Data protection is mostly common sense written down: know what you hold about people, have a reason for it, keep it safe and do not keep it longer than needed. This guidance puts that in plain terms.
This guidance document is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Guidance number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested guidance documents. No junk, jargon or unnecessary content. Simple and usable guidance documents
developed over 25 years through practical use in the real world.
Further guidance on data protection:
If you'd like hands-on help putting data protection arrangements in place across your team, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Data Protection Guidance
General guidance for all employees on data protection, so everyone understands what personal data is, how it must be handled, and what to do when someone asks for their data or something goes wrong.
Topics Covered
- What counts as personal data, including special category and criminal offence data
- How personal data must be handled, and having a reason to use it
- Your responsibilities, and requests from individuals
- Sharing personal data with suppliers, and new uses that need an impact assessment
- Using AI tools with personal data - why it is a use of personal data like any other, and why what an AI tool produces about a person is personal data too
- Keeping and deleting personal data, and reporting a personal data breach
- Further advice, with references to the related documents
Who Is It For?
Every member of staff who handles information about people, whether customers, employees, suppliers or members of the public. It works as induction reading, as refresher material, and as the basis for a short team briefing.
Included in the GDPR / Data Protection Toolkit
This guidance document is part of the GDPR / Data Protection Toolkit - the registers, forms, policies, procedure and guidance for documenting how you collect and process personal data, in one download.
Using the Guidance
Issue the guidance to staff at induction and when arrangements change, or talk it through at a team briefing. Record who has received it, so there is evidence that staff have been made aware of their responsibilities.
Why AI Tools Are Covered
Staff often paste notes, emails and call transcripts into AI tools to summarise them or draft a reply. When those mention people, that is a use of personal data, and what comes back is personal data too. The guidance explains what that means, and points to the related guidance for approved tools and classification.
Adapting the Guidance
The guidance is fully editable, so add the name of the person responsible for data protection and the way requests and breaches are reported in your organisation.
Related Documents
Other documents in the GDPR / Data Protection Toolkit that work alongside this one:
Reporting Problems
The guidance tells staff to report a suspected personal data breach straight away, even when they are not sure, because a breach that puts people at risk has to be reported to the regulator within 72 hours.
Would you rather we prepared it for you?
Our Personal Data Register and Privacy Notice Preparation service works through the personal data your organisation holds with you, including the AI tools in use, and prepares the register and privacy notice so they describe what actually happens to that data.
Personal Data Register and Privacy Notice Preparation