GDPR Data Protection Policy Template

GDPR Data Protection Policy


Data protection has long played a key role in business, and as a result of the GDPR, which came into force on 25 May 2018, it has become even more important.

This template Data Protection Policy sets out the rights of data subjects and the obligations of a business as a data controller under the GDPR, setting out a number of organisational and procedural measures to help ensure compliance.

As the one-year anniversary of the GDPR approaches, this document has been reviewed and updated and now includes a new definitions section, improved detail in key areas including consent, accountability, privacy by design, and automated processing, and a new provision dealing with direct marketing.

This Data Protection Policy is highly detailed, aiming to reproduce key parts of the GDPR in order to assist in the GDPR learning process throughout your business. Nevertheless, please note that training remains essential and that all personnel handling personal data within your business should be fully aware of the GDPR and its principles, as well as the procedures in place within your business.

This document is designed for business use only, and certain provisions of the GDPR relating to public authorities and other official bodies have not been fully incorporated. As best practice in data protection is continually developing, it is important to note that this remains a “living document” and will be reviewed as more best practice and official guidance on the GDPR becomes established. Preparations will also be made in the event that a ‘no-deal’ Brexit becomes probable in March 2019.

Optional phrases / clauses are enclosed in square brackets. These should be read carefully and selected so as to be compatible with one another. Unused options should be removed from the document.

This document is also available in the IT & Software group under IT & Data Policies.

This GDPR Data Protection Policy contains the following provisions:

1. Introduction
2. Definitions
3. Scope
4. The Data Protection Principles
5. The Rights of Data Subjects
6. Lawful, Fair, and Transparent Data Processing
7. Consent
8. Specified, Explicit, and Legitimate Purposes
9. Adequate, Relevant, and Limited Data Processing
10. Accuracy of Data and Keeping Data Up-to-Date
11. Data Retention
12. Secure Processing
13. Accountability and Record-Keeping
14. Data Protection Impact Assessments and Privacy by Design
15. Keeping Data Subjects Informed
16. Data Subject Access
17. Rectification of Personal Data
18. Erasure of Personal Data
19. Restriction of Personal Data Processing
20. [Data Portability]
21. Objections to Data Processing
22. [Automated Processing, Automated Decision-Making, and Profiling]
23. [Direct Marketing]
24. Personal Data Collected, Held, and Processed
25. Data Security - Transferring Personal Data and Communications
26. Data Security - Storage
27. Data Security - Disposal
28. Data Security - Use of Personal Data
29. Data Security - IT Security
30. Organisational Measures
31. Transferring Personal Data to a Country Outside the EEA
32. Data Breach Notification
33. Implementation of Policy

Once you have purchased access to the appropriate document folder click on the “Download Document” link below. You will be asked what you want to do with the file. It is recommended that you save the document to a location of your choice prior to viewing.