Data Protection Policy Solicitors
A data protection policy is an internal document that sets out how an organisation complies with UK data protection law, including who is responsible, how personal data is collected, used, secured, retained and deleted, and how staff must handle breaches and individuals’ requests.
call 0207 100 2525 to speak to a specialist today. Available 24/7
Adam Bernard Solicitors drafts data protection policies and supporting procedures for businesses, charities and professional practices.
A data protection policy is different from a privacy policy. Your privacy policy (or privacy notice) tells customers and website users how you use their data; see our privacy and cookie policies page. Your data protection policy tells your own staff how to comply.
Call 0207 100 2525 or book a free consultation — via Zoom, Teams, WhatsApp or Skype
Is a Data Protection Policy a Legal Requirement?
UK GDPR requires controllers to implement appropriate data protection policies where proportionate to their processing activities, and to be able to demonstrate compliance. This accountability principle is set out in Articles 5(2) and 24 of the UK GDPR. For most businesses that process employee or customer data, a written policy is the most practical way to meet it. Where special category or criminal offence data is processed under certain conditions, the Data Protection Act 2018 also requires an “appropriate policy document”.
What a Data Protection Policy Should Cover
An effective data protection policy explains the data protection principles, assigns responsibilities, and sets out practical rules and procedures for staff.
• Scope – who and what the policy applies to.
• Roles – senior responsibility, and a data protection officer where required.
• Data protection principles – lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, storage limitation, security and accountability.
• Lawful bases – how the organisation decides and records them.
• Records of processing activities.
• Security – access controls, passwords, encryption, remote working and devices.
• Data retention schedule.
• Individuals’ rights – how to recognise and escalate requests. See our subject access request page.
• Personal data breaches – internal reporting and the 72-hour deadline for notifying the ICO where required.
• Third parties – when a data processing agreement or data sharing agreement is needed.
• Training and consequences of breach.
Updates Needed After the Data (Use and Access) Act 2025
Most data protection changes introduced by the Data (Use and Access) Act 2025 took effect on 5 February 2026, and a new complaints requirement applied from 19 June 2026, so policies written before then should be updated. Changes under the Data (Use and Access) Act 2025 include:
• Recognised legitimate interests as a new lawful basis for certain purposes.
• Reasonable and proportionate searches when responding to subject access requests.
• Revised automated decision-making rules.
• A requirement to facilitate data protection complaints, including acknowledging complaints within 30 days.
• Higher PECR fines, aligned with UK GDPR levels. See the government’s commencement plan.
Supporting Policies and Procedures
Most organisations need a set of related documents, not a single policy. These typically include:
• Data breach response procedure.
• Subject access request procedure.
• Data retention policy and schedule.
• Information security and acceptable use of IT policy.
• CCTV policy, where relevant.
• Employee privacy notice.
• Complaints procedure for data protection complaints.
Registering With the ICO
Most organisations that process personal data must pay the data protection fee to the Information Commissioner’s Office, unless exempt. The ICO’s registration and fee guidance explains whether you need to pay.
Data Protection Policy Checklist
An up-to-date data protection policy should allow you to answer yes to these questions.
• Does it name who is responsible for data protection in the organisation?
• Does it reflect the data you actually process, as recorded in your records of processing?
• Does it explain how staff should recognise and escalate rights requests and breaches?
• Does it include a retention schedule or refer to one?
• Has it been updated for the Data (Use and Access) Act 2025, including complaints handling?
• Have staff been trained on it in the last twelve months?
Employee Monitoring and AI Tools
Policies should also set clear rules for monitoring staff and for using generative AI tools with personal data. Monitoring must be necessary, proportionate and transparent, and staff should be told what is monitored and why. Staff should not enter personal or confidential information into AI tools unless the organisation has approved the tool and assessed the data protection risks.
These rules can sit in your data protection policy or in a separate acceptable use policy.
How Adam Bernard Solicitors Can Help
We draft data protection policies and procedure packs, audit existing policies for the Data (Use and Access) Act changes, and train staff. Existing policies can be updated through our contract redrafting service. See all our commercial contract services.
Call 0207 100 2525 (24/7) or book a free consultation to discuss your contract.
This page is for information only and does not constitute legal advice.
Frequently Asked Questions
Is a data protection policy a legal requirement in the UK?
What is the difference between a data protection policy and a privacy policy?
How often should a data protection policy be reviewed?
What must a business do if there is a data breach?
Do small businesses need a data protection policy?
Request to book a Free Consultation
Our Clients Share Their Success Stories.
Good service 👍 👌 many thanks for the great service you have provided to us. Our visa got approved just within 2 weeks only because of your hardwork and subject matter expertise. I am very thankful to you
For me, it was the attitude towards the job the lawyers displayed. Totally unmatched. I've been in and out of law firms because of the divorce with my wife and other related issues but Adam Bernard Solicitors was it for me guys. The best!
I want to thank Adam Benard team, they really helped me in my process of purchasing a property, their team are listen and respond to their customers fast. I really love your service, thanks alot.
Adam Bernard team helped me to purchase the best property for the best amount of time for the best money i have . i personally love dealing with them and i thank the team for all the efforts they made to make the task better .
