GDPR Policy Template: generate your own documents

When running a business, you’re likely to be using personal data in some form or other, whether it’s personal data of your staff, customers or other business contacts. As soon as you start processing any personal data at all, you’ll need to make sure you comply with data protection law. This includes putting in place appropriate GDPR policies and procedures to make sure your business is UK GDPR compliant. This GDPR policy template toolkit (also called a Data protection policy toolkit) provides templates for 8 key data protection policies that your business is likely to need.

How do I use the GDPR policy toolkit?

Our Data protection policy toolkit (or GDPR policy template toolkit) contains 8 customisable data protection policy templates that your business is likely to need to ensure it is UK GDPR compliant. It also contains a helpful how-to guide, which will tell you how to use each policy.

Steps to generate your own policies using the GDPR toolkit

1. Download the GDPR policy template toolkit
2. Read the ‘How-to’ Guide
3. Complete the questionnaires to generate bespoke GDPR policies for your business
4. Download your completed policies

Do I need GDPR policy templates?

The specific GDPR policy templates your business needs will depend on its operations and whether it is a data controller or a data processor.

If you are a data controller, you must put in place necessary measures to comply with your data protection obligations. This includes having appropriate data protection policies to demonstrate how you comply with those obligations. You must also provide the people whose data you have with some key information about what that data is, what you will do with it, how long you will keep it, what their rights are etc. In most cases, this will mean having appropriate privacy notices setting out this information.

What is a data controller?

If you use personal data for the purposes of your own business, for example, when you use staff members’ personal details to pay them or customers’ personal details to process their orders for your product or services, your role is known as data controller. For most businesses, most or all of the data processing they carry out is as a data controller.

Whenever your business handles personal data as a data controller, there are various legal requirements that you must comply with. These obligations extend to any form of using, or processing, the data, covering almost anything you may be doing with it.

Note that you have fewer data protection obligations if you are dealing with personal data on behalf of someone else and in accordance with their instructions (this role is called data processor) (see below).

What is a data processor?

You are a data processor if you are dealing with personal data on behalf of someone else and in accordance with their instructions. For example, you may be hired by another company to carry out marketing for it, in which case you will likely be dealing with the personal data of its customers in accordance with its instructions.

If my business is a data controller, what are my data protection obligations?

When using personal data for the purposes of your own business, you must:

1. Be clear from the beginning about why you are collecting personal data and what you intend to do with it. In practice, this can usually be done by including a list of reasons for which you are collecting the data in a privacy policy. You need to provide privacy information to individuals about how you will use their data, usually done online through your website privacy policy. See our definitive guide to privacy policy templates and our guide on cookie policies for more information.
2. Ensure that you only collect and use personal data which is relevant and necessary in order to fulfil the purpose for which you are collecting it.
3. Store any personal data securely and not keep it for longer than necessary, establishing time limits for deleting data or reviewing whether it needs to be deleted.
4. Do what you can to make sure that data you hold is accurate and where necessary, is kept up to date; if you become aware that data you hold is inaccurate then you must erase or amend it without delay.
5. Ensure that you have a lawful reason for processing personal data.
6. If you use cookies on your website, ensure you obtain the relevant consents.
7. Pay a modest annual fee to the ICO if you qualify to do so.
8. Have a procedure to be followed if you receive any request from an individual about the data you hold on them.
9. Have comprehensive data protection policies and procedures in place (use our GDPR policy template toolkit to generate bespoke policies for your business.
10. Devise and implement a data protection impact assessment (DPIA) procedure to use when your data processing is likely to result in a high risk to the rights and freedoms of individuals.
11. Consider whether you need to appoint a data protection officer (DPO) or alternatively a member of staff who takes responsibility for data protection matters within your business.
12. Provide appropriate data protection training for staff.
13. Keep suitable records to demonstrate your compliance with data protection law.
14. Create an internal process to deal with any data breaches (eg the loss, theft or misuse of personal data in your possession) and train your staff to carry it out.
15. If you wish to share personal data with another person or business, review your data sharing agreement to ensure it complies with your obligations under the GDPR.
16. If you operate an online service which is likely to be accessed by children, ensure that you comply with the ICO’s Age Appropriate Design Code (see our Guide on the Children’s Code).

For detailed guidance on your data protection obligations as a controller, see our Q&A on Data protection obligations.

If my business is a data processor, what are my data protection obligations?

Your business has different data protection obligations when acting as the data processor rather than the data controller. You will have fewer responsibilities than you have when dealing with personal data that you process for your own purposes  (eg your own staff data and your own customer or client lists).

Your chief data protection obligations when acting as a data processor are:

1. provide appropriate data protection training for staff;
2. keep suitable records to demonstrate your compliance with data protection law;
3. create an internal process to deal with any data breaches (eg the loss, theft or misuse of personal data in your possession) and train your staff to carry that process out;
4. store any personal data securely and do not keep it for longer than necessary;
5. consider whether you need to appoint a data protection officer (DPO) or alternatively a member of staff who takes responsibility for data protection matters within your business; and
6. if you need to share the data with another person or business, you need to get written permission from the business under whose direction you are using the data.

Note that you may also be required to help the person or persons for whom you are processing the data to carry out a DPIA where necessary.

For detailed guidance on your data protection obligations as a processor, see our Q&A on Data protection obligations.

What happens if I don’t comply with my UK GDPR obligations?

Your UK GDPR obligations are ongoing, so you will need to ensure that you continually keep your processes under review. Failure to comply with data protection law can have serious financial and reputational consequences for your business, including fines of up to £17.5 million or 4% of your global annual turnover (whichever is higher) in some cases. It is therefore important to take your obligations seriously.

Can I insure against fines for failing to follow data protection law?

Probably not.

Fines for breaching your data protection obligations can potentially be very damaging, the maximum amount being £17.5 million or 4% of your annual global turnover, depending on the type of breach. Even if you can find an insurer who will provide affordable coverage for these fines, any such policy is likely to ultimately prove legally unenforceable if you try to make a claim. The main reason for this is that the fine is intended to have a deterrent effect and if businesses are able to mitigate against the risk of a fine by having insurance, the deterrent effect will be lost.

How does Brexit affect my GDPR policy templates?

Following the UK’s exit from the EU on 31 January 2020, there was a transition period until 31 December 2020 during which the EU and the UK were negotiating their future relationship. During this period, there were no immediate changes to data protection law in the UK and the GDPR continued to apply. From 1 January 2021, the EU GDPR has been retained in UK law as the UK GDPR.

In practical terms, this means that your key data protection obligations remain the same and you should generally continue to follow existing guidance. The ICO has advised that businesses already complying with their data protection obligations prior to Brexit and which have no contacts or customers in the EEA, will not have much more to do to now that the transition period is over. You should, however, review your data protection policies to make any amendments required to ensure that they work in a UK only context (eg by removing references to EU law); our GDPR policy templates are UK GDPR compliant.

However, if your business does have contacts or customers in the EEA or internationally then you may need to take additional steps to ensure data protection compliance following Brexit. Our Q&A on Data protection obligations provides guidance about what steps you should take.

The content in this article is up to date at the date of publishing. The information provided is intended only for information purposes, and is not for the purpose of providing legal advice. Sparqa Legal’s Terms of Use apply.

Frankie Mundy

Before joining Sparqa Legal as a Senior Legal Editor in 2017, Frankie spent five years training and practising as a corporate disputes and investigations lawyer at leading international law firm Hogan Lovells. As legal insights lead, Frankie regularly contributes to Sparqa Legal’s blog, writing content across employment law, data protection, disputes and more.