Dealing with personal data during sales

A data protection impact assessment policy is an internal document setting out how and when your business will assess the data protection risks of its activities. It’s important to have proper policies and procedures in place when you’re handling personal data and carrying out a data protection impact assessment is sometimes mandatory under Article 35 UK GDPR. A data protection impact assessment might also be referred to as a privacy impact assessment, a DPIA or a GDPR risk assessment. This template DPIA policy will help you to comply with your data protection obligations by setting out when and how your staff should consider carrying out data impact assessments. It also includes a template DPIA form, which has been produced by the Information Commissioner’s Office (ICO). This provides an example of how you can assess, record and seek to reduce the privacy risks associated with your projects. Where applicable, it also includes a template DPIA form for use by online services which are directed at, or are likely to be used by, children, which has been produced by the ICO. This will help relevant online services to comply with their obligations under the ICO's Age Appropriate Design Code. You can also purchase this policy as part of the Data protection policy toolkit .

This Data subject request policy will allow you to set up a policy that staff can refer to when responding to a request from an individual about their personal data that your business holds (a data subject request). Under the UK GDPR, individuals can make requests about their personal data that you collect, including requests to correct or delete personal data, or a request for a copy of the data and details of how your business uses it (known as a subject access request). There are both practical and legal steps that you need to take in order to minimise any disruption and fulfil your obligations under the UK GDPR when responding to a data subject request. Having this Data subject request policy in place will assist your business in identifying and responding appropriately to a data subject request. You can also purchase this policy as part of the Data protection policy toolkit .