Data protection policy template

A data protection policy tells everyone who works for you how the company handles personal data: the principles, who is responsible, how requests and complaints are dealt with, how long records are kept and what to do about a breach. This free Word template is for UK employers of roughly 10 to 250 people, under UK GDPR and the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025.

Download the Word template

Word (.docx) · 38 KB · free, no sign-up

Running a company of 30 to 200 people? Documents like this are now worth money.

Fill it in with your own roles, systems and retention periods; a generic policy won't show you comply.

Looking for a privacy notice? That tells people how you use their data, and the ICO has a free privacy notice generator. This page is the internal policy staff follow.

What's in the template

Data protection policy

Company 
Data protection leadOr DPO, if you have one
ICO fee registrationReference and renewal date, unless exempt
Approved by 
Version, date and next review 

1. Scope

Everyone who works for us, including contractors, and all personal data we hold about staff, applicants, customers, suppliers' contacts and visitors.

2. Principles

  • Lawfulness, fairness and transparency: we tell people what we do
  • Purpose limitation: no new use without checking
  • Data minimisation: only what we need
  • Accuracy: errors fixed promptly
  • Storage limitation: we follow the retention schedule
  • Integrity and confidentiality: data kept secure
  • Accountability: records that show we comply

3. Responsibilities

WhoResponsible for
DirectorsAccountability; approving this policy
Data protection leadAdvice, records of processing, requests, complaints, breaches, training
ManagersTheir team's compliance
EveryoneFollowing this policy; reporting problems at once

4. Lawful basis and sensitive data

Every purpose has a recorded lawful basis. Special category and criminal offence data also needs a recorded condition and, where the law requires it, an appropriate policy document.

5. Requests and complaints

  • Pass any request, however it arrives, to the data protection lead the same day
  • Log each one; answer subject access requests within one month unless extended
  • Complaints accepted by [email, online form, phone] and acknowledged within 30 days

6. Retention

RecordRetention periodReason
   
   
   

7. Security and sharing

  • Staff follow the IT security and acceptable use policies
  • Processors work under a written contract
  • New systems or uses of personal data are screened for a DPIA

8. Breaches

  • Report a suspected breach to the data protection lead immediately
  • Log every breach
  • Notifiable breaches reported to the ICO within 72 hours of becoming aware
  • Affected people told directly when the risk to them is high

9. Training and review

Training within a new starter's first month and before they handle personal data; refreshers yearly, never more than two years apart. Policy reviewed yearly.

How to write your data protection policy

  1. Start with an inventory: what personal data each team holds, why, where, who sees it and for how long. Even under 250 employees you must document processing that isn't occasional, could be risky, or involves special category or criminal offence data, which is likely to include payroll and HR.
  2. Choose a data protection lead. Call them a DPO only if you must, or want the formal role: the ICO says a voluntary DPO carries the same requirements.
  3. Record a lawful basis for every purpose before processing starts. The Data (Use and Access) Act 2025 added a seventh, "recognised legitimate interest".
  4. Set retention periods you can justify. UK GDPR leaves them to you.
  5. Name who handles requests, complaints and breaches.
  6. Link the detail: privacy notices, the IT security policy and the DPIA template for new projects.

What UK law expects

  • Access requests may be verbal or written. Reply within one month, or up to two more for complex requests or several from one person; the clock pauses while you await clarification you've asked for, and searches need only be reasonable and proportionate.
  • Complaints. Since 19 June 2026, section 164A of the Data Protection Act 2018 has required controllers to make complaining easy (for example, a complaint form that can be filled in electronically), acknowledge complaints within 30 days and give the outcome without undue delay.
  • Breaches. Report a breach to the ICO without undue delay and within 72 hours of becoming aware, unless it's unlikely to put individuals' rights and freedoms at risk. Log every breach either way.
  • Sensitive data. Using the employment condition in Schedule 1 to the 2018 Act requires an appropriate policy document on how you meet the principles and how long you keep the data.
  • Training. The ICO advises training new starters within a month, before they access personal data, and refreshers ideally yearly, at most two years apart.

On 30 September 2026 the Information Commission took over from the Information Commissioner's Office, with the same role and powers.

Example: a fictional 60-person events company

Retention schedule extract for a fictional conference organiser:

RecordRetention periodReason
Payroll records3 years from the end of the tax yearHMRC requirement
Copies of right to work documentsEmployment plus 2 yearsGOV.UK right to work rules
Unsuccessful applicants' CVs6 months after the post is filledCompany decision
Delegates' dietary and access needs30 days after the eventCompany decision: only needed for the event
Delegate contact details2 years after the last bookingCompany decision

It recorded why it needs no DPO: it isn't a public authority, and its core activities involve neither large-scale monitoring nor large-scale special category data.

Common mistakes

  • "As long as necessary" instead of actual retention periods.
  • No route for complaints, though one has been required since June 2026.
  • Staff waiting for certainty before reporting a misdirected email or lost laptop. Report first; the lead decides what's notifiable.

Frequently asked questions

Is a data protection policy a legal requirement?

Often, yes. Article 24(2) of UK GDPR requires appropriate data protection policies where proportionate to your processing, though the ICO accepts that a small organisation with occasional low-risk processing may not need, for example, a documented retention policy.

Is a data protection policy the same as a privacy notice?

No. The policy tells staff how to handle personal data. A privacy notice tells the people whose data you hold why you use it, how long you keep it and who gets it. You must give it when you collect data from them, or within a month if it comes from elsewhere.

Do we need a data protection officer?

Only if you're a public authority, or your core activities involve large-scale, regular and systematic monitoring of people, or large-scale special category or criminal offence data. Otherwise it's optional; the ICO suggests recording the decision.

Adapt the template to your company; it's a starting point, not legal advice.

Sources

Related templates