Privacy and Data Protection Policy
Sets how Your Organization collects, uses, shares, retains, and protects personal information: principles, lawful basis, individual rights, impact assessments, processors, and breach handling.
Maps to ISO/IEC 27001:2022 A.5.34 · GDPR Art.5(2) · GDPR Art.13 · GDPR Art.25 · GDPR Art.30 · GDPR Art.32 · GDPR Art.33 · GDPR Art.35 · SOC 2 Type II P1.1 · SOC 2 Type II P6.1
Read it now — the PDF opens either way.
Purpose
Your Organization handles personal information about customers, users, employees, and other individuals. This policy sets how that information is collected, used, shared, kept, and protected, so that Your Organization treats people fairly and meets the privacy laws and contract terms that apply to it.
This policy is a framework for the privacy program. It is not legal advice. Counsel should confirm which laws apply to Your Organization (for example, the GDPR, UK GDPR, CCPA/CPRA and other U.S. state laws, HIPAA, or sector rules) and adapt the requirements below.
Scope
This policy applies to all workforce members and to all processing of personal information by or for Your Organization, in any form and system, including processing carried out by vendors on Your Organization's behalf. "Personal information" means any information relating to an identified or identifiable individual.
7 more sections in the full template
Roles and responsibilities · Principles · Requirements · Exceptions · Enforcement · Evidence · Review cadence. Download the full document above, or open it in CMDash to fill in your organization name and effective date automatically.
Use this policy for real, not just on paper
“Open in CMDash” pre-selects the Privacy and Data Protection Policy template the first time you create a policy — your organization name and today’s date fill in automatically, and it lands as a DRAFT you can edit before publishing.