What is a data protection policy?
Definition
A data protection policy is an organisation's internal document that sets out how it handles personal data, who is responsible, and how it follows data protection law.
- Category
- Data
- Also called
- data privacy policy
- Last updated
A data protection policy is written for staff, not customers. The UK's ICO expects organisations to have policies for data protection, records management and information security, with roles and responsibilities spelled out.
What the ICO expects in it
According to the ICO's audit framework, the policy explains how the organisation applies the data protection principles, such as data minimisation and purpose limitation, and how it protects people's rights. Children and other vulnerable groups get extra protection. New systems and services must consider data protection from the design stage.
Every policy carries a version number, an owner, a review date and a change history. Staff should be able to confirm they've read it.
Where possible, a separate policy says how long each kind of data is kept, and why.
Policy vs. privacy notice
The privacy notice is the public document. It tells you who the organisation is, what it collects, why, who gets it and how long it keeps it. The policy is the internal rulebook behind it. The two should agree.
For you as an individual, the notice is the page worth reading before you hand over your details.
How to protect yourself
- 1
Read the privacy notice before sharing data
Look for what is collected, why, who receives it and how long it is kept.
- 2
Share only what's needed
If a form asks for more than the service requires, leave optional fields empty or ask why.
- 3
Know how to ask
Many laws let you request your data or its deletion. See our guide to the data subject access request.
- 4
Remove the copies held by data brokers
Serus finds the data brokers that hold your details and removes them.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is a data protection policy the same as a privacy policy?
No. A privacy policy or notice is public and speaks to customers. A data protection policy is internal and tells staff how to handle personal data.
Who needs a data protection policy?
The ICO expects organisations that handle personal data to have one, as part of showing they meet their obligations. Check the ICO or a lawyer for a specific case.
Sources
Something wrong or out of date? Tell us and we'll re-check it.