What Is Data Protection Policy?
A Data Protection Policy (DPP), while not a legal requirement, serves as a crucial security protocol to systematize the utilization, oversight, and governance of data within an organization. Its paramount purpose is to safeguard and secure every piece of data that an organization handles, stores, or processes, ensuring that it complies with data protection standards and regulations.
A comprehensive DPP should extend its coverage to all data preserved within the organization’s core infrastructure. This includes data housed in on-site storage equipment, remote locations, and cloud-based services. Its primary role is to fortify the security and integrity of all data, whether at rest or in transit.
By establishing a robust DPP, an organization exhibits its commitment to protecting consumer data privacy. In situations such as compliance audits or data breaches, the policy can serve as compelling evidence of the organization’s dedication to data protection principles.
A well-rounded DPP should encapsulate:
- The extent of data protection required
- Data protection strategies and policies deployed by relevant entities including individuals, departments, devices, and IT environments
- Pertinent legal or compliance stipulations for data protection
- The assigned roles and responsibilities associated with data protection, including data custodians and roles explicitly accountable for data protection activities.
In essence, a DPP is more than a policy; it is an affirmation of an organization’s commitment to safeguarding data privacy and maintaining data integrity.
Related content: Read our guide to data protection regulations
In this article:
- What’s the Difference Between a Data Protection Policy and a Privacy Policy?
- Key Elements to Include in Your Data Protection Policy
- Implementing a Data Protection Policy
- 3 Best Practices for Building Your Data Protection Policy
- Data Protection with Cloudian Secure Storage
Note: This article is part of a series on Data Protection.
The information provided in this article and elsewhere on this website is meant purely for educational discussion and contains only general information about legal, commercial and other matters. It is not legal advice and should not be treated as such. Information on this website may not constitute the most up-to-date legal or other information.
The information in this article is provided “as is” without any representations or warranties, express or implied. We make no representations or warranties in relation to the information in this article and all liability with respect to actions taken or not taken based on the contents of this article are hereby expressly disclaimed.
You must not rely on the information in this article as an alternative to legal advice from your attorney or other professional legal services provider. If you have any specific questions about any legal matter you should consult your attorney or other professional legal services provider.
This article may contain links to other third-party websites. Such links are only for the convenience of the reader, user or browser; we do not recommend or endorse the contents of any third-party sites.
What’s the Difference Between a Data Protection Policy and a Privacy Policy?
A privacy policy is a document that explains to customers how the organization collects and processes their data. It is made available to the public by organizations required to comply with privacy regulations.
A data protection policy is an internal document created for the purpose of establishing data protection policies within the organization. It is made available to company employees, as well as third parties, responsible for handling or processing sensitive data.
Key Elements to Include in Your Data Protection Policy
A data protection policy should be tailored to the organization’s size, risk profile, processing activities, and legal obligations. At minimum, it should include the following elements.
Scope
The policy should clearly define what data, systems, people, and processing activities it covers. This should include the types of personal data the organization collects, the categories of data subjects involved, and the purposes for which personal data is processed.
The scope should cover personal data handled by:
- Employees
- Contractors
- Departments and business units
- IT systems and applications
- Cloud services
- SaaS platforms
- Mobile devices
- Backup and archive systems
- Third-party processors and service providers
The policy should also explain whether it applies globally or only to certain jurisdictions, business units, or processing activities. If the organization transfers personal data across borders, the policy should require appropriate safeguards for international data transfers.
Definitions
The policy should define key data protection terms so that employees and stakeholders understand their obligations. Important definitions include:
- Personal data: Any information relating to an identified or identifiable individual. This can include names, identification numbers, location data, online identifiers, contact details, financial information, employment data, and other information that can identify a person directly or indirectly.
- Special category data: Sensitive personal data that receives additional protection under the GDPR, such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, and data concerning a person’s sex life or sexual orientation.
- Processing: Any operation performed on personal data, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, transmission, restriction, erasure, or destruction.
- Data controller: The person or organization that determines the purposes and means of processing personal data.
- Data processor: A person or organization that processes personal data on behalf of a controller and only under the controller’s instructions.
- Joint controllers: Two or more controllers that jointly determine the purposes and means of processing.
- Data subject: The individual whose personal data is being processed.
- Consent: A freely given, specific, informed, and unambiguous indication of the data subject’s wishes, given by a clear affirmative action.
- Personal data breach: A security incident that leads to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data.
- Data protection officer: A person appointed, where required, to advise on data protection obligations, monitor compliance, support DPIAs, and act as a contact point for supervisory authorities and data subjects.
GDPR Principles
The data protection policy should reflect the GDPR’s core principles for processing personal data.
- Lawfulness, fairness, and transparency: Personal data must be processed lawfully, fairly, and transparently. Individuals should receive clear information about how their data is used.
- Purpose limitation: Personal data should be collected for specified, explicit, and legitimate purposes and not further processed in a way that is incompatible with those purposes.
- Data minimization: The organization should only collect and process personal data that is adequate, relevant, and limited to what is necessary.
- Accuracy: Personal data should be accurate and, where necessary, kept up to date.
- Storage limitation: Personal data should not be kept longer than necessary for the purposes for which it is processed.
- Integrity and confidentiality: Personal data should be protected against unauthorized or unlawful processing, accidental loss, destruction, or damage using appropriate security measures.
- Accountability: The controller must be able to demonstrate compliance with GDPR principles through policies, procedures, records, contracts, technical controls, training, and governance.
Lawful Processing of Personal Data
The policy should explain that every processing activity must have a valid lawful basis before personal data is collected or used. The lawful basis should be identified, documented, and communicated where required.
The GDPR lawful bases are:
- Consent: The individual has given clear consent for a specific processing purpose.
- Contract: Processing is necessary to perform a contract with the individual or to take steps at the individual’s request before entering into a contract.
- Legal obligation: Processing is necessary to comply with a legal obligation.
- Vital interests: Processing is necessary to protect someone’s life or vital interests.
- Public task: Processing is necessary to perform a task in the public interest or in the exercise of official authority.
- Legitimate interests: Processing is necessary for the legitimate interests of the controller or a third party, unless overridden by the individual’s rights and freedoms.
The policy should make clear that legitimate interests should not be treated as a default or fallback basis. Where the organization relies on legitimate interests, it should document the legitimate interest, assess whether the processing is necessary, and complete a balancing test to consider the impact on individuals.
The policy should also explain when consent is appropriate, how consent is recorded, and how individuals can withdraw consent.
Roles and Responsibilities
The policy should assign responsibility for data protection across the organization. This includes executive leadership, legal and compliance teams, IT and security teams, department heads, employees, processors, and the data protection officer where one is appointed.
The policy should define responsibilities for:
- Maintaining compliance with data protection laws
- Implementing technical and organizational security measures
- Maintaining records of processing activities
- Reviewing lawful bases for processing
- Handling data subject rights requests
- Managing consent records
- Conducting data protection impact assessments
- Reviewing third-party processors and contracts
- Responding to personal data breaches
- Training employees on data protection requirements
- Cooperating with supervisory authorities
If the organization uses processors or sub-processors, the policy should require due diligence, written processing agreements, appropriate security measures, and ongoing oversight. Contract labels alone are not enough; the organization should assess the actual role each party plays in determining the purpose and means of processing.
Records of Processing Activities
The policy should explain how the organization documents its processing activities. Records of processing activities help demonstrate accountability and are required under GDPR Article 30 in many circumstances.
Records should generally include:
- The purposes of processing
- Categories of data subjects
- Categories of personal data
- Categories of recipients
- International transfers and safeguards
- Retention periods
- Security measures
- The controller, processor, and relevant contact details
- The lawful basis for processing, where appropriate
Smaller organizations may qualify for limited record-keeping exemptions in some circumstances, but these exemptions should be assessed carefully. Organizations that process personal data in ways that are not occasional, involve special category data, involve criminal offence data, or pose risks to individuals should not assume they are exempt from record-keeping obligations.
The organization should review regulatory changes regularly, including proposed EU simplification measures that may affect Article 30 record-keeping obligations.
Data Protection Impact Assessments
The policy should require a Data Protection Impact Assessment when processing is likely to result in a high risk to individuals’ rights and freedoms. DPIAs are especially important for new technologies, large-scale monitoring, profiling, automated decision-making, special category data, and processing that may significantly affect individuals.
A DPIA should identify:
- The nature, scope, context, and purpose of processing
- Whether the processing is necessary and proportionate
- Risks to individuals
- Measures to reduce or manage those risks
- Residual risks after mitigation
- Whether consultation with a supervisory authority is required
DPIAs should be completed before high-risk processing begins and reviewed when processing changes.
Data Subject Rights
The policy should explain how the organization handles data subject rights requests. Under the GDPR, individuals may have the right to:
- Be informed about how their personal data is used
- Access their personal data
- Rectify inaccurate or incomplete data
- Erase personal data in certain circumstances
- Restrict processing in certain circumstances
- Receive their data in a portable format
- Object to certain processing activities
- Challenge automated decision-making, including profiling, in certain circumstances
- Lodge a complaint with a supervisory authority
The policy should define how requests are received, verified, recorded, assessed, and answered within applicable deadlines.
Security Measures
The policy should describe the technical and organizational measures used to protect personal data. These measures should be appropriate to the nature of the data, the processing risks, and the organization’s environment.
Security measures may include:
- Access controls
- Multi-factor authentication
- Role-based permissions
- Encryption
- Pseudonymization
- Secure configuration
- Network security controls
- Endpoint protection
- Logging and monitoring
- Vulnerability management
- Backup and disaster recovery procedures
- Secure disposal of data and devices
- Staff training
- Incident response procedures
The policy should also require regular review and updates to security measures as risks, systems, and processing activities change.
Data Retention and Deletion
The policy should explain how long personal data is retained and when it must be deleted, anonymized, or archived. Retention periods should be based on business needs, legal obligations, contractual requirements, limitation periods, and the purposes for which the data was collected.
The policy should require:
- Defined retention periods for major data categories
- Secure deletion procedures
- Periodic review of stored data
- Controls for archived and backup data
- Documentation of retention decisions
- Processes for handling deletion requests
Keeping personal data longer than necessary can increase legal, operational, and security risk.
Third-Party Processors and International Transfers
If the organization shares personal data with vendors, service providers, cloud platforms, or other third parties, the policy should define how those relationships are assessed and governed.
The policy should require:
- Due diligence before engaging processors
- Written data processing agreements
- Clear processing instructions
- Security and confidentiality commitments
- Sub-processor controls
- Breach notification obligations
- Audit or assurance rights
- Return or deletion of data at the end of the relationship
For international transfers, the policy should require an appropriate transfer mechanism, such as an adequacy decision, standard contractual clauses, binding corporate rules, or another GDPR-compliant safeguard.
Data Breach Notification Procedures
The policy should include a clear process for identifying, reporting, investigating, and responding to personal data breaches.
The breach response procedure should cover:
- How employees report suspected incidents
- How the organization contains and investigates a breach
- How risks to individuals are assessed
- When to notify the supervisory authority
- When to notify affected individuals
- How to document the breach and response
- How to prevent similar incidents in the future
Under the GDPR, controllers must notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a notifiable personal data breach. If the breach is likely to result in a high risk to individuals, affected individuals may also need to be informed.
Contact Information
The policy should provide clear contact information for privacy and data protection matters. This may include:
- The data protection officer, if one is appointed
- The privacy, legal, or compliance team
- Instructions for submitting data subject rights requests
- Instructions for reporting privacy concerns or suspected breaches
- Contact details for the relevant supervisory authority, where appropriate
Clear contact information supports transparency and helps individuals exercise their rights.
Implementing a Data Protection Policy
A data protection policy should not remain a theoretical document. Rather, it should be implemented as part of the overall policies and governance of the organization, and treated in the same manner.
Here are several practices to consider when implementing your data protection policies:
- Add it to the staff handbook—introduce the policy to your staff. Make sure they read it and understand they are required to adhere to the policy.
- Provide a summarized version—if the policy is long, provide your staff with a summary that covers the main aspects and practices they are required to follow.
- Offer training and supervision—when first implementing the policy, provide your staff with the training needed to effectively practice organizational data protection standards. Make sure training is provided according to individual roles and work practices.
- Inform relevant third-parties—if your organization requires external contractors and partners to comply with the data protection policy, they should be provided with a copy. Additionally, you should make sure to add relevant contract clauses.
3 Best Practices for Building Your Data Protection Policy
The following best practices can help you build a successful data protection policy.
Understand the GDPR
Make sure you know what the General Data Protection Regulation is about and keep up to date with new policies.
The GDPR aims to give EU residents better control over how their data is processed. The existing legislation stipulates that individuals can request a copy of their personal data via a subject access request (SAR), and the request must be processed within 30 days. Individuals can also request that their data be amended or deleted, unless there is a legal justification to retain the data.
GDPR also aims to standardize personal data protection across the EU. While data protection authorities in each country have some autonomy, they must work together closely to ensure that data protection is managed in a uniform manner.
Related content: Read our guide to GDPR data protection
Take Inventory of Sensitive Data
In collaboration with IT, create a comprehensive inventory cataloging the storage locations of sensitive company data (in both on-premise and cloud-based applications).
The inventory should include the following analyses:
- HR system data (i.e. employee records, payroll, health and retirement benefits)
- Unstructured data residing in company equipment, remote servers and email accounts
- Persons with view or edit access to data
- The volume of data and aging
Establish Guidelines for Your Data Privacy Protection Policy
Outline the principles of your DPP and provide guidelines that clarify your organization’s data privacy posture. Consult stakeholders and experts to understand the needs of your organization and assess your ability to maintain the privacy and confidentiality of data on every system.
Research the organization to determine:
- What data is collected
- How long it is retained (and if this complies with regulations)
- Whether data is openly available or had limited access (and monitoring)
- The measures in place to protect data
- Whether data is used appropriately (according to the purpose of its collection)
Related content: Read our guide to data protection strategy
Data Protection with Cloudian Secure Storage
Data protection requires powerful storage technology. Cloudian’s storage appliances are easy to deploy and use, let you store Petabyte-scale data and access it instantly. Cloudian supports high-speed backup and restore with parallel data transfer (18TB per hour writes with 16 nodes).
Cloudian provides durability and availability for your data. HyperStore can backup and archive your data, providing you with highly available versions to restore in times of need.
In HyperStore, storage occurs behind the firewall, you can configure geo boundaries for data access, and define policies for data sync between user devices. HyperStore gives you the power of cloud-based file sharing in an on-premise device, and the control to protect your data in any cloud environment.
Learn more about data protection with Cloudian.
