Data Protection Policies
This workshop creates the written rules: an overall data protection policy and the procedures supporting it, with formal approval, version control and employee acknowledgement.
Workshop 5 video
Quick intro with a screen recording of the tasks — coming soon
What ResGuard provides
- Templates for every required policy and procedure (see the list below)
- Approval workflow with versions, owners and review dates, and approval notifications
- Employee portal for reading and acknowledging policies
- Automatic weekly reminders to employees who have not yet acknowledged a policy
Workshop tasks
-
1. Inventory & gap analysis
Review existing documents and identify what is missing: overall policy, retention, access and correction requests, data breaches, impact assessments and acceptable use. ResGuard provides templates for all required policies and procedures in the Policy Framework.
In ResGuard: Policy Framework -
2. Data protection policy
Draft the overall policy: purpose, scope, applicable laws, the PDPA obligations, roles from Workshop 2, references to procedures and consequences of non-compliance. Start from the ResGuard data protection policy template.
In ResGuard: Policy Framework -
3. Supporting procedures
Draft the missing procedures. Several are completed in later workshops: retention (6), access and correction requests (7), impact assessments (8) and data breaches (11). Each procedure can be drafted from its ResGuard template.
In ResGuard: Policy Framework -
4. Approval & version control
Have the DPO review each document, obtain management approval and assign an owner, version and next review date.
In ResGuard: Policy Framework -
5. Distribute & track acknowledgement
Publish the documents to the relevant employee groups, switch on acknowledgement and follow up with those who have not yet confirmed.
In ResGuard: Policy Framework -
6. Workshop review & close-out
Review the results, attach evidence and close the objective in ResGuard.
In ResGuard: Objective Manager
Templates included in ResGuard
ResGuard includes ready-made templates for every policy and procedure the programme requires. Start from the template in the Policy Framework, adapt it to your organisation and approve it:
- Data protection policy
- Acceptable use, clean desk and remote working policy
- Retention and deletion procedure with retention schedule
- Procedure for access and correction requests
- Data protection impact assessment (DPIA) procedure
- Privacy by design and by default procedure
- Technical and organisational measures (TOM) document
- Data processing agreement for vendors
- Data breach response procedure with notification templates
- Privacy notices (generated from your RoPA)
- Data protection scope document with roles (RACI)
- Management review and annual data protection report
What to keep in mind under the PDPA
- The Accountability Obligation requires policies and practices that meet the PDPA, communicated to staff, and information about them made available on request.
- A process for receiving and responding to complaints is part of these practices; describe it in the policy.
Expected result
- Policy gap analysis completed
- Data protection policy and procedures approved
- Version control and review cycle in place
- Employee acknowledgement tracked
ResGuard modules: Policy Framework