NOTIFICATION
TROLLEY
SIGN IN

Beta

Welcome to the first part of the new NCVO website. While we finish building it, you will find the rest of our help and guidance on our existing site.

Last reviewed: 02 March 2021

Use this to help you write your data protection policy and procedures and other related documents. It should not be used as legal advice. We link to more detailed advice from the Information Commissioner’s Office (ICO) throughout.

There are lots of links between this guide and other information on data protection. We recommend you use the pages together. There’s a lot of information, but once you start working through it, it should all become clear.

What your data protection policy should do for you

Your data protection policy is the commitment you’re making to protect data in accordance with the law. Your procedures show how you’re going to achieve your aims and comply with the law.

Some organisations have a specific data protection policy. Others cover data protection in their other policies and procedures.

Use these key principles that apply to all policy writing.

Make sure it’s:

  • appropriate to your organisation's size, culture and activities
  • easy for staff and volunteers to understand and follow
  • workable for your organisation
  • reviewed on a regular basis (at least annually).

Don’t confuse your data protection policy with your privacy policy, notice or statement. The latter is a document you write to share with people whose data you are going to collect, so they know what you’re doing with it. Read our guidance on writing a privacy notice.

It’s often easier to provide your policy and procedures as a set of shorter documents rather than one long one. Or have one document with sections.

Here’s a suggestion to follow. There are links throughout taking you directly to sections in our other data protection pages with more information to help you complete each part of your policy documents.

Your data protection policy needs to cover the following.

  • Your commitment to the legal principles.
  • Your commitment to the people's rights relating to your data.
  • Your intention to ensure that lawful processing is carried out.
  • Your intention to minimise data collection.
  • A commitment to, and a process for, ensuring staff are trained and up to date.
  • A statement about how often you’ll review this document and all the related policies and procedures.
  • A list of all the related policies and procedures.

Your data retention and deletion policy needs to cover:

  • how long you’ll keep data and how you’ll delete it
  • any factors that’ll influence your decisions on this for different projects.

Your policy on how to keep systems secure needs to include:

  • where data can be stored (what countries)
  • where data can be stored (whose computers, how should they be looked after)
  • what people can and can’t do with the data or with computers the data is processed on.

If you have any of these policies already it may cover this.

  • An IT policy
  • An acceptable use of IT policy
  • Bringing your own device policy (working from home)
  • Social media policy
  • Cybersecurity risk planning
  • CCTV policy

Use our five steps to cybersecurity guide for some basic advice.

Your data processing procedure needs to include the actions staff should take when working with data to make sure they’re using it safely and legally.

The best way to create these is to start from your record of the data you keep.

  • If you have a register of data or a privacy impact assessment, use that.
  • If you’re starting from scratch use our information on how to audit the data you hold.

From those records, do the following.

When you write these up you may have one procedure, with sections for different types of data, or different procedure documents for different types of data.

Procedure for when someone wants their data (known as subject access request procedure)

We cover why you need this and the types of information it should cover in our guide to preparing for when someone wants to see their data.

Procedure for when you have a data breach

This is always a stressful situation. Don’t wait until your first crisis to create a procedure. Act now by having simple guidelines to follow using the information in our guide to preparing for a data breach.

Training plan for staff and volunteers

Every organisation needs a training plan that’s right for the type of data people are able to access, and what they’re able to do with it.

You need to make sure they know the following.

  • What personal data is - help them with examples, it isn’t always intuitive.
  • What sensitive data is.
  • How to keep data safe.
  • How to report a data breach or other security issues.
  • That you'll support them to fix problems, not blame them, in the case of accidents.

When you need specialist advice

If you’re working a lot with data that is classed as sensitive or special category don’t rely on this guidance. You’ll have additional formal obligations. These links should help.

NCVO Trusted Supplier Offer

Hope and May offer a range of services to all charities, no matter their size, to help with compliance with data protection law. Their services include representing you as your data protection officer, policy audits and development, assistance with data breaches and SARs and international regulations.

Support services from £195+ VAT per month.

Call the helpline: 0330 111 0013 or email NCVO@Hope-May.com.

Find out more on the Hope and May Trusted Supplier page.

If you’re running projects from multiple countries you'll be working with varied data protection laws. You need to stay up to date with news and changes across the globe.

Writing a privacy statement, policy or notice

You’ll need to have a privacy policy or notice that you can share with anyone whose data you’re holding. You can use it to help them make an informed decision when you ask for consent.

You can use a template to do this. Make sure you read it carefully and complete and delete the parts that need amending.

Use the ICO privacy notice template.

This guidance was created with the help of TrustLaw, HR Services Partnership (HRSP) and Superhighways.

This page was last reviewed for accuracy on 02 March 2021

Back to top

Sign up for emails

Get regular updates on NCVO's help, support and services