Data Protection Policies
This workshop creates the written rules: an overall data protection policy and the procedures supporting it, with formal approval, version control and employee acknowledgement.
Workshop 5 video
Walkthrough of the workshop and its tasks — coming soon
Workshop tasks
-
1. Inventory & gap analysis
Review existing documents and identify what is missing: overall policy, retention, data subject requests, incidents, impact assessments and acceptable use.
In ResGuard: Policy Framework -
2. Data protection policy
Draft the overall policy: purpose, scope, applicable laws, principles, roles from Workshop 2, references to procedures and consequences of non-compliance.
In ResGuard: Policy Framework -
3. Supporting procedures
Draft the missing procedures. Several are completed in later workshops: retention (6), requests (7), impact assessments (8) and incidents (11).
In ResGuard: Policy Framework -
4. Approval & version control
Have the DPO review each document, obtain management approval and assign an owner, version and next review date.
In ResGuard: Policy Framework -
5. Distribute & track acknowledgement
Publish the documents to the relevant employee groups, switch on acknowledgement and follow up with those who have not yet confirmed.
In ResGuard: Policy Framework -
6. Workshop review & close-out
Review the results, attach evidence and close the objective in ResGuard.
In ResGuard: Objective Manager
What to keep in mind in Peru
- The ANPDP issued an Information Security Directive for personal databases; use it as the reference for the security rules in your policies.
- Prepare the policies in Spanish and adapt the examples to local processes.
Expected result
- Policy gap analysis completed
- Data protection policy and procedures approved
- Version control and review cycle in place
- Employee acknowledgement tracked
ResGuard modules: Policy Framework