Does Every Business Need a Data Protection Policy?

Almost every business that holds personal data should have a data protection policy. The law does not say "every business must have one" in those words, but the UK GDPR's accountability principle makes a written policy the normal way to show you comply.

A data protection policy is an internal document. It tells your staff how personal data is collected, used, protected and deleted, and who is responsible for each part.

We write data protection policies for UK organisations from £65 per document. This page explains when the law expects one, what it should contain and what has changed under the Data (Use and Access) Act 2025.

Data Protection Policy at a Glance

Question	Short answer
Is it a legal requirement?	Expected under UK GDPR Article 24(2) where proportionate to your processing
Who reads it?	Your staff; it is internal
Is it the same as a privacy notice?	No. A privacy notice is written for the people whose data you hold
What changed in 2026?	A data protection complaints duty from 19 June 2026, plus DUAA changes to access requests and lawful bases
How often to review?	At least annually, and when the law or your processing changes

What the Law Says

Article 24 of the UK GDPR requires controllers to put appropriate technical and organisational measures in place, and to be able to demonstrate that processing complies. Article 24(2) adds that, "where proportionate in relation to processing activities", those measures "shall include the implementation of appropriate data protection policies".

The accountability principle in Article 5(2) does the rest. You must be able to show compliance, and in practice a regulator, client or auditor will ask for your policy first.

The word "proportionate" matters. A sole trader with a customer list needs a short policy; a business processing health data or monitoring staff needs a fuller one.

Data Protection Policy or Privacy Notice?

The two are often confused. A privacy notice is an external document telling customers, staff or applicants what you do with their data and what their rights are, as Articles 13 and 14 require.

A data protection policy is internal. It sets the rules your staff follow so that what the privacy notice promises actually happens.

You need both, and they need to agree. Our guide to privacy notice updates for the DUAA covers the external side.

What the Policy Should Cover

Scope and Responsibilities

Say which data, systems and people the policy covers, and name who is accountable. That may be a data protection officer if you must appoint one, or a named manager if you do not.

You must appoint a DPO if you are a public authority, or if your core activities involve large-scale regular monitoring of individuals or large-scale processing of special category or criminal offence data.

The Principles and Lawful Bases

Set out the UK GDPR principles in plain terms: lawful, fair and transparent use; specific purposes; no more data than needed; accuracy; limited retention; security; and accountability.

Explain how staff identify the lawful basis for a new use of data, and when to ask before starting something new. The DUAA added a list of recognised legitimate interests that can be relied on without the usual balancing test, so the policy should say who decides when one applies.

Special Category Data

Health, ethnicity, religion, sexual orientation, trade union membership, biometric and genetic data need an extra condition under Article 9, and often an appropriate policy document under the Data Protection Act 2018. HR teams handle this kind of data every day, in sickness and occupational health records especially.

Individuals' Rights

The policy should explain how staff recognise and pass on requests: access, rectification, erasure, restriction, objection and portability. A subject access request does not need to use those words, and the clock usually runs for one month.

The DUAA confirms that searches only need to be reasonable and proportionate, and clarifies when you can pause the clock to clarify a request. Our subject access request policies page covers the procedure.

Security and Confidentiality

Cover access controls, passwords, encryption, clear desk, secure disposal and home working. Most organisations keep the technical detail in an information security policy and cross-refer to it.

Personal Data Breaches

Staff need to know what a breach is and to report it at once. You must report a notifiable breach to the ICO within 72 hours of becoming aware of it, and tell affected people without undue delay where there is a high risk to them.

Retention and Deletion

Link the policy to a retention schedule that says how long each type of record is kept and how it is deleted. Keeping data "just in case" breaches the storage limitation principle and makes every access request harder.

Suppliers and Transfers

Processors such as payroll providers, IT support and cloud services need written contracts that meet Article 28. Transfers outside the UK need a lawful transfer mechanism, and the policy should say who approves them.

Data Protection Impact Assessments

Explain when a DPIA is needed, for example before new monitoring, profiling or large-scale use of sensitive data. Our DPIA writing service covers the assessment itself.

Training

Set out induction and refresher training, and keep records. A policy nobody has been trained on gives little protection when a breach is investigated.

The DUAA Changes to Build In

The Data (Use and Access) Act 2025 updates UK data protection law rather than replacing it. The change with a fixed date is the new complaints duty under section 103, in force since 19 June 2026.

Every controller must now make it easy to complain about its handling of personal data, acknowledge a complaint within 30 days, and respond without undue delay. The ICO's guidance on handling data protection complaints sets out what it expects, and our complaints procedure guide explains the duty.

The Act also changes the rules on solely automated decisions with a significant effect on people, and on cookies. If you use automated tools in recruitment or run analytics on your website, the policy should say how those are controlled.

Does a Small Business Really Need One?

Yes, in most cases, though it can be short. Even a business with five staff holds employee records, customer details and supplier contacts, and the accountability principle applies whatever your size.

Small businesses benefit from some easements. Organisations with fewer than 250 employees only need full records of processing activities in some circumstances, and the complaints duty can be met with a simple form and log.

What a small business cannot do is have nothing. When a customer complains or a laptop is stolen, the first question from the ICO will be what your policy said and whether staff followed it.

Writing a Policy Staff Will Follow

A data protection policy fails when it reads like a copy of the regulation. Staff need to know what to do in the situations they actually meet: an email to the wrong person, a request from a former employee, a supplier asking for a customer list.

Short sections, plain language and worked examples help. So does a single named contact for questions, and a one-page summary for induction.

Keep the policy consistent with your other documents. The retention periods, breach steps and security rules it describes should match the retention schedule, the incident procedure and the IT policies, or an investigator will find the gaps for you.

Reviewing the Policy

Review the policy at least once a year. Also review it when you bring in a new system, start a new kind of processing such as staff monitoring or AI tools, or when the law changes, as it did with the DUAA.

Record each review, even if nothing changes. A dated review history is good evidence of accountability.

What Happens Without One

The ICO can issue reprimands, enforcement notices and fines of up to £17.5 million or 4% of worldwide turnover under the UK GDPR. Most enforcement against small firms is lower level, but the investigation still turns on whether you can show what you did and why.

Clients ask too. Supplier questionnaires and tenders routinely ask for a current data protection policy, and the absence of one can end a bid before it starts.

Common Gaps We Find

• No data protection complaints procedure, despite the 19 June 2026 duty.
• A policy copied from a template that names another organisation's systems.
• No link to a retention schedule, so data is kept indefinitely.
• Breach reporting steps that do not mention the 72-hour deadline.
• No mention of home working, personal devices or AI tools.
• A policy and privacy notice that describe different practices.

Data Protection Policy and Procedure Writers

We write data protection policies sized to your business, with the complaints procedure, breach procedure and retention schedule that sit around them. They are part of our GDPR policies and consultancy service.

If you already have a policy, our policy review service checks it against the DUAA changes and your actual processing. Get a quote for a fixed price.