Policy Creation

The building blocks of Compliance e: stonearch@protonmail.com t: 01706 559 022

Stone Arch
Data Protection

UK GDPR Expertise You Can Rely On.

Policy Creation

Stack of white envelopes tied with string.

Your policies are a key tool in your ability to demonstrate and achieve data protection compliance, as well as offering confidence to your customers that you take data protection seriously.

Stone Arch can assist by quality assuring and improving your existing data protection policies and procedures, as well as identifying gaps in your policy framework.

We'll ensure that you have the right policies and procedures in place, which are written in plain English, and understood by your staff so that they are clear about their obligations and requirements when handling personal data.

Policies and procedures make up part of our recommended five steps to compliance - please see below for further information about this aspect of your compliance journey. And don't forget to reach out to ask us about our "5 Steps to Compliance" course!

Policy and Procedure: into the detail

Difficulty level

🟢 Low (with Stone Arch templates)

Why is this important?

Policies and procedures provide the framework that help your business manage personal data consistently and responsibly.

Policies explain the standards and expectations that apply across the organisation. Procedures provide practical guidance on how those expectations are implemented in day-to-day activities.

Together, they help demonstrate accountability, which is a fundamental principle of data protection law..

What are the risks if we get it wrong?

Without clear policies and procedures:

Your customers and stakeholders may not be aware how their privacy is protected.
Your business may look further behind in the compliance journey than your competitors.
Employees may approach similar situations differently.
Important controls may be missed.
Compliance obligations may not be consistently applied.
Audits and investigations may identify gaps in governance.

Even where good practices exist, failing to document them can make it difficult to demonstrate compliance.

How are Policies and Procedures created?

The starting point is understanding the activity or obligation that requires governance.

When developing a policy or procedure, consideration should be given to:

The legal requirements involved.
Existing organisational processes.
Who is affected by the document.
What behaviours or actions are required.
How compliance will be monitored.

Good policies focus on principles and expectations. Good procedures focus on practical actions and responsibilities.

Documents should be written in language that is easy for employees, customers and stakeholders to understand and should be reviewed periodically to ensure they reflect current business practices.

Stone Arch recommend that every business has a Data Protection Policy as a minimum. Contact us today for a copy of our policy template, which, with minimal tailoring, provides an industry-leading Data Protection Policy for your business.

In addition to a Data Protection Policy, we recommend you consider implementing the following:

Data Breach Procedure (which sets out what to do in the event of a data breach)
Data Subject Rights Procedure (setting out how to handle any requests made by customers, employees and third parties under the data protection legislation)
Records Management Policy (explaining how you compliantly manage personal data)
Retention and Disposal Procedure (setting out how long you keep personal data and other records for, and how you handle deletion)

Stone Arch Data Protection

UK GDPR Expertise You Can Rely On.

Policy Creation

Policy and Procedure: into the detail

Difficulty level

Why is this important?

What are the risks if we get it wrong?

How are Policies and Procedures created?

Need help?

Stone Arch
Data Protection