Data protection policy

About this document

This data protection policy is an internal HR document for use by employers and staff. It complements your website privacy policy, which tells your customers how you manage data.

The policy is suitable for any business or organisation and enables both staff and employers to ensure that their workplace complies with the UK Data Protection Act 1998. The policy includes detailed provisions regarding the collection, use and storage of any data gathered within the workplace.

Your legal obligation, as in other areas, is to comply with the law. There is no specific obligation to publish and make available a data protection policy to all staff. However, if any person within the business or organisation breaks data protection law then the publication of this policy enables the employer to invoke a disciplinary procedure and to defend against any accusation that the company is in breach of the law.

When to use this template

This template is suitable for employers wishing to introduce a data protection policy into their workplace. You may be looking to introduce a formal written policy for the first time, or to replace an older policy.

Application and features

• Publicises your compliance with legal obligations of the UK Data Protection Act 1998
• Spells out to staff, how you and they will use all data within your organisation, including that relating to staff
• Helps to protect you from claims that you have misused data
• Provides you with an easy reference as to your ongoing obligations

Contents

• Reminder to staff of contractual obligations
• Identity and contact information
• Domain name and email address
• Financial information
• Additional personal information
• Affiliates and other business partners
• Personal information request
• Other paragraphs to protect your interests