Data Protection Policy

Data Protection Policy: Show How Your Organisation Handles Personal Data

A data protection policy is an internal document that tells everyone who works for you how to handle personal data properly: what they can collect, how to keep it secure, when it can be shared, how long to keep it, and what to do when someone asks for their data or something goes wrong. Robot Lawyer drafts the policy from your answers, for the law of the country or state you choose, and on the Verified plan a qualified legal professional checks it within 24 hours before you share it with your team.

CONTENTS

What Is a Data Protection Policy?

A data protection policy sets the rules your organisation follows when it uses personal data about employees, customers or anyone else. It turns legal principles, such as using only the data you need and keeping it secure, into practical steps staff can follow.

It is different from a privacy policy. A privacy policy is a public notice telling people how you use their data. A data protection policy is for your own people, and it helps you show regulators that you take your responsibilities seriously.

When Do You Need One?

• Employers
  Any organisation that holds staff records, payroll data or job applications.
• Businesses with customer data
  Shops, agencies, clinics and online services that hold customer contact, payment or account details.
• Sensitive data
  Organisations handling health information, biometric data or other special category data.
• Growing teams
  When more people handle personal data and need clear, consistent rules.
• After an incident
  When a data breach or a difficult access request shows the need for a written process.

What's Included in Your Policy?

• Policy details
  Your organisation's name and address, who to contact, who owns the policy, its effective date, version and next review date.
• Scope and roles
  Whose data the policy covers, and the responsibilities of managers, staff and any data protection officer.
• Data protection principles
  What each principle means in practice.
• Lawful bases
  Why you use personal data, and the extra care needed for sensitive data.
• Individuals' rights
  How to recognise and handle requests for access, correction or erasure.
• Security, sharing and transfers
  Keeping data safe, using suppliers, and sending data abroad.
• Retention and disposal
  Keeping data only as long as needed and deleting it securely.
• Data breaches
  How to report and handle a breach, and when to tell the regulator.
• Impact assessments
  When to carry out a data protection impact assessment.
• Optional forms
  A subject access request form, a data breach report form and a DPIA screening checklist, if you want them.

Data Protection Principles in Brief

• Lawful, fair and transparent
  Have a valid reason for using data, and tell people about it.
• Purpose limitation
  Use data only for the purposes you collected it for.
• Data minimisation
  Collect only what you need.
• Accuracy
  Keep data correct and up to date.
• Storage limitation
  Don't keep data for longer than you need it.
• Security
  Protect data against loss, misuse and unauthorised access.
• Accountability
  Be able to show how you follow the rules.

How It Works on Robot Lawyer

1. Answer the questions
   Tell us about your organisation, the data you hold, why you use it, how you store and share it, and how you handle breaches.
2. Generate your policy
   We draft a clear, practical policy your staff can follow.
3. Get it verified
   On the Verified plan, a qualified legal professional checks your policy within 24 hours and makes amendments where needed. The Essentials plan does not include this check. See how our documents are verified.
4. Share it with staff
   Add it to your handbook or intranet, and include it in induction and training.

How It Works in Different Countries

• UK
  The UK GDPR and the Data Protection Act 2018 apply, and the Information Commissioner's Office is the regulator. Serious data breaches must usually be reported within 72 hours.
• EU and Ireland
  The GDPR applies, with national regulators such as Ireland's Data Protection Commission.
• United States
  There is no single federal law. Several states, including California, have consumer privacy laws, and every state has data breach notification rules.
• Canada and Australia
  National privacy laws apply to many organisations, with their own breach reporting rules.

These notes are general. Check the current rules where you operate.

Data Protection Policy FAQs

Is a data protection policy a legal requirement?

Not always in name, but the law expects organisations to have appropriate policies and to show how they comply. A written policy is the clearest way to do that.

What is the difference between a data protection policy and a privacy policy?

A privacy policy tells the public how you use their data. A data protection policy tells your own staff how to handle data. Most organisations need both.

Do we need a data protection officer?

Only some organisations must appoint one, such as public authorities and organisations that monitor people on a large scale or handle sensitive data on a large scale. Your policy names your officer if you have one, or your main contact if you don't.

How quickly must we answer a request for someone's data?

In the UK and EU, usually within one month, which can be extended for complex requests. Your policy explains how staff should pass requests on straight away.

Can I use this policy outside the UK?

Yes. Your policy is drafted under the law of the country or state you choose. Our lawyers are qualified in England and Wales and, on the Verified plan, check documents for good practice, clear formatting and the law of England and Wales. They are not qualified in other countries' law, so if your policy is governed by another country's law, we recommend having a local lawyer check it too.

Create a Data Protection Policy

Give your team clear rules for handling personal data. You can start with a 7-day free trial. See our pricing for the plans. Related documents: Privacy Policy, Data Retention Policy, Data Breach Policy and Data Protection Request Letter.