# EXAMPLE: STAFF DATA PROTECTION POLICY
Date: 22 January 2028
Parties: Northmere Foods Limited and its workforce
## 1. Purpose
Northmere processes staff data fairly, lawfully and transparently for payroll, leave, recruitment, safety, benefits and legal compliance. This policy applies to employees, workers, applicants and contractors handling that data.
## 2. Scope
Managers collect only the minimum necessary, keep records accurate and use the specified HR systems. Special category data, including health and trade-union information, requires an additional lawful condition and restricted access.
## 3. Responsibilities
Access is role-based and reviewed every six months. Staff must use MFA, lock screens, check recipients before sending and never download a personnel file to an unapproved removable drive.
## 4. Policy-specific rules
The retention schedule keeps payroll records for seven years, unsuccessful recruitment records for six months and sickness evidence for the period needed to manage absence. A legal hold overrides routine deletion.
## 5. Reporting
A suspected breach must be reported to the Data Protection Lead within four hours. The Lead assesses containment, records the decision and considers notification to the ICO within 72 hours and communication to affected people.
## 6. Process
Employees can ask the Data Protection Lead for access, rectification, restriction or objection. Requests are logged, identity is checked proportionately and exemptions are explained; no manager may obstruct a statutory request.
## 7. Review and approval
The Data Protection Officer audits access twice a year, investigates incidents and reports metrics to the board. Training is annual, suppliers receive written instructions, and this policy is reviewed every January or after a material law or system change.