Your data protection policies are written. Are they actually working?
While most organisations recognise internal policies such as a Data Protection, Data Breach, Retention, or Subject Access Request Policy, as vital components of the data protection compliance framework, simply having them written is only part of the equation.
These documents may have been reviewed, and oftentimes approved at Board level. You might even require employees to sign that they have understood their responsibilities in them, but the question still remains. Are your data protection policies actually working?
Policy vs practice
Having policies in place and having effective data protection compliance processes are two very different things, and having policies is not indicative that you are meeting your obligations. Even the best policy does little to protect personal data or ensure compliance if staff don’t understand it, internal processes don’t reflect it, and no one checks if it’s followed.
A policy is not a control
Policies are quite often mistaken for a control, which is not the case. A policy tells people what you expect them to do, but a control is what you apply to actually make that happen. For example, your Retention Policy might say that personal data should not be kept for longer than necessary to meet the purpose, but what happens in practice to make that happen, and assist employees with upholding their end of the bargain? Do you have automatic processes to delete customer records after a defined period of inactivity? Does someone regularly review shared drives? Do you have automatic retention set up on employees’ inboxes?
The 4:50pm Friday test
The real test is to ask yourself, what does a typical working day look like versus what are we telling employees they are supposed to do? Take for instance, a potential data breach is discovered at 4:50pm on a Friday. What happens next? Ignore what your policy says, what actually happens in practice?
If employees know what to do, who to contact, and can follow a practical process, your policies might be doing their job. If however, employees have to search through your policy folder, ask 3 people “what should I do”, or rely on someone else’s memory of what they think they are supposed to do, it is likely that there is a gap between your policy and practice. But what should we do to test this?
Test whether your policies are working
I don’t mean the annual review of your policies to tick off another compliance task for the year.
You should be asking:
Do employees actually understand the policies?
Policies are often written for compliance purposes rather than for the people expected to use and understand them.
To test whether employees understand their responsibilities, you can ask a few questions:
- What would you do if you accidentally sent an email to the wrong person?
- Who would you tell about a suspected data breach?
- Who would you tell if you received what you think might be a request for personal data?
- How long should you be keeping information in your role?
- Can you use customer data for a new project without checking?
- Do you know who to contact if you have an idea that uses customer information for something new?
Do your processes match your policies?
This is an extremely important check that is often not completed. Take a policy document, and follow the process in real life.
I will use the retention example again. Take for instance, if this says that inactive contacts should be deleted after 12 months. Now trace that data through your systems.
- Where is it stored?
- Who owns it?
- How is the retention period monitored?
- Is it deleted from backups?
- Who has responsibility for ensuring that data is deleted?
Do people know what happens when something goes wrong?
In practice, breach policies are a prime example of policies that may not be fully working. All too often we see breaches being reported to the Data Protection Officer (DPO) later than they should, because people don’t fully understand what they need to do. Ask:
- Can your employees identify a potential data breach?
- Do they know who to report it to, and the timeframes they need to meet for reporting?
- Do they understand that if they discover a potential breach as they are about to head home for the weekend, they must still make someone aware?
- Does someone monitor reports outside normal working hours?
- Are your incidents being recorded and assessed consistently?
Are you testing your controls?
Most organisations are familiar with testing other controls, such as financial and cyber security controls, but data protection controls are often not given the same level of attention.
Consider, as you would with something like cyber security controls, completing practical exercises to assess whether your controls are working. These don’t need to be expensive (like penetration testing can be), and they don’t need to take lots of resources. Consider doing some simple testing such as:
- Sampling records to check retention practices
- Testing how quickly a Subject Access Request (SAR) can be identified and escalated
- Running tabletop exercises to test staff understanding
- Reviewing a sample of data breaches/near misses
If your tests show that policy and practice aren’t aligning, you will need to consider what needs to change. Do you need to update processes so that they align with what you state you are doing in your policy, do you need to update your policy so that employees actually understand what it is they need to do, or do you need to do both?
Out of date policies
Time and time again we will see policies that haven’t been touched in 2-3 years, but in that time the business has grown significantly. If you have a policy that was written 3 years ago, but in that time you have grown, employed dozens of new people, and introduced new systems to keep up with your expansion, your policy is going to be ineffective and out of date.
Your policies need to reflect how you actually operate, not how you operated when the document was written. Annual reviews are a great way to ensure that your policies are keeping up with your organisation’s development.
Turn your findings into improvements
Your goal shouldn’t be to have a huge suite of perfect policies. It should be to have confidence that those policies translate into consistent behaviour, supported by effective controls that make sense for your organisation.
If your employees understand your policies, your processes reflect them, your systems support them and you regularly test whether they work, then your policies are doing their job as part of a functioning data protection framework.
If you are less certain, that doesn’t mean you are failing. It does mean it is worth looking at where employees need more support. Quick reference guides for SARs, Data Protection Impact Assessments (DPIAs) and data breaches can be a useful starting point, helping people find the immediate steps they need without having to work through a ten-page policy every time.
Use what you find to make practical improvements. That might mean simplifying a process, making reporting routes clearer, updating a system or giving employees training on the situations they encounter most often.
Ultimately, the real measure of effective data protection is what happens to personal data in the day-to-day running of your organisation.
You can find further useful guidance on the ICO website.
Get in touch today!
If you need help drafting or reviewing policies, creating quick reference guides or testing employee awareness, get in touch with the team at DPAS. We can also carry out a data protection audit to help you understand what is working, where the gaps are and what to prioritise next.
