Internal data protection policies (DDP) should set out the principles and legal conditions that organisations must satisfy when obtaining, handling, processing, transporting or storing personal data in the course of their operations and activities, including customer, supplier and employee data. This should provide a clear guide for employees so they know how to handle and process data in compliance with the law.
The six key privacy principles to be set out in the DPP are as follows: (1) Lawfulness, fairness and transparency - personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject; (2) Purpose limitation – there must be a specified, explicit and legitimate purpose for which personal data is collected; (3) Data minimisation – only essential personal data which is relevant to the purpose for which the information is processed can be collected and stored; (4) Accuracy - personal data must be accurate and kept up to date. Any incorrect data must be updated or deleted without delay; (5) Storage limitation - personal data which allows an individual to be identified must only be kept for as long as is necessary for the purposes for which the data is processed; and (6) Integrity and confidentiality – measures should be put in place to protect any data held to ensure that it is kept confidential and is not at risk of being seen or used by anyone who is not authorised to process the data.
There is also an accountability principle which should also be covered. This will deal with what data the controller is responsible for and demonstrate how it is in compliance with the data protection principles (e.g. that there is an appointed data protection officer, regular training is to be carried out by employees etc.).
The grounds for processing data should also be covered in the DPP. There are six grounds for which data can be lawfully processed (1) consent from the data subject, (2) that it is necessary in connection with a contract; (3) it is necessary to comply with legal obligation to which the controller is subject, (4) to protect the vital interests of the data subject or another person, (5) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or (6) the processing is necessary for the purposes of the legitimate interests pursued by the controller. The policy should set out what is required to satisfy the relevant grounds which the company is seeking to rely on and ensure this process is followed in order to reduce the risk of there being any data protection breaches.
There will be certain things which you will be able to deal with internally such as compliance on a day to day basis with your data protection policies. However, this is an area of law for which it would always be best practice to get an opinion or to take advice on any matters which you are unsure or concerned about. Please note, that the Information Commissioners Office (ICO- ico.org.uk) has a very useful information service and although they do provide a “policing” function as the UK data protection authority they are very concerned about prevention. Consequently, they are very approachable.
When it comes to matters such as subject access requests (SAR) you need to seek legal advice as soon as possible. There is a strict time limit of one month of receipt in which the request must be dealt with and there are penalties for non-compliance within this time period. However, even more importantly, you could be investigated by the ICO. Most businesses run into problems with respect to SARs because they simply ignore them.
If you are not a public authority or body, do you monitor individuals on a large scale (eg tracking an individual’s behaviour on the internet or on CCTV), do you not process as your core activities “special categories” of personal data (eg racial or ethnic origin) or criminal convictions or offences data then you don’t need to appoint a DPO. You can do that voluntarily but you must register the individual with the Information Commissioner’s Office (ICO) and the DPO does have to take on a high level of responsibility. Having said that, you should have somebody in the organisation that is responsible for data protection.
Do access the ICO’s website(ico.org.uk) for a variety of very helpful information including guidance for DPOs.
- Lawfulness, fairness and transparency
- Purpose limitation
- Data minimisation
- Accuracy
- Storage limitation
- Integrity and confidentiality (security)
- Accountability










