The documents
What you must be able to produce
Six documents. A regulator asks for them in order and the gaps are visible within a minute.
The Record of Processing
The document a regulator asks for first, which most small employers believe they are exempt from and almost none actually are.
The Privacy Notice People Actually Read
Two documents rather than one: the complete notice that satisfies the requirement, and the page that answers what people want to know.
The Retention Schedule, With Triggers
Periods are easy to write and useless without the event they run from. The trigger is the part that makes deletion possible.
The Legitimate Interests Assessment
The basis most employers rely on and the document almost none has written. It takes an hour and it is the one a regulator asks to see.
The Impact Assessment, and When It Is Required
A heavier document than the legitimate interests assessment, required in defined circumstances that employers routinely meet without noticing.
Keeping Them Consistent With Each Other
A regulator compares the documents before reading any of them. Contradiction is a worse finding than absence, and it is the easier one to produce.
Who Owns These When Nobody Is a Specialist
Most employers have no data protection officer and do not need one. They do need somebody whose job this is, and usually nobody's is.