Data protection

New and updated

• Type:

  Letters and forms

  Letter responding to subject access request providing requested information

  This template letter has been updated to reflect new requirements from 19 June 2026 for handling data protection complaints, including making clear that individuals can complain to the organisation as well as to the Information Commissioner’s Office.

• Type:

  Letters and forms

  Contractor privacy notice

  Use our updated template wording to review and amend your organisation’s contractor privacy notice to reflect new requirements from 19 June 2026 for handling data protection complaints.

• Type:

  Letters and forms

  Worker privacy notice

  Use our updated template wording to review and amend your organisation’s worker privacy notice to reflect new requirements from 19 June 2026 for handling data protection complaints.

• Type:

  Letters and forms

  Job applicant privacy notice

  Use our updated template wording to review and amend your organisation’s job applicant privacy notice to reflect new requirements from 19 June 2026 for handling data protection complaints.

• Type:

  Letters and forms

  Employee privacy notice

  Use our updated template wording to review and amend your organisation’s employee privacy notice to reflect new requirements from 19 June 2026 for handling data protection complaints.

• Type:

  Policies and procedures

  Processing special category personal data and criminal records data policy

  Use our updated template wording to review and amend your organisation’s data protection policy to reflect new requirements from 19 June 2026 for handling data protection complaints.

• Type:

  Policies and procedures

  Data protection policy

  Use our updated template wording to review and amend your organisation’s data protection policy to reflect new requirements from 19 June 2026 for handling data protection complaints.

• Type:

  Letters and forms

  Form to raise data protection complaint

  Use this model form to allow an individual to raise a complaint about how the organisation has handled their personal data.

• Type:

  How to

  How to manage the retention of employee data under the UK GDPR

  From 6 April 2026, employers have a duty to keep records relating to statutory annual leave for at least six years, under provisions in the Employment Rights Act 2025.

• Type:

  How to

  How to determine the legal grounds for processing employee data under the UK GDPR

  Updated to reflect that "recognised legitimate interests" has been added as a seventh potential legal ground for processing, by the Data (Use and Access) Act 2025. The most relevant grounds for employers remain performance of a contract, legal obligations or the employer's legitimate interests.