Data privacy and security policy: access, retention, vendors and breaches

A payroll clerk at a services firm exported the full employee spreadsheet to settle a bank query. The file had home addresses, identity numbers, nominee names and salary history. It went to her personal webmail 'just for the weekend'. Nobody had told her not to, and nobody knew the attachment existed.

A data privacy and security policy exists to stop that kind of quiet exposure. It covers personal data about employees, candidates and customers, and the company's own confidential records. It applies to staff, interns, consultants and every vendor who handles that data for you.

Begin with an inventory. Walk each department and write down which personal data it collects, why, where it sits and who touches it. HR holds the richest set, so start there.

• Employee records: identity documents, bank details, family and nominee details, medical notes, salary and appraisal history.
• Candidate data: CVs, interview notes, assessment scores and unsuccessful applications.
• Customer data: contact lists, project files, support tickets and anything uploaded to your products.
• Company data: contracts, pricing, source code and board papers, which belong under your confidentiality rules.
• Hidden stores: biometric attendance logs, CCTV footage, recruiter spreadsheets on personal drives and exit interview forms.

Mark a few items as sensitive, such as health, financial and identity data. These get tighter access and stricter retention. Keep the list in a data inventory register that HR and IT both review, with a column for the retention label and the storage location.

Collect data only for a purpose you can state. The law on digital personal data expects a lawful ground, usually consent or another permitted use, and a clear notice to the person. Your policy should say which ground applies to each data set and who signs off a new collection.

Write two notices. One goes to employees and candidates, and one to customers. Each says what is collected, why, who sees it, how long it stays and whom to contact. Data minimisation follows: if no form needs a field, remove the field.

• Data owners: name one accountable person per data set, such as the HR head for personnel files and the delivery head for client data.
• Retention schedule: set how long each category stays and what triggers deletion. Longer retention helps disputes and costs more risk. Shorter retention does the opposite.
• Access levels: define roles and what each can see. Broad access is faster and harder to defend.
• Privacy contact: appoint a person or mailbox for requests and complaints, with a deputy.
• Breach escalation: decide who is told within the first hours, who decides on notifying people and who speaks to outsiders.
• Approved processors: keep a list of vendors allowed to hold personal data, with the reason for each.

Each decision is a trade between convenience and exposure. Write the choice down together with the reason, so the next HR head understands why.

Grant access by role and by need. A recruiter does not need payroll files, and a developer does not need appraisal notes. Run a quarterly access recertification with each data owner signing the extract, and remove access the same day a person moves team or leaves. The password and access control policy covers the login mechanics.

State the storage rules plainly. Encrypt laptops, shared drives and backup tapes or cloud buckets. Pseudonymise or mask test data before it reaches a sandbox. Use approved channels to send sensitive files, and never personal email or chat apps. Define the backup routine, keep one copy offline and test a restore each half-year.

Vendors need the most care. Before a payroll tool, a survey platform or a cloud suite receives personal data, record what it will hold, where it stores it and who can see it. Get a data processing agreement covering security, use limits, sub-processors, breach notice and deletion certificates on exit. If data moves to another country, record that and confirm the terms with a qualified adviser. Run a yearly shadow IT sweep of expense claims and browser extensions, since staff adopt survey forms, transcription bots and file converters unasked.

The confidentiality and non-disclosure policy handles classification and sharing of business secrets, so keep the two documents aligned.

1. 1

   Request received

   The person writes to the privacy contact to see, correct or erase their data. HR logs it in the data request register with the date and the identity check.

2. 2

   Owner checks

   The data owner finds the records, confirms what must be kept for another lawful reason and prepares the reply.

3. 3

   Privacy contact replies

   A written response goes out within the period the company has set, with any refusal explained.

4. 4

   Incident reported

   Anyone who suspects exposure tells the privacy contact at once. A lost laptop, a wrong-recipient email and a vendor alert all count.

5. 5

   Lead contains it

   IT revokes access, retrieves what it can and preserves logs. The lead keeps a dated incident record.

6. 6

   Management decides

   The owner or board decides who must be informed and drafts the notice with advice. Then the register is closed with the lessons.

Breach files contain personal data about real people, so they need restricted access and confidential case handling. Keep them out of the ordinary request queue, and share them only with the lead, the owner and counsel.

Keep the data inventory, the consent log, the processor list, the access review log, the data request register, the incident register and signed acknowledgements. Each employee reads the policy, confirms understanding, accepts it and signs with the date and version. New joiners do this in the first week.

Run privacy training at joining and once a year, with extra sessions for HR, finance and IT. Add a half-hour tabletop drill where the team walks through a lost laptop, a mis-sent payslip batch and a vendor alert. Review the policy at least once a year and after any incident or new tool. Update the version number and re-collect acknowledgements.

1. Title and ID: Data Privacy and Security Policy, HR-POL-013, version [number]
2. Purpose: protect personal, customer and company information held by [company name]
3. Scope: all staff, interns, consultants and processors handling our data
4. Definitions: personal data, sensitive data, data owner, processor, breach
5. Policy statements: data is collected only for [stated purposes]; access is by role; records are kept for [number] years
6. Procedures: request handling in [number] working days; incidents reported at once to [privacy contact]
7. Roles: data owners, privacy contact, IT lead, HR head, management
8. Approval authority: [title] approves new processors and retention changes
9. Exceptions: written request to [title], logged with an end date
10. Violations: handled under the disciplinary and grievance policy
11. Legal references: [law on digital personal data, to be confirmed with an adviser]
12. Forms: data request form, incident report, processor assessment, acknowledgement
13. In force from [date], issue [number]
14. Next look: every [number] months or after a major incident
15. Sign-off block: employee ticks read, understood, accepted; adds name, signing date, policy version

Policy drafting and review sits under HR policies and governance. To pick which rulebook to write next, read the 30 policies a growing company needs.