Templates / Attestation Flow

Personal data handling (GDPR) template

For staff who handle personal data. It turns the GDPR principles into everyday rules and says to report a suspected breach immediately, since the controller may have to notify within 72 hours, with a quiz and yearly re-attestation.

• App: Attestation Flow for Confluence
• Category: Privacy
• Edition: Picking the pack works in every edition; the paid settings and the starter text need a paid licence
• Re-acknowledge: every 365 days

Note shown to readers:

By acknowledging, you confirm you understand how to handle personal data and when to report a personal data breach.

Template. This template is a starting point, not legal advice. Adapt it to your organisation, your contracts and the law that applies to you, and have it reviewed by a qualified professional before you rely on it.

Purpose

[Company] processes personal data about customers, employees and others. This policy turns the GDPR principles into everyday rules.

Principles we follow

• Lawfulness, fairness and transparency: we have a legal basis and tell people what we do.
• Purpose limitation: we use data only for the purposes we stated.
• Data minimisation: we collect only what we need.
• Accuracy: we keep data correct and up to date.
• Storage limitation: we delete data when we no longer need it ([retention schedule]).
• Integrity and confidentiality: we keep data secure.

Everyday rules

• Access personal data only when your role requires it.
• Do not copy personal data into personal tools, spreadsheets on your desktop or chat messages.
• Share personal data outside [Company] only under a contract approved by [privacy contact].
• Pass requests from individuals (access, deletion, correction) to [privacy contact] the same day.

Personal data breaches

Report any suspected breach to [privacy contact] immediately. The controller may have to notify the supervisory authority within 72 hours of becoming aware of it, so every hour counts.

Contacts

Data protection contact or DPO: [name, email]. Records of processing: [location].

Includes 2 quiz questions; the answers are not published here. They are shown only in the app's requirement editor, to the person setting up the requirement, who can change them before saving.

1. How quickly must a suspected personal data breach be reported internally?
   • Within a month
   • Immediately, to [privacy contact]
   • Only if a customer complains
2. Which principle means collecting only the data you need?
   • Data minimisation
   • Storage limitation
   • Accuracy

Edit a Confluence page, insert the Attestation Flow macro, open the requirement editor and pick the pack under Start from a policy pack. It fills the note and the due date; with a paid licence it also fills the re-acknowledgement window, the minimum reading time and the quiz, and can add the starter text to the page. Required readers are never preset: you choose them.

• Attestation Flow for Confluence documentation
• Confluence policy templates: all 16 templates