Free Data Protection and Privacy Policy Template and Generator

This policy sets the rules [Company Name] (the "company") follows to protect personal information about employees, customers, and other people, and confidential information that others entrust to the company. It covers how that information is collected, used, protected, shared, kept, disposed of, and what happens if it is lost or stolen.

An internal policy. This is an internal policy for [Company Name] personnel. It is not a public privacy notice and does not create rights for anyone outside the company. Where the company publishes a privacy notice, that notice must be consistent with this policy.

Legal review required. Privacy and data breach laws vary by state and country, change often, and depend on the facts. This policy is a framework, not legal advice. [Company Name] must have it reviewed by qualified legal counsel before adoption, and must involve counsel in every decision about breach notification or a new use of sensitive information. Where a law, regulation, or contract sets a stricter requirement, the stricter requirement applies.

This policy applies to all employees, officers, temporary workers, contractors, and service providers of [Company Name] ("personnel") who handle personal or confidential information, in any form: electronic, paper, spoken, or on any device, including personal devices used for work.

It covers information about people located in North Carolina and anywhere else the company does business, and confidential information the company receives from customers, suppliers, and partners.

Personal information

Any information that identifies a person or could reasonably be linked to them, such as a name with an address, email, phone number, ID number, or account number. Under North Carolina law (N.C.G.S. 75-61), the breach notification rules cover a first name or initial and last name combined with identifying information such as a Social Security, driver license, passport, bank, credit card, or debit card number, a PIN, a password, or biometric data.

Sensitive personal information

Personal information that can cause serious harm if exposed: Social Security, driver license, and passport numbers, financial account and card numbers, passwords, health information, and biometric data.

Confidential information

Non-public information about the company or entrusted to it by others, such as customer drawings, pricing, contracts, and information received under a nondisclosure agreement.

Data minimization

Collecting, using, and keeping only the personal information actually needed for a specific purpose, and no more.

Vendor

Any outside company that receives, stores, or can access personal or confidential information on the company's behalf, such as a payroll provider, IT provider, cloud service, or shredding company.

Security breach

Unauthorized access to and acquisition of personal information that creates a risk of harm. Under North Carolina law, a breach involves unencrypted and unredacted records, or encrypted records together with the key. Other states and countries define it differently. [Company Name] treats every suspected exposure as a possible breach until the privacy lead and counsel decide otherwise.

Individual request

A request from a person to see, correct, delete, or stop a use of their personal information.

Every requirement in this policy comes from five principles, based on FTC guidance for businesses:

1. Know what you have: the company knows what personal information it holds, where it is, and who can reach it.
2. Keep only what you need: the company collects and keeps only the personal information it needs for a legitimate business purpose.
3. Protect what you keep: personal information is secured on paper, on devices, in systems, and with vendors.
4. Dispose of it properly: information that is no longer needed is destroyed so it cannot be read or reconstructed.
5. Plan ahead: the company knows how it will respond if personal information is lost or stolen.

Fair use. Personal information is used only for the purpose it was collected for, or a closely related purpose people would reasonably expect, and never sold. A new use of sensitive information requires approval from the privacy lead.

Training. Personnel who handle personal information are trained on this policy when they start and at least once a year, as part of the company security awareness training.

[Company Name] holds the following categories of personal and confidential information. The privacy lead keeps a more detailed inventory that records, for each category, the systems and paper files where it is stored, the vendors that receive it, and how long it is kept.

Keeping it current. The privacy lead reviews the inventory with each department at least once a year, and personnel must tell the privacy lead before starting to collect a new kind of personal information or using a new system or vendor to store it.

• Collect only the personal information needed for a clear business purpose, and do not collect it "just in case."
• Do not copy personal information into spreadsheets, email, chat, or personal storage unless the job requires it, and delete working copies when the task is done.
• Do not enter personal or confidential information into AI tools, websites, or apps the company has not approved for that information.
• Use test or made-up data, not real personal information, when testing or demonstrating systems.

Social Security numbers. Social Security numbers are collected only where a law or a legitimate business process requires them, such as payroll, tax reporting, benefits, and background checks, and are never used as an employee or customer ID. North Carolina law (N.C.G.S. 75-62) also limits how businesses display, transmit, mail, and disclose Social Security numbers, for example by forbidding them on cards used to access services and requiring a secure or encrypted connection if a person is asked to send one over the internet.

Telling people. The company publishes a privacy notice on its website that describes the personal information it collects through the website and how it is used. The privacy lead and counsel keep the notice consistent with this policy and review it at least once a year.

• Access to personal information is limited to the people whose jobs require it, granted by role, reviewed at least once a year, and removed promptly when someone changes jobs or leaves.
• Systems that hold personal information require unique accounts and multi-factor authentication, a second check such as a code or app approval.
• Laptops, phones, and removable drives that may hold personal information are encrypted, and personal information sent outside the company is sent through encrypted email or an approved secure file-sharing service.
• Paper records with personal information are kept in locked cabinets or rooms, not left on desks, printers, or vehicles, and are shredded when no longer needed.
• Personal information is not discussed where others can overhear, and callers are verified before personal information is given out.

The technical safeguards for systems that hold personal information are set out in the company information security policy, where adopted.

Personal and confidential information may be shared outside the company only for a legitimate business purpose, and only as follows:

• Share only the minimum personal information the vendor needs to do the work.
• Before sharing sensitive personal information, confirm the vendor protects it appropriately, following the company vendor risk management policy where adopted, for example through a security questionnaire, an independent security report such as a SOC 2 Type II report, or a review of its security practices.
• Never sell personal information or share it for another company's marketing.
• Share personal information with government agencies or in legal proceedings only when required by law and after consulting the privacy lead or counsel.

These sharing rules do not limit the Protected Reports section.

Written agreements. Before a vendor receives or can access personal information, it must sign a written agreement that requires it to use the information only to serve the company, protect it with reasonable security, limit its own staff's access, flow these terms down to its subcontractors, notify the company promptly of any security breach, and return or securely destroy the information when the work ends. North Carolina law separately requires a business that holds personal information it does not own to notify the owner immediately after discovering a breach.

Retention. Personal information is kept only as long as needed for the purpose it was collected for, or as long as a law, contract, or legal hold requires, whichever is longer. The company record retention schedule, set in the data retention and destruction policy where adopted, sets the periods for each type of record. When no period is set, the privacy lead decides one and adds it to the schedule.

Disposal (official written policy). This section is the official written disposal procedure of [Company Name] for records containing personal information, as North Carolina law (N.C.G.S. 75-64) requires. When records containing personal information are no longer needed:

• Paper is shredded, pulverized, or burned so that it cannot practicably be read or reconstructed, using cross-cut shredders or locked shred bins collected by a disposal company.
• Electronic media, including computers, phones, copiers, printers with storage, drives, and backup media, is erased or destroyed so that the information cannot practicably be read or reconstructed, following NIST SP 800-88 and the company IT asset disposal policy, where adopted.
• Personal information in cloud services and email is deleted, including from shared folders and recycle bins, under the retention schedule.

Disposal companies. A shredding or IT disposal company may be used only after due diligence, such as reviewing an independent audit of its operations, checking references and recognized industry certifications, or reviewing its security practices, and under a written contract. The privacy lead monitors its compliance, for example by keeping its certificates of destruction.

Employees, customers, and other people may ask what personal information [Company Name] holds about them, ask for it to be corrected or deleted, or ask the company to stop using it for marketing. Requests are handled as follows:

1. Anyone who receives a request forwards it to the Privacy Lead the same day.
2. The privacy lead verifies the person's identity before sharing or changing anything, using information the company already holds. Information is never sent to an unverified email address or caller.
3. The privacy lead responds within 30 days, or sooner if a law requires it, and tells the person if more time is needed and why.
4. Marketing opt-outs are honored promptly and never require the person to create an account or pay a fee.
5. Deletion requests are honored unless the company must keep the information by law, contract, or legal hold, or needs it to complete a transaction. The person is told what was deleted and what was kept and why.
6. Every request, the response, and the date are logged and kept for at least two years.

Which rights a person has depends on where they live and which laws apply to the company. Counsel confirms the company's obligations before the company refuses a request.

Report immediately. Anyone who suspects that personal or confidential information has been lost, stolen, sent to the wrong person, or accessed by someone who should not have it, reports it immediately to the Privacy Lead, including lost laptops and phones and misdirected email. Do not investigate on your own, delete evidence, or contact affected people.

Assess with counsel. The privacy lead contains the problem with IT, starts a breach assessment with legal counsel within 24 hours of the report, notifies the cyber insurance carrier as the policy requires, and follows the company incident response policy, where adopted. The assessment decides what information was involved, whose, where they live, whether it was encrypted, and which notification laws and contracts apply.

North Carolina notice. When the personal information of North Carolina residents is involved in a security breach, N.C.G.S. 75-65 requires the company, with counsel's guidance, to:

• Notify affected people without unreasonable delay, consistent with any written request from law enforcement to delay because notice would impede a criminal investigation.
• Make the notice clear and conspicuous, and include a general description of the incident, the type of personal information involved, what the company did to protect it from further access, a company phone number, advice to review account statements and monitor free credit reports, the toll-free numbers and addresses of the major consumer reporting agencies, and the toll-free numbers, addresses, and websites of the FTC and the North Carolina Attorney General's Office.
• Notify the Consumer Protection Division of the North Carolina Attorney General's Office of the nature of the breach, the number of people affected, the steps taken to investigate and to prevent a repeat, and the timing, distribution, and content of the notice.
• If more than 1,000 people are notified at one time, also notify the nationwide consumer reporting agencies of the timing, distribution, and content of the notice.

When the company is the vendor. If the company holds personal information that belongs to a customer or another business and discovers a breach of it, the company notifies that owner immediately, and follows any faster deadline in the contract.

Other laws. Every U.S. state and many countries have their own breach notification laws, with different definitions, deadlines, and regulators. Counsel decides which apply. Contracts with customers may also require notice within a set number of hours.

Records. Every suspected breach, the assessment, the decision on notification and its reasons, and copies of notices are kept for at least five years. The privacy lead reviews each breach with the Chief Executive Officer and updates this policy where needed.

Other U.S. states. Breach notification laws apply based on where the affected person lives, so a breach involving people in other states may require notices under each of their laws as well as North Carolina law. Some states also have broad consumer privacy laws that give people rights over their data, usually applying only above size or data-volume thresholds. Counsel reviews at least once a year whether any of these laws apply to the company.

Exceptions. Requests for an exception are made in writing to the Privacy Lead, explaining the business need, the risk, and the safeguards that will be used instead. Exceptions involving sensitive personal information require approval by the Chief Executive Officer after consulting counsel, are recorded, and are limited to 12 months. No exception can permit a practice that breaks the law or a contract.

Enforcement. Accessing, using, sharing, or keeping personal information without authorization, or failing to report a suspected breach, may result in loss of access and disciplinary action, up to and including termination of employment or of a contractor agreement, consistent with applicable law. Vendors that fail to protect company information are subject to the remedies in their contracts.

Policy review. The privacy lead and counsel review this policy no later than October 2, 2027, and sooner after a breach, a change in privacy law that affects the company, a new kind of personal information or vendor, or expansion into a new state or country.

• North Carolina Identity Theft Protection Act, N.C.G.S. 75-60 to 75-66, including 75-62 (Social Security numbers), 75-64 (disposal), and 75-65 (breach notification).
• FTC, Protecting Personal Information: A Guide for Business.
• NIST Privacy Framework and NIST SP 800-88, Guidelines for Media Sanitization.

Related company policies. This policy works together with the [Company Name] information security, incident response, data retention and destruction, vendor risk management, IT asset disposal, and acceptable use policies, where adopted. If they conflict, the stricter requirement applies.

Nothing in this document prohibits or restricts anyone from reporting a possible violation of law to, filing a charge or complaint with, communicating with, or taking part in an investigation by any government agency, including law enforcement, the U.S. Department of Health and Human Services, the Securities and Exchange Commission, the National Labor Relations Board, or a state attorney general, or from making any other disclosure protected by law. No approval is needed for these reports, and no one will be disciplined for making one in good faith.

Approval. Sign below to approve this document for adoption by [Company Name] after it has been reviewed by your legal counsel. Until it is signed, it is a draft and is not in effect.

Revision history. Record every change to this policy below. Increase the document version and obtain approval again each time the policy is revised.

This document was generated from a starter template provided by Preferred Data Corporation. It is general information only. It is not legal advice and it is not a substitute for advice from a licensed attorney. Using the template does not create an attorney-client, consulting, or other professional relationship.

Preferred Data Corporation is not a law firm or an insurer. It makes no representation that this document is complete, current, or suitable for any particular organization, industry, jurisdiction, or regulatory requirement. To the fullest extent permitted by law, it is not responsible or liable for any loss or damage arising from the use of this template or of any policy created from it. You are solely responsible for how you adapt, adopt, and enforce it.

Laws, regulations, insurance requirements, and contracts that apply to your organization may require different or additional terms. The facts, deadlines, and legal references in this template were checked against their sources on the date shown as "Template content last reviewed" in Document Control, not on the effective date, and may have changed since. Before you adopt, publish, or rely on this document, and in every case where you have a legal, regulatory, or contractual obligation, have it reviewed by qualified legal counsel.

In an actual security incident or data breach, contact your attorney, your cyber insurer, and law enforcement where appropriate. Do not rely on this template alone to decide whether, when, or how to notify anyone.

If Preferred Data Corporation prepared this document for you as part of its services, your service agreement governs those services. The content of this document is still general information and should be reviewed by your own counsel before you adopt it.

This template is provided "as is", without warranties of any kind, including accuracy, completeness, or fitness for a particular purpose. Links to laws, agencies, and other websites are provided for convenience and may change. Use of this template is also subject to the Website and Free Resources Disclaimer and the Terms of Service at preferreddata.com/legal/disclaimer and preferreddata.com/legal/terms-of-service.

To report an error, contact Preferred Data Corporation at preferreddata.com/contact or (336) 886-3282 and include the Document ID shown in Document Control. Corrections are listed in the template changelog on the template's page at preferreddata.com/policy-templates.