Policy template · ISO 27001
Data protection policy template
The policy that shows how your firm meets UK GDPR, not just that it intends to. A ready-to-edit Word template covering the Article 5 principles, accountability and your DPO decision, mapped to ISO 27001 A.5.34 and written for a UK firm of 25 to 250 people.
Key takeaways
A data protection policy, or GDPR policy, is the internal document in which leadership sets how the organisation handles personal data. UK GDPR Article 24 expects appropriate data protection policies where proportionate, and Article 5(2) requires you to demonstrate compliance. This template gives a UK firm of 25 to 250 staff a ready-to-edit Word policy.
- Required by
- UK GDPR Articles 5(2) and 24, where proportionate; ISO 27001:2022 control A.5.34
- Approved by
- Top management, with a named data protection lead or DPO
- Review cycle
- At least annually, and after significant change
- Format
- Word, about 12 pages, with a DPO decision record
What's in the template
One Word document, about 12 pages, version 1.0. It has four parts:
- The data protection policy. Your organisation's rules for handling personal data under UK GDPR, laid out the way an auditor or a client's privacy team reads it: purpose and scope, your role as controller or processor, who is accountable, how you meet each of the six Article 5 principles, lawful basis, transparency, individuals' rights and complaints, data protection by design, security, processors and transfers, retention, breaches, records of processing, training, registration and review.
- A getting-started guide. It shows what to decide first (your role and your DPO position), which sections to cut down at your size, and what to leave alone.
- Next steps. These show which documents sit beneath the policy (privacy notices, your record of processing, a retention schedule, a breach log) and the order to write them in.
- A policy management checklist. It covers approval, staff acknowledgement, training and review dates: the records an auditor asks to see alongside the policy.
Three appendices give you a DPO decision record, so the choice to appoint a data protection officer, or not to, is written down with its reasons; a register of the related documents, with an owner and location for each; and a glossary. Every placeholder is in square brackets, so you replace names, systems and data types rather than writing from a blank page.
What is a data protection policy?
A data protection policy, often called a GDPR policy, is the internal document in which your leadership sets out how the organisation handles personal data: who is accountable, which rules staff follow, and how you meet UK GDPR's principles in practice. It is written for your own people, not the public. That's what separates it from a privacy notice.
It matters because UK GDPR makes you prove compliance, not just achieve it. Article 5(2) says the controller "shall be responsible for, and be able to demonstrate compliance with" the principles. The policy is usually the first piece of that evidence a client's due-diligence questionnaire, an ISO 27001 auditor or the regulator asks to see.
A policy no one follows is worse than no policy. It's a written record of what you knew you should be doing.
Which laws and standards ask for one
| Source | What it asks for |
|---|---|
| UK GDPR, Article 5(2) | The controller is responsible for, and must be able to demonstrate, compliance with the six principles in Article 5(1). This is the accountability principle. |
| UK GDPR, Article 24 | The controller must put appropriate technical and organisational measures in place, and review them. Where proportionate to the processing, those measures include "appropriate data protection policies". |
| ISO 27001:2022, control A.5.34 | The organisation must identify and meet its requirements for preserving privacy and protecting personal data (PII) under applicable laws, regulations and contracts. |
| The ICO's accountability guidance | Lists data protection policies, where proportionate, among the measures it expects, and says you should be able to show the policies are implemented and followed, through training, monitoring and audit. |
| Customer due diligence | Most enterprise and financial-services questionnaires ask for the policy, the name of your data protection lead or DPO, and how you handle breaches and data subject requests. |
UK GDPR doesn't say every firm must have a document with this title. But for a firm of 25 to 250 people holding client and employee data, it's hard to demonstrate accountability without one. For the ISO 27001 side, see the A.5.34 guide and the A.5.31 guide on legal and contractual requirements.
A note on names: since 30 September 2026 the regulator is legally the Information Commission; it is still known as the ICO.
Do you need a data protection officer?
Probably not, but you need to decide, and write the decision down. Article 37(1) requires a DPO in three cases: you're a public authority or body; your core activities involve regular and systematic monitoring of individuals on a large scale; or your core activities involve large-scale processing of special category data or criminal offence data.
Most firms of 25 to 250 staff meet none of these. A broker or a fintech whose core business is processing health or financial-vulnerability data at scale might. The ICO's guidance recommends recording a decision not to appoint, to help demonstrate accountability. If you appoint a DPO voluntarily, the same requirements apply as if it were mandatory, including reporting to the highest level of management and avoiding conflicts of interest.
That's why many smaller firms name a "data protection lead" instead. The policy needs one or the other, with a real name against it.
A policy is not a privacy notice
The data protection policy is one document in a small set. Keeping each one to its own job is what makes the set hold together.
| Document | What it does | Who reads it | UK GDPR basis |
|---|---|---|---|
| Data protection policy | Sets your internal rules and who is accountable | Staff, auditors, clients' due-diligence teams | Article 5(2), Article 24 |
| Privacy notice | Tells individuals what you do with their data and their rights | The people whose data you hold | Articles 13 and 14 |
| Record of processing activities | Lists what personal data you process, why, where it goes and how long you keep it | You, and the regulator on request | Article 30 |
| Retention schedule | Sets how long each category of record is kept, and why | Staff who create and delete records | Article 5(1)(e), storage limitation |
| Breach log | Records every personal data breach, reported or not | You, and the regulator on request | Article 33(5) |
The policy points to the others. It doesn't repeat them. A retention period written into the policy will be wrong the first time the schedule changes. For the records side, the A.5.33 guide covers protecting records under ISO 27001.
How to create your data protection policy with this template
If you know what personal data you hold and where it goes, this takes about a day, plus one management meeting. If you don't, start with the data map, because every section of the policy depends on it.
Before you start
A data protection policy describes how you handle personal data, so it depends on knowing what that data is. Check you have:
- A picture of your personal data. What you hold about clients, their customers, staff and suppliers, where it lives, and who you share it with. No picture yet? Run a short data-mapping exercise first. It becomes your record of processing, and the A.5.34 guide shows what to capture.
- Your role for each activity. Whether you're the controller (you decide why and how data is processed) or a processor (you act on a client's instructions). Many B2B firms are both. Not sure? Settle it before you write, because the obligations differ.
- A named owner, and an approver with authority. The owner keeps the policy current and is usually your data protection lead. The approver must be top management. No owner yet? Name one before you start, because a policy nobody keeps current is out of date by the first new system.
- Your information security policy. Security of personal data is one of the six principles. The data protection policy should point to your security controls, not restate them. No security policy yet? The information security policy template is the place to start.
If none of these exist yet, the job is bigger than one document. That's the point where most firms bring in help.
1. Define your role and scope (about an hour)
- Do this: list the legal entities, teams and systems in scope, the categories of people whose data you process, and whether you act as controller, processor or both for each main activity.
- The template: has a scope section with placeholders for entities, data subjects and roles, and a short controller-or-processor guide in the getting-started notes.
- Watch for: a scope that only covers client data. Employee and candidate data is personal data too, and it's often the most sensitive data a small firm holds.
2. Settle accountability and your DPO position (1 to 2 hours, including the conversation with your leadership)
Next, name the person who owns data protection day to day, the director accountable for it, and what every manager and member of staff must do. Then work through the Article 37 criteria and record your decision on a data protection officer. The template's roles section and DPO decision record give you the structure. The judgement is in being honest about your core activities.
3. Make each principle real (half a day)
- Do this: for each of the six Article 5(1) principles, write what you actually do and where the evidence lives. For example: for storage limitation, "records are kept for the periods in our retention schedule and deleted by [process]".
- The template: sets the principles out as a table, one row each, with columns for the commitment, the procedure that delivers it and the evidence.
- Watch for: restating the law. "Personal data shall be accurate and kept up to date" is the regulation's sentence, not your process. An auditor will ask how.
4. Connect the procedures beneath it (2 to 3 hours)
Then link the policy to the procedures that do the work: privacy notices, data subject requests, complaints, data protection impact assessments, processor contracts, international transfers and breaches. Two of these changed recently or are often missed. Since 19 June 2026, the Data Protection Act 2018 (section 164A) requires controllers to make it easy for people to complain to them, and to acknowledge a complaint within 30 days. And Article 33(5) requires every personal data breach to be logged, including the ones you decide not to report to the regulator. A reportable breach must be reported without undue delay and, where feasible, within 72 hours of becoming aware of it. The template points to each procedure by name, so you list the ones you have and flag the ones you don't.
5. Approve, communicate and record training (one management meeting, then 1 to 2 hours)
- Do this: take the policy to top management for approval and set a review date no more than a year out. Publish it where staff can find it, ask everyone in scope to confirm they've read it, and include it in induction and annual data protection training.
- The template: includes a policy management checklist for the approval, acknowledgement, training and review records.
- Watch for: training that never mentions the policy, and acknowledgement no one can evidence. Both are covered in How to use it so it holds up at audit. The A.6.3 guide covers the training side.
Do it yourself, or have us do it with you
| Do it yourself with the template | Do it with GRCMANA | |
|---|---|---|
| What you end up with | An approved data protection policy | The policy, plus the documents beneath it: privacy notices, a record of processing, a retention schedule, request and breach procedures, and a recorded DPO decision, consistent with each other and with your ISO 27001 controls. Ongoing support from a virtual DPO if you want it |
| Your time | About a day, if you already know what data you hold and where it goes. Considerably more if you don't | Less of your own time: we run the data mapping and draft the documents, and your team reviews and decides |
| Best if | Someone on your team understands UK GDPR and is comfortable making the judgement calls above | Data protection landed on you alongside your day job, a client is asking for evidence, you process sensitive data at scale, or you're not sure whether you need a DPO |
Prefer the second column? Talk to us about a virtual DPO.
What good looks like
Most data protection policies quote UK GDPR accurately. Fewer describe what the firm actually does. Here is the difference.
Weak and strong, side by side
| Section | Weak | Strong | Why the strong one works |
|---|---|---|---|
| Scope | "This policy applies to all personal data." | "This policy applies to personal data about clients, client end-users, staff, candidates and suppliers, processed by [entity] as controller, and as processor for [service] under client contracts." | It names the data subjects and the role, which can be checked against your record of processing. |
| Accountability | "Everyone is responsible for data protection." | "[COO] is accountable to the board. [Name], our data protection lead, owns this policy. We have recorded why we are not required to appoint a DPO (Appendix A)." | Named roles and a recorded DPO decision can be sampled. "Everyone" can't. |
| Storage limitation | "Data will not be kept longer than necessary." | "We keep personal data for the periods in our retention schedule ([location]). [Owner] runs a deletion review each [quarter]." | It points to a schedule and a process an auditor can test. |
| Breaches | "Breaches will be reported to the ICO." | "Staff report suspected breaches to [channel] immediately. [Lead] assesses each one, logs it, and reports reportable breaches to the regulator within 72 hours of becoming aware, where feasible." | It covers logging every breach and the 72-hour clock, not just reporting. |
| Rights and complaints | "We respect individuals' rights." | "Requests and complaints go to [address or form]. We log each one, acknowledge complaints within 30 days and respond to requests within the statutory time limit." | It names the route and the log, which is where the evidence lives. |
What an auditor checks in the first five minutes
Before reading the detail, most auditors and client privacy reviewers check that:
- It's current and approved. It has a version, an approval by top management and a review date that hasn't passed.
- Someone owns it. A named data protection lead or DPO, and a recorded decision on whether you need a DPO.
- It matches your processing. The data and roles it describes match your record of processing and your privacy notices.
- The procedures exist. Every procedure it names, such as requests, breaches and retention, can be produced on request.
- There's a breach log. It exists, and it includes breaches that weren't reported.
- You're registered. You've paid the data protection fee to the ICO, unless you're exempt.
If all six hold, the reviewer moves on with confidence. If one fails, they usually look harder at everything else.
What good looks like at 25 staff and at 250
| Feature | Around 25 staff | Around 250 staff |
|---|---|---|
| Length | Five to eight pages | Eight to twelve pages, with procedures in separate documents |
| Owner | A director acting as data protection lead alongside their main role | A named privacy or compliance lead, or a DPO where Article 37 applies |
| Record of processing | A spreadsheet covering the main activities | A maintained register, reviewed with each new system or supplier |
| Requests and complaints | A shared mailbox and a simple log | A defined workflow, often in a ticketing tool, with response-time reporting |
| Training | Induction plus a short annual refresher | Role-based training, with extra depth for HR, sales and engineering |
| Reporting | An annual update to the directors | Regular metrics to the management review or board |
The common mistake at 25 staff is adopting a policy written for a large enterprise: it describes a privacy team the firm doesn't have. The common mistake at 250 is the reverse, a policy written at 40 people that never caught up with new systems, suppliers and data.
How to use it so it holds up at audit
The policy is only half the evidence. An auditor, a client or the regulator tests whether it operates, and these are the records they usually ask for:
- The approval record: who in top management approved this version, and when.
- Acknowledgement and training: evidence that staff in scope have read the policy and completed data protection training.
- The DPO decision: the recorded reasons for appointing a DPO, or for not needing one.
- Operating records: the record of processing, the request and complaint log, the breach log and completed impact assessments.
- The review history: the date of the last review, what changed, and the next review date.
The most common reasons a data protection policy fails audit:
- It was copied from a template and describes processing the firm doesn't do, or misses processing it does.
- It promises procedures, such as retention, deletion and request handling, that don't exist.
- It names a DPO who isn't independent, or no one at all.
- The breach log is empty because only reported breaches were recorded.
- It's more than a year old, and nothing shows it was reviewed after new systems or suppliers arrived.
Each of these is cheap to fix before an audit and expensive to explain after a breach.
Data protection policy questions
Its purpose and scope, your role as controller or processor, who is accountable, how you meet each of the UK GDPR principles, and how you handle lawful basis, transparency, individuals' rights and complaints, security, processors, transfers, retention, breaches and training. It should point to the procedures that deliver each one.
UK GDPR Article 24 requires appropriate data protection policies where they are proportionate to your processing, and Article 5(2) requires you to demonstrate compliance. For most firms handling client and employee data, a policy is the simplest way to do both.
A data protection policy is internal. It tells staff the rules and names who is accountable. A privacy policy, properly called a privacy notice, is external. It tells individuals what you do with their data and what rights they have. You need both, and they should agree.
Yes. "GDPR policy" and "data protection policy" usually mean the same internal document. In the UK it should be written against UK GDPR and the Data Protection Act 2018, not only the EU GDPR.
At least once a year, and after any significant change, such as a new system, a new supplier handling personal data, a new type of data or a change in the law. Keep a record of each review, even when nothing changes.
Get the template
Start from a policy that already follows UK GDPR's structure, written for a firm your size, with your DPO decision built in. Download the Word template, put your names and data in, and take it to your next management meeting for approval.
This template is a starting point to adapt to your organisation, not legal advice.
