MKB Juristen drafts custom legal documents
It is best not to cobble together or copy important contracts, terms and conditions, and other legal documents yourself. We help entrepreneurs on a budget with customized legal solutions, clear costs upfront, and practical explanations.
- Custom contracts, terms and conditions, and legal documents
- Budget-friendly and clear about the costs upfront
- Request a free consultation or a no-obligation quote
Drafting a privacy policy involves establishing in an internal document who within your organization is responsible for personal data, which procedures apply, how long you retain data, and which security measures you take. The privacy policy is a steering document for your own people, not the external statement on your website. Its content follows from the accountability obligation of Article 5, paragraph 2 of the GDPR and the duty to take appropriate measures of Article 24. Below are the components that belong in it and the approach to making it a workable document.
The short answer
- Assign roles: who is the data controller and who is internally accountable.
- Link to the processing register: which processing operations you carry out pursuant to Article 30.
- Establish retention periods per category of data.
- Describe security measures pursuant to Article 32.
- Include a data breach procedure in accordance with Articles 33 and 34.
- Arrange training so that employees know and follow the policy.
Drafting a privacy policy: the standard components
A privacy policy is only useful if it aligns with how your organization operates. The foundation consists of these components:
- Roles and responsibilities: who decides on processing, who manages the systems, and who is the point of contact for questions or incidents.
- Principles from Article 5: purpose limitation, data minimization, accuracy, and storage limitation, translated into concrete working rules.
- Retention periods by category, with a statutory period where applicable.
- Security pursuant to Article 32: access control, password policy, encryption and backups.
- Data breach procedure pursuant to Articles 33 and 34: how to recognize, report, and register a data breach.
- Processors: which external parties do you work with and which data processing agreements are in place.
- Rights of data subjects: how to handle a request for access or deletion.
Roles and the processing register
Start by considering who is responsible for what. In an SME, the management is typically the data controller, with one or more employees serving as the internal point of contact. A Data Protection Officer is only mandatory in specific cases, such as the large-scale processing of special categories of data, but you may voluntarily appoint one.
Subsequently, link the policy to the processing register from Article 30. That register lists which processing operations you carry out, for what purpose, and on what legal basis. Without that inventory, a policy hangs in the air, because you do not know exactly what you need to manage. The register is the inventory, and the policy is the ground rules surrounding it.
Security and data leaks
Article 32 requires appropriate technical and organizational measures. Appropriate means proportionate to the risks; thus, an organization with sensitive files takes more stringent measures than a company that only processes address data. Examples include role-based access control, strong passwords, laptop encryption, verified backups, and a clear policy regarding the use of private devices.
In addition, include a data breach procedure. Article 33 requires you to report a data breach to the Dutch Data Protection Authority within 72 hours in principle, unless the risk to data subjects is low. In the event of a high risk, you must also inform the data subjects pursuant to Article 34. Document how an employee reports a suspected breach, who assesses it, and who handles the report.
From paper to practice
A policy gathering dust in a drawer will not help you during an audit and will not prevent incidents. Ensure employees are familiar with it, discuss it upon hiring, and repeat the core principles periodically. Briefly document that and when you do so, as this is also part of the accountability obligation.
A brief example. A dental practice in Breda with eight employees processes medical data, which is sensitive data. The privacy policy stipulates that only practitioners have access to files, that the system logs out automatically, that data is retained in accordance with the retention period for medical records, and that any suspected data breach is reported to the practice manager the same day. During an audit, the practice can demonstrate that the policy is appropriate for the sensitivity of the data.
Honest recommendation
If you work alone or with a small team and only process standard data, you can easily draft a privacy policy yourself. Keep it concise, align it with your processing register, and ensure that the retention periods and data breach procedure match current practice. You don't need a lawyer for that.
Seek assistance as soon as you work with sensitive data, have staff across multiple locations, use many processors, or store camera footage. The difficulty then lies in aligning roles, security levels, and procedures with the risks. A legal expert helps you create a policy that is workable and truly fulfills your accountability obligations.
Want to know more or have it arranged immediately? View the privacy policy of MKB Juristen, first read what a privacy policy is , and see what it costs to have a privacy policy drafted .
Frequently Asked Questions
Assign roles and responsibilities, link the policy to your processing register under Article 30, establish retention periods, describe security measures pursuant to Article 32, and include a data breach procedure in accordance with Articles 33 and 34. Finally, ensure that employees are familiar with the policy.
There is no statutory template, but a usable policy contains roles, the principles of Article 5, retention periods, security under Article 32, the data breach procedure, the handling of processors, and the handling of data subject rights. Together, these fulfill the accountability obligation.
Only in specific cases, such as large-scale processing of special categories of data or systematic observation. Outside of those cases, you may voluntarily designate a point of contact. For most SMEs, an internal responsible person suffices.
For each category of data, based on the principle of storage limitation in Article 5. Where a statutory period applies, such as the seven-year tax retention obligation for invoices, adopt that. For other data, specify a period or a concrete criterion.
How an employee recognizes and reports a suspected breach, who assesses it, and who handles the notification to the Dutch Data Protection Authority. Article 33 generally requires reporting within 72 hours; in the event of a high risk, you also inform the data subjects pursuant to Article 34.
Yes. A policy only works if people know and follow it. Discuss it upon hiring, make the core easy to find, and repeat it periodically. Briefly document that you are doing this, as that is also part of the accountability obligation.
The privacy policy is internal and describes how your organization operates. The external privacy statement informs visitors and customers. What you arrange internally must align with what you promise externally, but they are two separate documents with different audiences.
