Skip to main content
Forms Legal

Data Protection Policy (UK)

Data Protection Policy (UK)

DATA PROTECTION POLICY

[Organisation Name]

Effective date: [Effective Date]

Next review: [Review Date]

Data protection contact: [DPO Name] | [DPO Email]

1. INTRODUCTION

[Organisation Name] ("we", "us", "the Organisation") is [Organisation Type] registered at [Registered Address]. We are committed to protecting the personal data of all individuals whose data we process, in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

This policy sets out our obligations and the standards that all staff, contractors, and other persons acting on our behalf must follow when handling personal data. It applies to all processing activities carried out by the Organisation, whether on paper, electronically, or by any other means.

2. DATA PROTECTION PRINCIPLES

All personal data processed by the Organisation must be handled in accordance with the six data protection principles set out in Article 5 of the UK GDPR:

  • Lawfulness, fairness, and transparency — processed on a lawful basis and in a transparent manner.
  • Purpose limitation — collected for specified, explicit, and legitimate purposes and not further processed in an incompatible manner.
  • Data minimisation — adequate, relevant, and limited to what is necessary for the purposes of processing.
  • Accuracy — accurate and, where necessary, kept up to date.
  • Storage limitation — kept in a form which permits identification of data subjects for no longer than necessary.
  • Integrity and confidentiality — processed with appropriate technical and organisational security measures.

We are also required to demonstrate compliance with these principles (the 'accountability' principle, Article 5(2) UK GDPR).

3. LAWFUL BASES FOR PROCESSING

We will only process personal data where we have a lawful basis for doing so under Article 6 of the UK GDPR. The lawful bases we rely on include:

  • Consent — where the data subject has given clear, freely given, specific, informed consent.
  • Contract — where processing is necessary to perform a contract with the data subject or to take pre-contractual steps.
  • Legal obligation — where processing is necessary to comply with a legal obligation.
  • Legitimate interests — where processing is necessary for our legitimate interests (or those of a third party) and those interests are not overridden by the data subject's rights.

For special category data (health, biometric, religious, racial, or other sensitive data), we will rely on an additional condition under Article 9 UK GDPR, such as explicit consent or a legal obligation.

4. PERSONAL DATA WE PROCESS

The Organisation processes the following categories of personal data: [Data Categories]

The categories of data subjects whose data we process include: [Data Subjects]

5. INDIVIDUAL RIGHTS

Under the UK GDPR, data subjects have the following rights, which we will respect and facilitate:

  • Right of access — to obtain a copy of their personal data (subject access request, SAR).
  • Right to rectification — to have inaccurate data corrected.
  • Right to erasure ('right to be forgotten') — to have data deleted in certain circumstances.
  • Right to restriction of processing — to restrict how their data is used in certain circumstances.
  • Right to data portability — to receive their data in a structured, commonly used format.
  • Right to object — to object to processing based on legitimate interests or for direct marketing.
  • Rights in relation to automated decision-making and profiling.

Data subjects wishing to exercise any of these rights should contact [DPO Name] at [DPO Email]. We will respond to requests within one month (with possible extensions in complex cases) and at no charge in most cases.

6. DATA SECURITY

The Organisation has implemented the following technical and organisational security measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage:

[Security Measures]

All staff who handle personal data are required to complete data protection training and to follow this policy. Breaches of this policy may result in disciplinary action.

7. DATA BREACHES

A personal data breach is any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. All staff must report any suspected or actual data breach to [DPO Name] immediately.

Where a breach is likely to result in a risk to individuals' rights and freedoms, we will report it to the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it (Article 33 UK GDPR). Where the breach is likely to result in a high risk to individuals, we will also notify affected individuals without undue delay.

8. DATA RETENTION

Personal data will not be retained for longer than is necessary for the purposes for which it was collected, taking into account any legal obligations to retain records. We maintain a data retention schedule which sets out the retention periods for each category of data we process. Data that is no longer needed will be securely deleted or anonymised.

9. RESPONSIBILITY AND REVIEW

The person responsible for data protection compliance within the Organisation is [DPO Name], who may be contacted at [DPO Email]. This policy will be reviewed at least annually and updated as necessary to reflect changes in the law, the ICO's guidance, or the Organisation's processing activities.

This policy was adopted on [Effective Date] and is next due for review on [Review Date].

Approved by: ____________________________

Name: ____________________________

Title: ____________________________

Date: ____________________________

Authorised Signatory

________________

Signature

Date: ________________

Maintained by Vladislav Sergienko, Founder·Template last modified: ·Report an error

What Is a Data Protection Policy (UK)?

A Data Protection Policy in the United Kingdom sets out the standards, responsibilities, and procedures the organisation expects everyone to follow, and takes its legal force from the Companies Act 2006.

The legal framework governing the Data Protection Policy (UK) in United Kingdom draws on several key statutes and regulatory bodies. Under the Companies Act 2006, Companies House maintains the register of UK companies. Section 386 of the Companies Act 2006 sets accounting record obligations. The Competition and Markets Authority (CMA) enforces the Consumer Rights Act 2015. The Financial Conduct Authority (FCA) regulates financial services under the Financial Services and Markets Act 2000. The High Court of Justice has jurisdiction under the Senior Courts Act 1981. Parties executing a Data Protection Policy (UK) in United Kingdom should confirm the document reflects current law, including any amendments enacted since the original drafting date. The UK General Data Protection Regulation (UK GDPR) sets the foundational requirements.

When Do You Need a Data Protection Policy (UK)?

Any UK organisation that collects or processes personal data about individuals — employees, customers, suppliers, or website visitors — needs a data protection policy. Common triggers include: setting up a new business that will hold customer or employee data; onboarding staff who will have access to personal information; launching a website with contact forms, cookies, or analytics; entering contracts with clients or partners who require evidence of data protection compliance; responding to an ICO audit or complaint; and implementing ISO 27001 or Cyber Essentials certification. A data protection policy is also essential when your organisation processes special category data — data that is particularly sensitive, such as health information, racial or ethnic origin, religious beliefs, biometric data, or criminal convictions under Articles 9 and 10 UK GDPR. Processing special category data requires specific legal bases and additional safeguards, which should be addressed in the policy. Contractually, many commercial contracts — especially with larger organisations and public sector bodies — now include data protection warranties and require suppliers to demonstrate that they have appropriate policies and procedures in place. Having a well-drafted policy reduces risk and supports business development.

Parties in United Kingdom should prepare a Data Protection Policy (UK) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under the Companies Act 2006, Companies House maintains the register of UK companies. Section 386 of the Companies Act 2006 sets accounting record obligations. The Competition and Markets Authority (CMA) enforces the Consumer Rights Act 2015. The Financial Conduct Authority (FCA) regulates financial services under the Financial Services and Markets Act 2000. The High Court of Justice has jurisdiction under the Senior Courts Act 1981. Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

What to Include in Your Data Protection Policy (UK)

A UK GDPR-compliant data protection policy should cover the following key areas. First, an introduction setting out the scope of the policy, the organisation's commitment to data protection, and the name and contact details of the Data Protection Officer (if one has been appointed) or the person responsible for data protection compliance. Second, a statement of the data protection principles under Article 5 UK GDPR and how the organisation applies them in practice. Third, the lawful bases for processing personal data under Article 6 UK GDPR — consent, contract, legal obligation, vital interests, public task, or legitimate interests — and how the organisation identifies and documents the applicable basis for each type of processing. Fourth, individual rights: the rights of data subjects under the UK GDPR (access, rectification, erasure, restriction, portability, objection, and automated decision-making rights under Articles 15 to 22) and the procedures for handling requests. Fifth, data security — the technical and organisational measures in place under Article 32, including access controls, encryption, pseudonymisation, staff training, and breach response procedures. Sixth, data retention — how long different categories of data are kept and the process for secure disposal. The policy should also set out staff responsibilities, training requirements, international transfer safeguards, and the review and update schedule.

Additional compliance elements for a Data Protection Policy (UK) used in United Kingdom include: Under the Companies Act 2006, Companies House maintains the register of UK companies. Section 386 of the Companies Act 2006 sets accounting record obligations. The Competition and Markets Authority (CMA) enforces the Consumer Rights Act 2015. The Financial Conduct Authority (FCA) regulates financial services under the Financial Services and Markets Act 2000. The High Court of Justice has jurisdiction under the Senior Courts Act 1981. Forms-legal.com provides this template as a starting point for United Kingdom-compliant documentation.

Cite this page

Reference this free template in an article, syllabus, or research note:

APA

Forms Legal. (2026). Data Protection Policy (UK) (United Kingdom) [Legal document template]. Forms Legal. https://forms-legal.com/uk/business/policies/uk-data-protection-policy

MLA

"Data Protection Policy (UK) (United Kingdom)." Forms Legal, 2026, https://forms-legal.com/uk/business/policies/uk-data-protection-policy.

BibTeX
@misc{formslegal-uk-data-protection-policy,
  author       = {{Forms Legal}},
  title        = {Data Protection Policy (UK) (United Kingdom)},
  year         = {2026},
  howpublished = {\url{https://forms-legal.com/uk/business/policies/uk-data-protection-policy}},
  note         = {Free legal document template. Based on UK General Data Protection Regulation (UK GDPR)}
}

Also available for these jurisdictions:

AustraliaAustraliaGhanaGhanaHong KongHong KongIrelandIrelandIndiaIndiaNew ZealandNew ZealandSingaporeSingapore

Frequently Asked Questions

Based on UK General Data Protection Regulation (UK GDPR) — Template last modified June 2026

This template is provided for informational purposes only and does not constitute legal advice. Laws vary by jurisdiction and change over time. Consult a qualified attorney for advice specific to your situation.Full disclaimer

Found an error? Let us know