FreelanXData protection policy for staff
A practical data protection policy for staff: the GDPR principles in plain words, what to do with requests, suppliers, transfers and breaches.
Applies to: everyone who handles personal data for [Company] · Data protection contact: [name, email] · Effective: [date]
We process personal data lawfully, fairly and transparently; for specified purposes; limited to what is necessary; accurate; kept no longer than needed; and secure (GDPR, art. 5).
- Use personal data only for the purpose for which it was collected.
- Collect only what you need; do not copy data to personal devices or accounts.
- Share personal data only with people who need it, and outside [Company] only under a contract approved by [contact].
- Delete data at the end of its retention period, as set in the retention schedule.
Forward any request from a person about their data (access, correction, deletion, objection) to [contact] the same day. We answer within one month.
A supplier or contractor processing personal data for us must sign a data processing addendum before access.
Do not send personal data outside [the EEA / the UK / the country] without checking with [contact] that safeguards are in place.
Report any suspected loss, theft or unauthorised access to personal data to [contact] immediately. We may have to notify the authority within 72 hours.
Everyone completes data protection training when they join and every [12] months.
Step by step
- 1Copy the policy and complete every [bracket] with your own rules.
- 2Check the practice notes for each country where you have people: local law and collective agreements prevail.
- 3Consult employee representatives where the law requires it, then publish the policy and record that each person received it.
Watch-outs
What changes from one country to another, with the legal source.
Breaches are notified to the authority within 72 hours where there is a risk; requests are answered within one month.
GDPR, art. 12(3) and 33Same timelines under the UK GDPR; the ICO is the authority.
UK GDPR; Data Protection Act 2018Breaches are notified to the Data Protection Board and to affected persons.
DPDP Act 2023, s 8(6)Notifiable breaches are reported to the PDPC within 3 calendar days of assessment.
Personal Data Protection Act 2012, s 26DSecurity incidents that may cause relevant risk are reported to the ANPD.
LGPD, art. 48Residents have rights to know, delete and correct, including employees since 2023.
California Consumer Privacy Act, as amended by the CPRALegal references checked on 15 Oct 2026. Rules change: check the source before you rely on it.
Questions people ask
Is it free?
Yes. Every template is free to read and copy: no sign-up, no email, no download.
Is this legal advice?
This template is for information and does not constitute legal advice; adapt it to your situation and local law.