Templates & operational documents

A Word BYOD policy for personal phones and laptops used at work. It covers enrollment, acceptable use, lost devices, and separating company data from personal data. Adapt it to your MDM stack before you roll the program out.

A Word form for written permission to use or disclose protected health information. Use it at intake or when sharing PHI with another provider. Have U.S. counsel check it against your Notice of Privacy Practices.

A Word privacy notice you can adapt for a website or service. It lists typical GDPR notice topics so you can fill in your own processing. Counsel should confirm lawful bases, recipients, and retention before you publish it.

A Word checklist of GDPR program tasks, from records of processing to incident handling. Use it to see what is still blank. Completing the list is not a certification and does not by itself prevent a fine.

A Word data-protection policy covering roles, principles, and handling of personal data. Map it to your DPO or privacy lead. It is not a substitute for a DPIA or a processing contract.

A Word information-security policy that you align with your controls and GDPR security duties. Name your tools and owners. It does not implement those controls.

A Word guide for healthcare staff posting on social media. It flags patient confidentiality and typical GDPR issues. Local professional rules still apply.

A Word participation/consent form for research involving people. Describe the study in your own words. Ethics-board and sector rules are outside this file.

A Word policy for workplace cameras: where they may be used, who can view footage, and how long recordings are kept. Edit it for your sites and access-control tools. It is a starting document, not a surveillance-law opinion.

A PowerPoint knowledge check with yes/no questions and facilitator notes. Run it after a briefing. It tests recall; it does not certify staff or your program.

A Word form asking to use someone’s name or image on social channels. State the accounts and the duration. Platform terms and employment rules still sit with you.

A Word checklist of incident-response steps: contain, record, assess, and follow up. Keep it next to your register. Notification duties depend on the incident, not on ticking every box.

An MP4 briefing on home-network and remote-work habits. Play it when staff start working off-site. It is awareness training, not a remote-work policy.

An Excel register of processing activities (ROPA-style). Add your systems, purposes, and retention periods. It does not inventory your estate for you.

A Word retention policy plus a schedule you fill with your own periods. It describes how to keep and then destroy data. Legal minimums and industry rules still have to be written in by you.

A Word worksheet for assessing a personal-data incident and recording next steps. Use it when something has already gone wrong. Supervisory-authority deadlines still depend on your facts.

A Word form for people who ask you to erase their data. Log the request and the decision. Erasure still depends on whether a legal exception applies.

A Word consent form for photos and video of people at events or in the workplace. Fill in the purpose and where images will appear. Separate employment or press rules may still apply.

A Word checklist to help you decide whether a DPIA is likely required. Answer the questions for the processing in front of you. A “yes” is a prompt to assess, not a completed DPIA.

A Word DSAR intake form so you can identify the requester and the data they want. Pair it with your identity-check process. It does not answer the request for you.

An Excel log for personal-data incidents: what happened, who was affected, and what you did. Fill a row per incident. It is a record, not a notification to a regulator.

A PowerPoint quiz on healthcare privacy habits, with answer notes for the facilitator. Use it after a session. It is a training aid, not a HIPAA or GDPR audit.

A Word form for staff to report a suspected incident internally. Route it to your privacy or security lead. It is not a filing with a supervisory authority.