information. The privacy notice template is for the people whose information you hold and says what you do with it. They should agree with each other, so write them from the same list of what you hold and why.
Section 7 of the policy is where the DPIA template comes in, and section 6 is a data processing agreement with each supplier. For AI tools in particular, see UK GDPR and AI for a small organisation.
What the office does with it by hand #
The policy is written once. The work it creates is recurring: logging requests and breaches, chasing training that is due, deleting records when their retention period ends, and the reminder when the review date arrives. Those follow a rule. Deciding the lawful basis, or whether a breach puts people at risk, is a judgement, and it stays with a person.
The task sorter separates the two kinds of work, and the admin time calculator shows what the first kind costs in a month.