Preloaded UK policy

Data Protection & GDPR Policy template

UK GDPR compliant policy covering data subject rights, breach notification and the seven principles.

Legal basis
  • UK GDPR
  • Data Protection Act 2018
  • Data (Use and Access) Act 2025
Last reviewed April 2025. Guidance, not legal advice.

What the policy covers

  1. 1. POLICY STATEMENT
    your company is committed to processing personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Ac
  2. 2. THE SEVEN DATA PROTECTION PRINCIPLES
    All personal data we process must comply with the following principles (UK GDPR, Article 5):
  3. 4. SPECIAL CATEGORY DATA
    Special category data (including health/medical information, ethnic origin, biometric data, trade union membership) requires an additional lawful basis under UK GDPR Article 9 and
  4. 5. DATA SUBJECT RIGHTS
    All individuals whose data we process have the following rights, which we will facilitate without undue delay and within one calendar month of receiving a request:
  5. 7. SECURITY AND DATA BREACHES
    We maintain appropriate technical and organisational measures to protect personal data against unauthorised access, loss or destruction.
  6. 8. EMPLOYEE MONITORING
    Where we monitor employees (for example, through CCTV, GPS tracking or IT systems monitoring), we will:
  7. 9. INTERNATIONAL TRANSFERS
    Following the renewal of the UK-EU adequacy decision on 19 December 2025, transfers of personal data to the European Economic Area (EEA) remain lawful without additional safeguards
  8. 10. REVIEW
    This policy will be reviewed annually and following any significant change in data protection legislation or ICO guidance.

Who needs it

Any UK employer whose people can get hurt, handle personal data or spend company money. Inspectors, insurers and principal contractors ask to see these first.

Questions people ask

Is a data protection & gdpr policy a legal requirement?

It rests on UK GDPR and Data Protection Act 2018 and Data (Use and Access) Act 2025. Some policies must be written down once a business reaches a certain size or does certain work; others are simply how a tribunal, an inspector or a client's auditor expects to see that you have thought about it. A clear, dated, signed policy is the evidence either way. Guidance, not legal advice.

Can I change it to suit how we work?

Yes. Inside Work-Lynx it is a starting point: put your company name in, adjust the arrangements to what you actually do, set the review date and publish it. Staff read and acknowledge it on their phones, and you can see who has not.

Is it up to date?

Last reviewed April 2025. The pack is updated when the law moves, and every policy carries a review date so it does not quietly go stale.

How do I get it?

Two ways. It is preloaded in Work-Lynx with the other 48 UK policies (from £2.50 a month plus £1 per employee, 14 days free, no card), and a Word version is a free download on our free templates page.

Who is it for?

Any UK employer whose people can get hurt, handle personal data or spend company money. Inspectors, insurers and principal contractors ask to see these first.

All 49 UK policies, £2.50 a month

This policy and 48 others are already in Work-Lynx, alongside GPS clock-in, rotas, timesheets, leave and Employ AI for UK employment law. £2.50 base plus £1 per employee a month. 14 days free, no card, no sales call.

Start free trial