Policies and Documentation

The ICO’s transparency principle is explicit. Information given to data subjects must be concise, transparent, intelligible and easily accessible. It must use clear, plain language.

Why your communication matters as much as the regulation

This is not optional. The ICO has taken enforcement action against organisations whose privacy notices are incomprehensible. They have consistently held that legalese does not constitute valid transparency.

We bring together data protection expertise and professional copywriting to produce documentation that is regulatory sound and genuinely readable. The two are not in tension. They are both required.

The documentation you need

From privacy notices to sub-processor agreements, we produce the full range of Data Protection documentation. These can be done individually or as part of a comprehensive compliance implementation. Sector specific versions are tailored to your business.

The rights of every individual are very clear under Data Protection regulations. These are incorporated throughout our documentation and are detailed here.

Right to be informed, what data you collect, why, how long you keep it, and who you share it with.
Right of access, Subject Access Requests (SARs), individuals can ask for a copy of their personal data.
Right to rectification, individuals can ask you to correct inaccurate or incomplete data.
Right to erasure, the “right to be forgotten”, applies in specific circumstances, not as an absolute right.
Right to restrict processing, individuals can ask you to pause processing while accuracy or legitimate grounds are contested.
Right to data portability applies where processing is by consent or contract and carried out by automated means, and data is provided in a machine-readable format.
Right to object covers objections to processing based on legitimate interests, direct marketing, and research/statistics.
Rights related to automated decision-making and profiling, the right not to be subject to solely automated decisions that have legal or similarly significant effects.

Privacy Notices

Customer, employee, supplier, and public-facing privacy notices written in plain English and compliant with UK GDPR. Sector-specific versions tailored to your business.

Retention Schedules

Documented data retention and deletion schedules. Mapped to your processing activities, legal obligations and sector guidance. Keeps data storage compliance practical and auditable.

Consent Tools

Creating consent wording, cookie notices and marketing opt-in clauses to meet the standard the ICO requires.

Records of Processing Activities (ROPA)

Documentation that is structured to support accountability, maintained for audits and ready for regulatory inspection. Includes sub-processing mapping and transfer documentation.

Data Protection Impact Assessments (DPIA)

Designed for high-risk processing activities. Covering new systems, AI tools, surveillance technologies, large-scale profiling and special category data.

Legitimate Interests Assessments (LIA)

Structured three-part LIAs covering purpose, necessity and balancing tests. Supporting your legal basis documentation and withstanding regulatory investigation.

Data Processing Agreements (DPA)

Compliant DPAs for processor relationships. These include sub-processor clauses, security schedules, and return and deletion obligations.

Employee Data Policies

Keeping your internal data practices compliant and your staff informed. Policies include Bring Your Own Device, remote working, monitoring, HR data retention, WhatsApp and social media.

Complex documentation, clearly written

There is a suite of documents that requires specialist knowledge beyond standard UK GDPR. These include international transfers, sector-specific regulations, AI governance, and the crossover of data protection and information security.

The breadth of knowledge required to deliver data protection support has increased as new technologies become part of working practices. We have experience in writing these types of documents for our clients.

AI governance charters and processing assessments
ISO 270001 documents
Sector-specific compliance
CCTV and biometric data policies
Data breach response plans
Due diligence questionnaire responses

Policy maintenance for continued compliance

The data protection laws and ICO guidance are continually evolving. Our retainer service keeps your documentation up to date. Do you have existing policies you want reviewed or updated?

We update policies when legislation or guidance changes and review your ROPA as your processing activities develop.