Personal data protection

Template to adapt

This is a public template, not your organisation’s effective internal policy. Before use, complete the organisation, owner, approver, scope, effective date and review date. Adapt controls to actual risks and obligations.

Organisation: [complete] · Owner: [complete] · Approved by: [complete]

Effective from: [complete after approval] · Review: [complete]

Purpose, roles and data

For each process, describe personal data, purpose, legal basis, categories of individuals, recipients and retention. For special categories, also establish an Article 9 GDPR condition. Consent is not a universal legal basis; choose the basis matching the actual processing.

Distinguish controllers, processors and any joint controllers. The DPO advises and monitors; the controller remains accountable for processing decisions.

Individual rights

Define an intake contact, request owner and proportionate identity verification. Respond without undue delay and within one month, not automatically 30 days. Under Article 12(3), an extension of up to two further months may apply; inform the person of the extension and reasons within the first month.

Assess scope and exceptions for each right. Articles 13 and 14 information duties have their own rules. Article 22 does not concern every AI output, but specified solely automated decisions producing legal or similarly significant effects.

Controls before processing

• Minimise data, permissions and copies.
• Set retention by purpose and applicable obligations.
• Assess transmission and storage security and test recovery.
• Govern processing by a supplier acting as a processor through a contract or another legal act under Article 28, and check its sufficient guarantees.
• Review third-country transfers and the relevant legal mechanism.
• Carry out a DPIA before processing likely to result in high risk.

Pseudonymised data may remain personal data. Encryption and European storage alone do not establish compliance with all GDPR requirements.

Personal data breaches

Assess confidentiality, integrity and availability breaches. The controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless risk to individuals’ rights and freedoms is unlikely. A processor informs the controller without undue delay. Where high risk is likely, inform affected individuals without undue delay under Article 34, considering its exceptions.

Encryption informs the assessment; it is not an automatic reason to withhold notification. Document all personal data breaches, the related facts, their effects and the remedial action taken; record the risk assessment and reasons for the decision, including a decision not to notify.

Further guidance: GDPR, individual rights and logging/retention.

---

Template reviewed on 6 September 2026. Detailed legal sources are in the linked guides. L1 — Align helps prepare evidence and responsibilities; adaptation and implementation scope is agreed in the proposal.