Staff records

A data protection impact assessment policy is an internal document setting out how and when your business will assess the data protection risks of its activities. It’s important to have proper policies and procedures in place when you’re handling personal data and carrying out a data protection impact assessment is sometimes mandatory under Article 35 UK GDPR. A data protection impact assessment might also be referred to as a privacy impact assessment, a DPIA or a GDPR risk assessment. This template DPIA policy will help you to comply with your data protection obligations by setting out when and how your staff should consider carrying out data impact assessments. It also includes a template DPIA form, which has been produced by the Information Commissioner’s Office (ICO). This provides an example of how you can assess, record and seek to reduce the privacy risks associated with your projects. Where applicable, it also includes a template DPIA form for use by online services which are directed at, or are likely to be used by, children, which has been produced by the ICO. This will help relevant online services to comply with their obligations under the ICO's Age Appropriate Design Code. You can also purchase this policy as part of the Data protection policy toolkit .

Use this checklist for departing staff to tick off the various tasks you need to undertake when a staff member leaves your business, and make sure you don’t forget anything important. This checklist covers practical matters for the security of your premises, like returning keys, and administrative matters, like dealing with final salary payments. It also includes measures to take to protect your business interests, such as removing the individual’s access to your internal systems. You can also purchase this checklist as part of the TUPE transfer toolkit for outgoing employer .