What is an appropriate policy document, and when do you need one?

What it is

Schedule 1 Part 4 of the DPA 2018 sets out what the document must contain: the procedures for complying with the principles, and the policies on retention and erasure for the data processed under the condition, with an indication of how long it will be kept.

When you need one

• When relying on the employment, social security and social protection condition. DPA 2018 Sch 1 para 1
• When relying on most substantial public interest conditions in Part 2, where the condition says so. DPA 2018 Sch 1 para 5
• When processing criminal offence data under conditions that require it. DPA 2018 Sch 1 Part 3

Who is responsible

The controller, which must keep the document under review, keep it for six months after the processing ends, and make it available to the regulator on request.

What it involves

1. List the Schedule 1 conditions you rely on.
2. Explain how you meet each principle for that processing.
3. Set out retention and erasure.
4. Record the condition and the APD in your record of processing.
5. Review it regularly.

Timing

In place when the processing starts, and retained for at least six months after it ends.

If it goes wrong

Regulatory

Without an APD the Schedule 1 condition is not met, so the processing breaches Art 9 or 10. A breach sits in the higher tier of penalties: up to £17.5 million or 4% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice ordering the processing to stop or change.

Criminal

No offence.

Civil

Anyone who suffers material or non-material damage, including distress, because of the infringement can claim compensation from the controller or processor in the county court or High Court (sheriff court or Court of Session in Scotland) under Art 82 and DPA 2018 s.168.