IT & Data Protection Policies
If your business collects any form of information from customers it will most likely be, in some way or another, subject to the provisions of the UK's data protection legislation, which includes the UK GDPR and the Data Protection Act 2018. In addition to data concerning customers, all businesses (with the exception of sole traders) will hold information about employees. The data protection legislation applies here too.
Data protection policies greatly assist in complying with the requirements of the data protection legislation by setting out clear procedures to be followed both by businesses and by data subjects.
Similarly important, and strongly related to data protection, is IT security. Keeping business IT systems secure and maintained is not only vital for the smooth-running of a business but also to complying with important data protection obligations. An IT Security Policy can provide invaluable guidance in this area.
IT & Data Protection Policies is part of Business . Just £38.50 + VAT provides unlimited downloads from Business for 1 year.
Frequently Asked Questions
Does my business actually need a data protection policy? +
There is no single law that says you must have a standalone policy, but the UK GDPR makes you accountable for how you handle personal data, and a policy is the main way to show you meet that. It sets out clear procedures for staff and for responding to data subjects, which helps you comply and evidences that compliance if the ICO asks. So it is best practice bordering on essential once you hold any real amount of personal data.
We hold data on customers and staff, what law applies? +
The UK's data protection framework: the UK GDPR and the Data Protection Act 2018. If you collect information from customers you are almost certainly within it, and every business except a sole trader with no staff also holds employee data, which is covered too. The law sets principles for lawful, fair and secure processing and gives individuals rights. Data protection policies help you apply these duties consistently across customer and staff data.
What is the difference between a data protection policy and an IT security policy? +
A data protection policy sets the procedures for handling personal data lawfully, covering rights, retention and how staff and data subjects should act. An IT security policy focuses on keeping your systems and data secure and maintained, which is a big part of the security obligations under data protection law. They overlap but are not the same: one governs how you treat personal data, the other how you protect the systems that hold it. Most businesses benefit from both.
Do sole traders need to worry about data protection? +
Yes, if they handle personal data. A sole trader with no employees may not hold staff data, but if they process customer or client personal data the UK GDPR and Data Protection Act 2018 still apply to them. Being small does not exempt you. The duties scale with what you do, but the basics, a lawful basis, security and respecting individuals' rights, apply to sole traders too. A simple data protection policy helps a small business meet them.
