NewWalk straight into Work-Lynx. Every tool, working, in your browser. No account, nothing to fill in.Walk in, no account.Try it now →
WorkLynx
Preloaded policy

Data Protection and Privacy Policy template

How the company handles employee and customer personal data under applicable US privacy laws including CCPA/CPRA and state equivalents.

Legal basis
  • No comprehensive federal privacy law as of 2026
  • CCPA/CPRA (CA)
  • VCDPA (VA)
  • CPA (CO)
  • CTDPA (CT)
  • UCPA (UT)
  • TDPSA (TX)
  • and growing state set
Last reviewed April 2026. Guidance, not legal advice.

What the policy covers

  1. PURPOSE
    your company handles personal data of employees, customers, and contacts.
  2. SCOPE
    Applies to all employees, contractors, and third parties handling personal data on behalf of your company.
  3. DATA WE COLLECT
    Employee data: name, contact details, government-issued ID (SSN / EIN where required), bank details for payroll, tax forms (W-4, I-9), employment history, performance records
  4. LAWFUL BASIS / PURPOSES
    We collect and process personal data only for legitimate business purposes: employment administration, payroll, tax reporting, customer service, contract performance, legal complia
  5. EMPLOYEE RIGHTS (where state law applies)
    In jurisdictions with comprehensive privacy laws (CA, VA, CO, CT, UT, TX, OR, MT, IA, DE, NH, NJ, MN, RI, TN, IN), employees and consumers may have rights to:
  6. SECURITY
    We maintain reasonable administrative, physical, and technical safeguards including:
  7. DATA RETENTION
    Personal data is retained only as long as needed for the purpose or as required by law:
  8. DATA BREACH
    In the event of a personal data breach, we will notify affected individuals and applicable state attorneys general per state breach-notification laws (all 50 states have one).
  9. THIRD-PARTY DISCLOSURE
    We do not sell personal employee data.

Who needs it

Any employer whose people can get hurt, handle personal data or spend company money. Inspectors, insurers and regulators ask to see these first.

Questions people ask

Is a data protection and privacy policy a legal requirement?

It rests on No comprehensive federal privacy law as of 2026 and CCPA/CPRA (CA) and VCDPA (VA) and CPA (CO) and CTDPA (CT) and UCPA (UT) and TDPSA (TX) and and growing state set. Some policies must be written down once a business reaches a certain size or does certain work; others are simply how a tribunal, an inspector or an auditor expects to see that you have thought about it. A clear, dated, signed policy is the evidence either way. Guidance, not legal advice.

Can I change it to suit how we work?

Yes. Inside Work-Lynx it is a starting point: put your company name in, adjust the arrangements to what you actually do, set the review date and publish it. Staff read and acknowledge it on their phones, and you can see who has not.

Is it up to date?

Last reviewed April 2026. The pack is updated when the law moves, and every policy carries a review date so it does not quietly go stale.

How do I get it?

It is preloaded in Work-Lynx with the other 28 policies for the US. Work-Lynx is $3 plus $1.25 per employee, 14 days free, no card, and what you see on the pricing page is the bill.

Who is it for?

Any employer whose people can get hurt, handle personal data or spend company money. Inspectors, insurers and regulators ask to see these first.

All 29 US policies, $3 a month

This policy and 28 others are already in Work-Lynx, alongside GPS clock-in, schedules, timesheets, PTO and an employment-question advisor. $3 base plus $1.25 per employee a month. 14 days free, no card, no sales call.

Start free trial