💭 Ask yourself...

"If I asked a member of staff to explain how we deal with personal information, would their answer match our policy?"

If not...

The policy probably needs reviewing.

Short answer

Policies aren't there to satisfy a regulator.

They're there to explain how your organisation actually works.

A good policy should reflect your day-to-day processes, support your staff to make good decisions and provide a clear framework for handling personal information consistently.

If your policies don't match what your organisation actually does, they're unlikely to help when you need them most.

Why is this important?

Many organisations have data protection policies because they know they should.

The problem is that some policies:

• were downloaded from the internet; 
• were written for a completely different type of business; 
• haven't been updated to reflect changes in the law, such as the Data (Use and Access) Act; 
• describe processes that no longer exist; 
• are so complicated that nobody reads them. 

A policy should never be something that sits in a folder and is forgotten.

It should be a practical document that helps people make the right decisions every day.

What makes a good policy?

A good policy should:

• reflect what your organisation actually does; 
• be written in language your staff can understand; 
• clearly explain responsibilities; 
• support consistent decision-making; 
• be reviewed regularly; 
• evolve as your business changes. 

The best policies aren't necessarily the longest.

They're the ones people actually use.

Common Misconceptions

❌ "I've bought a GDPR policy, so I'm compliant."

Not necessarily.

A template is only a starting point. Your policies should reflect your organisation's own processes, risks and ways of working.

❌ "Nobody reads our policies anyway."

That's usually a sign something needs to change.

Policies should be practical documents that help staff understand what is expected of them—not documents that are written purely for compliance purposes.

❌ "I only need to update my policies when the law changes."

Not always.

Your policies should also be reviewed when your business changes, you introduce new technology, experience a data breach, change suppliers or identify better ways of working.

❌ "The more detailed the policy, the better."

Not necessarily.

A policy that nobody understands or follows offers very little value. Good policies are clear, proportionate and practical.

❌ "Policies prove we're compliant."

Policies demonstrate your intentions.

Real compliance comes from putting those policies into practice. Regulators will often look at whether your organisation actually follows its documented procedures, not simply whether the documents exist.

Good policies don't create good businesses. Good businesses create good policies.

The role of a policy is to capture the decisions, values and processes that already exist within your organisation, providing a framework that helps everyone work consistently and confidently.

Practical steps

1. Review each policy regularly. 
2. Remove anything that doesn't reflect your current business. 
3. Update policies when legislation or your business changes. 
4. Make sure staff know where policies are and understand their responsibilities. 
5. Check that your policies align with what actually happens in practice. 

🤝 Need a little support?

Many organisations have policies that were created years ago and haven't kept pace with how the business has evolved.

A policy review isn't about rewriting everything from scratch. Sometimes small changes can make your documentation far more practical, easier for staff to follow and better aligned with the way your organisation actually operates.

If you're unsure whether your policies still reflect your business, we're happy to help.

Related Guides:

How Do I Keep Track of All the Personal Data? 

We've Completed a DPIA... Is That It? 

Can I Just Rely on Legitimate Interests?