Back to Module
2 of 3|Privacy Operations
reading 20 min•Compliance Monitoring
Internal Policies
You need internal rules to govern employee behaviour.
🎯 Learning Objectives
- ▸ Learn the essential internal privacy policies
- ▸ Understand the implementation of policies
Essential Policies
To comply with the DPDPA, you need a set of internal documents that guide employee behavior:
- • Data Protection Policy: The overarching policy outlining the company's commitment to privacy.
- • Access Control Policy: Who can access what data and how access is granted/revoked.
- • Data Retention & Deletion Policy: How long data is kept and how it is securely destroyed.
- • Incident Response Policy: What to do if a breach happens.
- • Remote Work Policy: Rules for handling data on personal devices (BYOD).
📖 Glossary
- Internal Policy
- A set of rules and guidelines created by an organization to govern its internal operations.
- BYOD
- Bring Your Own Device, a policy allowing employees to use personal devices for work.
🔑 Key Takeaways
- You need an internal Information Security Policy.
- You need a Data Retention and Deletion Policy.
- You need an Acceptable Use Policy for company devices.
📚 Further Reading
- Privacy Program Management — IAPP (2022)
Course Author
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...