Data protection is mostly common sense written down: know what you hold about people, have a reason for it, keep it safe and do not keep it longer than needed. This guidance puts that in plain terms.
This guidance document is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Guidance number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested guidance documents. No junk, jargon or unnecessary content. Simple and usable guidance documents
developed over 25 years through practical use in the real world.
Further guidance on data protection and personal data:
To get access to these files please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. The guidance is also included in the GDPR / Data Protection Toolkit.
If you'd like hands-on help putting your personal data register and breach reporting in place, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Data Protection Guidance
A general guidance document on data protection for everyone who handles personal data at work. It explains what counts as personal data, how it must be handled, the reason needed for each use, requests from individuals, using AI tools, keeping and deleting data and reporting breaches.
Topics Covered
- What counts as personal data - any information about an identifiable living person, from HR records and CCTV to emails, AI summaries and vehicle location data
- Special category and criminal offence data - extra protection for health, beliefs, biometric and criminal record information, collected only with a clear need and a recorded reason
- Handling and lawful basis - the principles for using personal data, and the lawful basis for each use recorded on the personal data register
- Your responsibilities - accessing only what your job needs, keeping data off personal devices, checking recipients and reporting problems straight away
- Requests from individuals - the rights people have over their data, and passing any request to the person responsible on the day it arrives
- Suppliers and impact assessments - a processing agreement before a supplier handles personal data, further checks outside the UK, and impact assessments for high-risk processing
- Using AI tools with personal data - treating what goes into and comes out of an AI tool as personal data, with a person reviewing significant decisions
- Retention and breaches - secure deletion when data is no longer needed, including backups, and reporting a suspected breach to your manager immediately
Who Is It For?
Everyone who handles personal data in their work, from HR and payroll records to customer details, emails and meeting notes. Managers need it too, as they receive notice of new uses and reports of suspected breaches.
Included in the GDPR / Data Protection Toolkit
This guidance document is part of the GDPR / Data Protection Toolkit - the registers, forms, policies, procedure and guidance for documenting how you collect and process personal data, in one download.
Using the Guidance
Issue it at induction to anyone who handles personal data, and keep it as a reference alongside the data protection policy procedure. Record who has received it, for example on the training matrix.
Personal Data in AI Tools
The guidance treats AI as an ordinary use of personal data. Entering personal data into an AI tool needs a lawful basis and an entry on the personal data register, and the tool provider usually handles the data on the company's behalf, so the supplier checks apply. What the tool produces about a person, such as a meeting summary or call transcript, is personal data too.
Adapting the Guidance
Edit the guidance to match your own arrangements - who is responsible for data protection, the forms used for requests and breaches, and the names of your own data protection policy, register and supporting guidance.
Related Documents
Other documents that work alongside this guidance:
Would you rather we prepared it for you?
Our Personal Data Register and Privacy Notice Preparation service works through the personal data your organisation holds with you, including the AI tools in use, and prepares the register and privacy notice so they describe what actually happens to that data.
Personal Data Register and Privacy Notice Preparation