Policy
A top-level document: what we protect, from what, and where responsibility lies.
The set is determined by what you are covering: the personal data law, industry requirements or your own procedure. It usually comes to ten or fifteen documents.
A top-level document: what we protect, from what, and where responsibility lies.
Appointing the person responsible for processing, the composition of the commission, the list of authorised staff.
Who receives which rights, how the granting is recorded and how it is all revoked on departure.
Media, passwords, remote work, the procedure to follow during an incident.
Short and clear, not thirty pages that nobody will ever open.
Logs of media, of citizen requests, of briefings. Those are exactly what you are usually asked to produce.
The main requirement of the set is that it can be followed. A document that contradicts the working process will be breached in the first week.
How it all works: who grants access, what happens on departure, where the passwords are kept.
We prepare the set and agree wording that the company will actually be able to follow.
Approval, acknowledgement by signature, briefing of staff.
We review it once a year: systems, structure and responsible people all change.
Acknowledgement sheets go missing more often than the documents themselves. The policy is approved, the order is signed, and there is nothing to prove the staff ever read them. Signatures are collected once at rollout and then with every new hire, otherwise within a year the set is useless again.
A designated person inside the company. We hand over not only the texts but the way to work with them: when to update, whom to brief, where to keep the signatures. Without a designated person the set goes stale within a year.
Once a year as a matter of routine, and out of turn on significant changes: a new system, a new department, a change of responsible person, changed requirements. A review usually means amending a few clauses rather than rewriting.
The designated person, the policy, the consents and the logs. They do not always get as far as technical measures: if the basic paperwork is not in order, the findings start there.
Write what needs covering: the personal data law, a client requirement or your own procedure. We will propose the contents and a timeframe.
Request received
It is already with a manager. You will get an answer within the working day, and urgent requests go to the duty engineer immediately.
There is no such city in the list. Check the spelling.