All templates
Policies
Data Protection & Privacy Policy
A comprehensive data protection policy covering processing principles, lawful bases, data subject rights, retention, security measures, breach response, and third-party management.
DATA PROTECTION & PRIVACY POLICY — [COMPANY NAME]
Effective: [Date] | Version: [X.X]
1. INTRODUCTION
[Company Name] is committed to protecting personal data we process. This policy establishes principles and responsibilities for handling personal data in compliance with GDPR, CCPA, and other applicable laws. It covers data of employees, applicants, customers, suppliers, and partners.
2. DEFINITIONS
• Personal Data: Any information about an identified or identifiable person.
• Processing: Any operation on personal data (collecting, storing, using, sharing, deleting).
• Controller: Entity determining purposes ([Company Name]).
• Processor: Entity processing on behalf of controller.
• Sensitive Data: Race, politics, religion, health, biometrics, sexual orientation.
3. PRINCIPLES
• Lawfulness, Fairness, Transparency
• Purpose Limitation
• Data Minimisation
• Accuracy
• Storage Limitation
• Integrity & Confidentiality
4. LAWFUL BASES
• Consent | Contract | Legal Obligation | Vital Interests | Legitimate Interests
5. DATA WE COLLECT
• Employees: Name, contact, ID, bank details, employment/performance records, medical (for benefits/sick leave).
• Candidates: CV, interview notes, reference/background checks.
• Customers: Contact, billing, communication history.
• Vendors: Contact, contract, payment data.
6. DATA SUBJECT RIGHTS
• Informed | Access (within 30 days) | Rectification | Erasure
• Restrict Processing | Portability | Object | Automated Decision-Making
7. SECURITY
Encryption, access controls, regular assessments, employee training, incident response, secure disposal.
8. BREACH RESPONSE
1. Contain and assess.
2. Notify authority within [72 hours] if required.
3. Notify affected individuals if high risk.
4. Document all breaches.
9. RETENTION
Only as long as necessary per Retention Schedule. Securely deleted/anonymised beyond that.
10. THIRD PARTIES
Processors vetted and contractually bound. Require security measures, breach notification, and compliance.
11. INTERNATIONAL TRANSFERS
Safeguards (SCCs, BCRs, adequacy decisions) for transfers outside [EU/UK].
12. EMPLOYEE RESPONSIBILITIES
• Comply with this policy | Complete training | Handle data carefully | Report breaches
13. CONTACT
DPO / HR: [DPO Email] | [DPO Phone]