If your company processes personal data about customers, employees or business partners, you must implement a GDPR-compliant data protection policy. This guide explains what a data protection policy is, what it should contain, who signs it and how to store it. It offers practical advice, from the document’s contents to how to adopt it in a Polish limited liability company (sp. z o.o.).
What is a personal data protection policy?
A personal data protection policy is a document that sets out the rules for processing and protecting personal data in your organization. It is required by the GDPR (the General Data Protection Regulation) and national regulations.
What is a data protection policy for?
- Protecting data: it describes the technical and organizational measures used to protect personal data against breaches.
- Legal compliance: it supports compliance with the GDPR and the Personal Data Protection Act.
- Defining processing rules: it specifies what data is collected, for what purpose and on what legal basis.
- Building trust: it informs data subjects, including employees, customers and partners, about how their data is processed and protected.
- Minimizing risk: it helps identify threats and prevent personal data breaches.
- Responsibilities and procedures: it sets out the roles of people responsible for data processing, such as the Personal Data Controller, and what to do in the event of an incident.
What should a personal data protection policy contain?
- Basic definitions and terms: explanations of terms such as personal data, processing and data subject.
- Personal data processing principles: lawfulness, purpose limitation, data minimization, integrity and confidentiality.
- Legal bases for processing: when data may be processed, such as consent, a contract or a legal obligation.
- Categories of data processed: what data is collected, such as a first name, surname or email address.
- Purposes of data processing: why data is processed, such as marketing, performing contracts or recruitment.
- Data subjects’ rights: the right of access, rectification and erasure, the right to restrict processing and the right to object.
- Data protection measures: technical procedures, such as encryption and IT safeguards, and organizational measures, such as password policies and employee training.
- Rules for working with processors: instructions for working with other entities, such as service providers.
- Breach response procedure: a plan for responding to personal data breaches.
What should you do with the data protection policy after drafting it?
- Create and implement it: prepare the policy and tailor it to your business.
- Communicate it to employees and associates: everyone with access to data should know and follow its rules.
- Update it: review the policy regularly and adapt it to legal and organizational changes.
- Train and educate staff: organize employee training so they follow the policy.
- Monitor and audit: check compliance with the policy, for example, through audits.
- Make it available to interested people: depending on the circumstances, the policy may be shared with customers or inspection bodies.
How do AI and the AI Act affect a personal data protection policy?
If your company uses AI systems to process personal data, the data protection policy must address the obligations arising from the AI Act, the regulation on artificial intelligence. Here are the areas you must address:
Transparency of AI data processing
Under the AI Act, entities using AI systems must ensure transparency about how they operate, including informing data subjects that AI is being used. The policy should identify:
- the types of AI systems used,
- the purposes for which they are used,
- their impact on natural persons.
AI-related risk assessment
The AI Act requires risk assessment, particularly for high-risk systems. The policy should include:
- procedures for identifying and minimizing privacy threats,
- the people responsible for overseeing AI systems.
Data minimization and purpose limitation
AI use must follow GDPR principles of data minimization and purpose limitation. Specify in the policy:
- what personal data AI processes,
- for what purpose,
- for how long.
Responsibility and oversight of AI systems
The AI Act requires responsibility for AI system operation to be assigned. Identify in the policy:
- the people or units responsible for AI oversight,
- how compliance with regulations is monitored.
Rights regarding automated processing
Individuals have the right to information about how AI makes decisions and, in some cases, the right to object to automated data processing. The policy should clearly state these rights and how to exercise them.
Including these elements helps meet legal requirements and shows customers and partners that your company uses AI responsibly. See also responsible AI use.
Summary: implementation, signatures and storage
A personal data protection policy is the foundation of your organization’s data management system. Implementing it supports regulatory compliance and reduces the risk of personal data breaches.
Who signs the policy?
- The data controller signs the document when it is implemented.
- In a Polish limited liability company (sp. z o.o.), the people authorized to represent the company sign it.
- If the management board president has authority to represent the company individually, that person signs the policy on the company’s behalf and specifies its effective date.
How to implement it
- Management board resolution: the most commonly used form.
- Management order: an alternative, depending on how decisions are made in the company.
Storing the document
- Paper copy: keep it in a locked cabinet with the other personal data documentation.
- Electronic copy: store a scan of the signed document in the cloud, such as OneDrive, where authorized staff can access it.
Q&A: company personal data protection policy
Why is a personal data protection policy important for a company?
It supports compliance with the GDPR and national regulations, protects personal data against breaches, and builds trust among customers, employees and business partners.
What are the main purposes of a personal data protection policy?
The policy is intended to protect data, define processing rules, minimize breach risks and set out the responsibilities of people who process data.
What should a personal data protection policy contain?
It should contain definitions, data-processing principles, legal bases, categories of data collected, processing purposes, data subjects’ rights and procedures for personal data breaches.
Who should sign a personal data protection policy in a sp. z o.o.?
The people authorized to represent the company sign it. If the management board president may represent it individually, that person signs and specifies the policy’s effective date.
What are common ways to implement a company policy?
The policy may be implemented by management board resolution (the most common form) or by management order, depending on the company’s decision-making process.
How should a personal data protection policy be stored?
Keep a paper copy in a secure place with the rest of the personal data documentation. Store a scan of the signed document in the cloud, such as OneDrive, so authorized employees can access it.
How should a personal data protection policy be kept up to date?
Review and update it regularly whenever legal or organizational changes occur. Train employees so they know the data-protection rules and follow them in their daily work.
What should you do after a personal data breach?
The policy should include a breach response plan. Identify the incident as soon as possible, take corrective action and, if required, report the breach to the supervisory authority (PUODO).
Should the data protection policy be shared with people outside the company?
Depending on the nature of the company’s business and legal requirements, the policy may be shared with customers or inspection bodies to make data-processing activities transparent.
What can happen if a company has no personal data protection policy?
The supervisory authority may impose financial penalties, and the company may lose the trust of customers and partners. If a breach occurs, the company may also face civil liability for harm to data subjects.
