Where proportionate, controllersControllerDecides why and how personal data is processed. Carries most of the duties, and most of the penalties. must implement appropriate data protection policies. A policy framework is the set of documents that says what the organisation will do, who does it, and how anyone will know. It is evidence of accountability only if it describes what actually happens.
A practical hierarchy
| Layer | Purpose | Examples |
|---|---|---|
| Policy | Commitments and responsibilities, approved by senior management | Data protection policy, information security policy |
| Standards | Specific rules that implement the policy | Retention schedule, classification scheme, access standard |
| Procedures | Step-by-step how-to | Subject access, breach response, DPIADPIAData protection impact assessment: a structured risk assessment required before processing likely to result in a high risk to people., complaints |
| Records | Evidence the procedures ran | Request log, breach register, completed DPIAs |
The data protection policy should be short. The work is in the standards and procedures.
The core set
- Data protection policy
- Information security policy
- Retention schedule and records management policy
- Rights request procedure, with subject access stop-the-clock rules
- Breach response procedure, including PECR where it applies
- DPIA procedure and screening
- Complaints procedure, required since 2026-06-19 for data protection complaints
- ProcessorProcessorProcesses personal data on a controller's instructions, such as a cloud host or payroll bureau, with its own security and breach duties. and data sharing procedure
- International transfer procedure
- Appropriate policy document, where Schedule 1 conditions require one
- Acceptable use and monitoring policies for staff
Making policies real
- Owners. Every document has a named owner and a review date.
- Fit. Written for the people who will use them, in their language.
- Training. Linked to role-based training, not a single annual module.
- Exceptions. A route to record departures, approved by the owner.
- Testing. Procedures rehearsed, especially breach response.
Public authorities
For public authorities, the FOI publication scheme and the records management code under FOIA s.46, or FOISA s.61 in Scotland, belong in the same framework: records management is what makes both access regimes work.
For a complaint
A policy that the organisation did not follow is strong evidence. Ask for the relevant procedure; an organisation that cannot produce one has an accountability problem as well as the original failure.