| File Reference : | P-101 Shared Data Responsibility Model Policy |
| Date File Updated | 30-09-26 |
| File Format | MS Word |
| No. of files | 1 |
| Category | Policies | Tags: shared responsibility model, cloud data, data protection impact assessment, Cyber Essentials |
Included in the alphaZ subscription
Every alphaZ document and toolkit, with updates as they are released. Everything you download is yours to keep.
A shared data responsibility model policy template for data held in the cloud, with a review before use, data protection assessment and a register of who is responsible for what.
This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Policy number and title
- Information-classification
- Version
- Page number / total pages
Further guidance on cloud and data:
Download this policy template with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.
This file is included in the alphaZ subscription.
If you'd like this policy prepared for your organisation along with the rest of your company policies, or help with your information security risk assessment and treatment plan, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Shared Data Responsibility Model Policy Template
A policy template for data collected or stored in external cloud services, stored under a shared responsibility model, with the organisation taking responsibility at all times for the data under its control that is held in the cloud.
The policy has Approved By and Date Approved fields and carries a Public information classification, so it can be shared with workers, clients and other interested parties.
What the Shared Data Responsibility Policy Covers
- Scope - all data collected or stored in external cloud-based services
- Shared responsibility - responsibility for data under the organisation's control held in the cloud
- Review before use - data security and risks reviewed before cloud services are used for company data
- Personal data - data protection risks assessed before use, with a data protection impact assessment where the risk is likely to be high
- Legal requirements - use complying with the law on personal, financial and other data
- Responsibility register - for each cloud service, who is responsible for user access, data, applications, operating systems and virtual networks, and the physical network, servers and storage
- Compliance - shared by management and workers, with breaches treated as potential misconduct
Checked Against Cyber Essentials
The IT policies in the range have been checked against the Cyber Essentials requirements, so their rules on passwords, devices, access and updates do not contradict what a Cyber Essentials assessment asks for.
Written to Be Shared
Like every alphaZ policy, this is written as a public policy statement that can be shared openly with workers, customers, suppliers and assessors. The internal detail of how it is carried out belongs in your procedures.
Using the Policy
Add your company name and logo, check each commitment matches what your organisation does and edit any that do not, then approve and date the policy and share it with workers and anyone else who needs to see it.
Who Needs a Shared Data Responsibility Policy?
Organisations that hold company or personal data in cloud services and want to be clear about which responsibilities sit with them and which with the provider.
Works with the Cloud Computing Register
The responsibility register can be kept on the F-IMS39 Cloud Computing Register, personal data risks assessed on the F-Q97 Data Protection Impact Assessment, and cloud risks covered by the RA-BR7 Cloud Computing risk assessment.
Document Control
The footer carries the policy number and title, information classification, version and page numbers, and the approval fields record who approved the policy and when, so it can be controlled with the rest of your management system documents and listed on a document register such as the F-IMS20 Document Register.
Related Policies
- P-100 Cloud Computing Policy - cloud computing
- P-102 Data Ownership Policy - data ownership
- P-25 Data Protection Policy - data protection
Would you rather we prepared it for you?
Our Company Forms, Policies and HR Reset service prepares your policy set, staff handbook and HR forms as one branded set, tailored to how you actually run things.
