An internal policy that sets out how your organisation complies with UK GDPR and the Data (Use and Access) Act 2025 – who does what, and the rules every member of staff must follow.
Data protection & GDPR
Data Protection Policy
About this document
Your main internal data protection policy. It explains the data protection principles, who is responsible for what, the lawful bases you rely on and the procedures for rights requests, complaints, breaches, sharing, transfers, retention and training. It is a key part of the “accountability” evidence the regulator expects to see.
The document is laid out in the sections below. Each one comes with a plain-English guidance note explaining what it does and what to change.
Our templates are professionally structured starting points for UK businesses, not legal advice. For anything complex, unusual or high-value, have your final version checked by a solicitor.
Included in the pack
Data protection & GDPR
for every document in this category
Editable Microsoft Word files
Guidance notes in every document
Written for UK businesses
Download and keep
Need more than one category?
Documents All-Access gives you every category for 12 months for £295.
Compare options →Need it tailored?
We can adapt any template to your business, or write a document from scratch.
Talk to us →
