Obligation & Compliance — Unit 11, Upper-intermediate English

**Policy excerpt · Data Protection · effective 1 March**

Colleagues,

This policy sets out duties for everyone who handles personal data. All personnel **are required to** complete annual privacy training and a refresher each February. **Mandatory training** must be finished before system access is restored after any role change. Training is **mandatory** for contractors with system access.

Teams must **comply with** retention limits and **adhere to** the classification standard in Annex B. Processing of personal data is **subject to** documented legal basis on every intake form. **Pursuant to** Article 17, erasure requests must be logged within thirty days and acknowledged in writing.

**Failure to** maintain accurate records may leave the organisation **liable to** regulatory fines. We have an **obligation to** protect customer data **in compliance with** the **regulatory framework**. Sharing credentials or bypassing approval workflows is **strictly prohibited**; such conduct may constitute a **breach of contract** for vendors **bound by** our data-processing agreement.

It is **imperative that** encryption **is** enabled on all portable devices before they leave the office. These controls are **binding** and **non-negotiable** in production environments. Breach notification is a **statutory requirement**; line managers **are obligated under** Section 9 to report incidents within four hours.

Before third-party tools are adopted, procurement must complete **due diligence** and confirm vendors **meet the criteria** in the security checklist. Teams that delete audit logs may **fall foul of** policy and lose access until remedial training is completed. Legal will **grant approval** for new integrations only when remediation is verified.

**Annex D — Where this policy does not apply, and where judgement is expected**

A policy that claims to cover every case is a policy nobody reads to the end. The following exclusions and discretions are stated deliberately.

**Emergency access.** In a live incident affecting customer data, an on-call engineer **may** exercise elevated access without prior approval. The approval requirement is suspended; the logging requirement is not. Such access **must be** recorded within one hour and reviewed by the Data Protection Officer within two working days. Any engineer who delays containment to obtain a signature will not be criticised for the delay, but this policy does not require it of them.

**Anonymised data.** Retention limits in Annex B **do not apply** to data from which identification is not reasonably possible. Teams **must not** assume a dataset is anonymised because direct identifiers have been removed; combinations of quasi-identifiers frequently permit re-identification, and the classification standard **is binding** on that question rather than the team's own assessment.

**Legal hold.** Where Legal issues a hold notice, the hold **overrides** every deletion obligation in this policy, including erasure requests. This apparent conflict is resolved in favour of the hold, and staff receiving an erasure request for data under hold **must** escalate rather than decide.

**Proportionality.** Not every control applies at every scale. A team processing fourteen records for an internal pilot is **not required to** complete the full impact assessment, provided the data does not include special categories and provided the exemption is recorded. **Failure to** record the exemption removes it.

**Reporting a mistake.** No disciplinary action will follow the good-faith self-report of a data-handling error made within twenty-four hours. This provision is **unconditional** and is not subject to the manager's discretion. Errors that are concealed are treated entirely differently, and that distinction is the point of the provision.