Which policies does GDPR require?

The EDPB's small business guide recommends a binding internal policy that sets out data protection and security rules for everyone who handles personal data. A reviewer looks for a document that names its owner, states its scope (systems, staff, contractors and processors), sets out the rules in plain terms, and says who enforces them when they are broken. A policy that restates the regulation without operational rules will not show that the organization has decided how it works.

• Scope and ownership: the systems, data categories and people covered, plus the named role accountable for the policy.
• Operating rules: how personal data is collected, stored, shared, backed up and deleted, written as instructions staff can follow.
• Escalation: how staff report incidents and suspected breaches, and who decides on notification.
• Approval and version control: the approver, approval date, version number and next review date.
• Distribution: proof that the current version reached every person in scope.

To check this tab, confirm the policy is approved by management, dated, versioned and linked from the places staff actually work, and that its rules match how systems are configured.

The EDPB guide recommends an information classification policy so that staff know which data needs which protection. Classification is what turns general security rules into specific handling requirements: personal data, special category data and data that is merely confidential should not all be stored, shared or deleted the same way. Without it, access and retention decisions have no stated basis.

• Classification levels: a short set of labels with a definition and example for each, including a level for special category data under Article 9.
• Handling rules per level: storage locations, encryption expectations, sharing rules and permitted transfer routes for each label.
• Labelling method: how labels are applied in documents, databases, tickets and repositories, and who is responsible for applying them.
• Link to the record of processing: each processing activity mapped to a classification level so the two documents agree.
• Review: the trigger for reclassifying data and the date the scheme was last reviewed.

To check this tab, pick a sample of systems and confirm the labels in the policy match how the data is tagged, stored and access-restricted in practice.

The EDPB guide asks for access on a need-to-know basis, with differentiated authorisation profiles and a regular review of access rights, backed by a documented access control policy that covers joiners, leavers and role changes. The policy should describe how access is granted, how it is limited to what each role needs, and how it is removed. An illustrative pattern from the guide is reviewing access rights every six months, which an organization may set differently based on its own risk.

• Need-to-know and profiles: defined authorisation profiles per role, with the data each profile may reach and the actions it may perform.
• Joiners, movers and leavers: the request and approval step for new access, the trigger for changes when someone changes role, and the deadline for removing access when someone leaves.
• Privileged access: separate rules for administrators and service accounts, including who approves them and how their use is logged.
• Access review: the review frequency the organization has chosen (the EDPB example is every six months), the reviewer, and what happens to access that is no longer justified.
• Evidence: access request tickets, approval records, review sign-offs and removal logs.

To check this tab, compare a sample of current accounts against the approved profiles and confirm that leavers were removed within the policy's stated deadline.

The EDPB guide recommends making staff aware of privacy risks and providing security training, and it links documented operating procedures to that awareness. A reviewer expects a training plan that matches the roles in the organization, not a single generic course. The evidence that matters is who was trained, on which version of the policy, and when they were last refreshed.

• Training scope: the topics for each role, such as phishing and credential handling for all staff and procedure-specific sessions for those who handle data subject requests.
• Onboarding and refresh: training before access is granted, and a refresh cycle set by the organization.
• Procedures: written operating procedures for recurring tasks, such as backup restores or erasure requests, so awareness translates into consistent action.
• Records: attendance, completion dates, the policy version covered and results of any assessment.
• Feedback loop: how incidents and near misses change the training content.

To check this tab, confirm that every person with access appears in the training records and that the records cover the current policy version.

The EDPB guide recommends confidentiality clauses in contracts with employees and other data handlers. These clauses bind people and organizations to protect personal data, and they are the contractual counterpart to the internal policy. For processors, Article 28 also requires a written contract, so a reviewer will check that confidentiality terms sit within those agreements rather than in a separate informal arrangement.

• Employee terms: a confidentiality obligation in employment or engagement contracts that continues after the relationship ends.
• Third-party terms: confidentiality and data handling obligations for contractors, temporary staff and service providers with access to personal data.
• Processor contracts: written terms covering instructions, staff confidentiality and security, as Article 28 requires.
• Signature records: signed copies or accepted electronic acceptance, stored where they can be retrieved for an assessment.
• Review on change: clauses updated when the policy or the processing changes.

To check this tab, sample the contracts for staff and suppliers with data access and confirm each one contains an enforceable confidentiality obligation and a signed copy is on file. Legal review of the wording is a matter for qualified counsel.

Under Article 24, the controller is responsible for showing that processing complies with the GDPR, and where proportionate, for implementing appropriate data protection policies. That responsibility stays with your organization, so senior management must own each policy, approve it and fund the work to keep it in force. Where a data protection officer is designated, the DPO advises on the policies and monitors compliance with them, but the DPO does not become the approver by default. The WP243 rev.01 guidelines describe the DPO's tasks as informing and advising, monitoring compliance, advising on data protection impact assessments and cooperating with the supervisory authority.

• Named policy owners: Assign each policy to an accountable manager, such as the CISO for security policies or the HR lead for staff confidentiality rules.
• Senior management approval: Record who approved each version, when, and under what authority, so the approval itself is evidence.
• DPO input: Where a DPO is designated, document the advice received and any decision taken against it.
• Review cycle: Set a review date for each policy and keep the change history with it.
• Staff communication: Show that staff received, read and acknowledged the policies that apply to their roles.

Confirm whether your organization must designate a DPO under Articles 37 to 39 before you set the approval chain.

An implementation partner can help with the operational side of policies. Drafting, tailoring to your systems, configuring access and logging, and assembling the evidence pack are all practical work that depends on how your platforms actually run. A partner does not decide what your policy says on your behalf, does not approve policies and does not issue any report, certificate or attestation. Those decisions and any formal conclusions remain with your organization and with independent assessors. DeployOpen, for example, prepares systems, controls and evidence for assessments but does not issue audit reports or certifications.

• Drafting support: Produce first drafts of security, access control and retention policies for your review and sign-off.
• Tailoring to systems: Map policy statements to the configured settings of self-hosted platforms, such as role assignments and log retention.
• Access and logging configuration: Set up the access controls and audit logs that show a policy is applied in practice.
• Evidence pack preparation: Collect configuration exports, access review records and log samples in an organized form.
• Clear boundaries: Put in writing that the partner's work is preparatory and that approval and formal findings rest elsewhere.

Check that the scope document states who signs each policy and who receives each evidence item.

Independent parties test whether policies are followed in practice. A supervisory authority can investigate a controller or processor and examine its policies, records and systems. Where a certification scheme applies, an accredited certification body or a supervisory authority may issue a certification under Article 42, valid for at most three years. Only these bodies issue certifications, and the GDPR requires no audit, attestation or certificate. Certification does not reduce the controller's or processor's responsibility for compliance, so a certificate supports the organization's own accountability rather than replacing it.

• Practice over paper: Assessors compare the written policy with the systems, staff behavior and records that show what actually happens.
• Findings, not approvals: An assessor reports findings and conclusions; it does not write or approve your policies.
• Certification bodies: Only accredited certification bodies or supervisory authorities issue GDPR certifications, and the EDPB maintains a register of certification mechanisms, seals and marks.
• Scope of the certificate: Confirm which processing, systems and policies a certificate covers before relying on it.
• Continued responsibility: Keep your own monitoring running between any certification review.

Ask any assessor or certification body to confirm its accreditation and the scheme it operates under before you engage it.