> Acme Inc — Internal Data Protection Policy

>

> Effective Date: 2026-03-19

>

> Policy Owner: Jane Mueller

>

> Generated by Codepliant Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

## Related Documents

- Privacy Policy (`PRIVACY_POLICY.md`)
- Access Control Policy (`ACCESSCONTROLPOLICY.md`)
- Encryption Policy (`ENCRYPTION_POLICY.md`)
- Data Retention Policy (`DATARETENTIONPOLICY.md`)
- Incident Response Plan (`INCIDENTRESPONSEPLAN.md`)

## 1. Purpose and Scope

This Data Protection Policy establishes the principles, standards, and responsibilities for protecting personal data and sensitive information processed by Acme Inc. It applies to all employees, contractors, and third parties who access or process data on behalf of the organization.

### Scope

This policy covers:

- All personal data processed in connection with our products and services
- Employee and contractor personal data
- Data stored in electronic and physical formats
- Data processed by third-party services and sub-processors

## 2. Data Classification

All data processed by the organization must be classified according to the following levels:

Classification | Description | Examples | Handling Requirements
--- | --- | --- | ---
Restricted | Highly sensitive data — unauthorized disclosure would cause severe harm | Payment card data, authentication credentials, encryption keys | Encrypted at rest and in transit, access logged, need-to-know basis only
Confidential | Sensitive personal data or business-critical information | PII (names, emails, addresses), health data, financial records | Encrypted in transit, access controlled, retention limits enforced
Internal | Non-public data intended for internal use | Analytics data, error logs, internal communications | Access restricted to authorized personnel, not shared externally
Public | Data intended for public access | Marketing content, published documentation, public APIs | No special handling required

### Detected Data Types and Classifications

Based on automated code analysis, the following data types have been identified:

Data Type | Classification | Source
--- | --- | ---
Payment card details | Restricted | Payment processing services
Billing address | Confidential | Payment processing services
Transaction history | Confidential | Payment processing services
Authentication credentials | Restricted | Authentication services
User identifiers (name, email) | Confidential | Authentication services
Session tokens | Restricted | Authentication services
AI input data (user prompts) | Confidential | AI services
AI-generated outputs | Internal | AI services
Usage analytics | Internal | Analytics services
IP addresses | Confidential | Analytics services
Device information | Internal | Analytics services
User profile data | Confidential | Database services
Application data | Internal | Database services
Email addresses | Confidential | Email services
Communication records | Internal | Email services
Error reports | Internal | Monitoring services
Performance metrics | Internal | Monitoring services

## 3. Data Handling Procedures

### 3.1 Collection

- Collect only the minimum data necessary for the stated purpose (data minimization)
- Obtain appropriate consent or establish lawful basis before processing
- Provide clear privacy notices at all data collection points
- Document the purpose and lawful basis for each data collection activity

### 3.2 Storage

- Restricted data must be encrypted at rest using AES-256 or equivalent
- Confidential data must be stored in access-controlled systems
- All personal data must be stored in approved locations only
- No personal data on local workstations, USB drives, or personal cloud storage
- Database access must use parameterized queries to prevent injection attacks
- Database backups must be encrypted and tested regularly

### 3.3 Transmission

- All data transmitted over networks must use TLS 1.2 or higher
- API keys and credentials must never be transmitted in URLs or query parameters
- Email containing personal data must use encryption where possible
- File transfers to third parties must use approved secure channels

### 3.4 Processing

- Process data only for the purposes documented in the Record of Processing Activities
- Implement pseudonymization or anonymization where feasible
- Log all access to Restricted and Confidential data
- AI models must not be trained on customer personal data without explicit consent
- AI processing outputs must be reviewed for unintended personal data exposure
- Analytics data must be anonymized or pseudonymized where possible
- User consent must be obtained before analytics tracking is enabled

## 4. Access Control

### 4.1 Principles

- Least Privilege: Grant the minimum access necessary for the role
- Need-to-Know: Access to personal data only when required for job function
- Separation of Duties: Critical operations require approval from multiple parties

### 4.2 Access Levels

Role | Restricted Data | Confidential Data | Internal Data | Public Data
--- | --- | --- | --- | ---
Administrator | Read/Write (logged) | Read/Write | Read/Write | Read/Write
Developer | No access | Read (in production) | Read/Write | Read/Write
Support Staff | No access | Read (with justification) | Read | Read
Third-Party Contractor | No access | As per DPA only | As per contract | Read

### 4.3 Access Management

- All access must be authenticated and authorized
- Multi-factor authentication (MFA) is required for admin access and production systems
- Authentication sessions must have appropriate timeout periods
- Access permissions must be reviewed quarterly
- Access must be revoked within 24 hours of role change or termination
- Shared accounts are prohibited for accessing personal data

## 5. Data Disposal

### 5.1 Retention Periods

Data must be disposed of when it is no longer needed for the stated purpose or when the retention period expires:

Data Type | Maximum Retention | Disposal Method
--- | --- | ---
Account data | Duration of account + 30 days | Secure deletion from all systems
Payment/transaction records | 7 years (legal requirement) | Secure archival then deletion
Analytics data | 26 months | Automated purge
Error logs and monitoring data | 90 days | Automated purge
AI interaction data | 90 days | Automated purge
Email communications | 3 years | Secure deletion
User profile data | Duration of account + 30 days | Secure deletion from all systems
Backups containing personal data | 90 days after source deletion | Automated purge from backup rotation

### 5.2 Disposal Methods

- Electronic data: Cryptographic erasure or overwriting with random data
- Database records: Secure deletion with verification from all replicas and caches
- Backups: Allowed to expire naturally from backup rotation (max 90 days)
- Physical media: Shredding or degaussing
- Third-party data: Written confirmation of deletion from sub-processors

### 5.3 Disposal Verification

- Maintain a log of all data disposal activities
- Verify deletion from all systems, including backups and caches
- Obtain written confirmation from third parties when data is deleted on their systems

## 6. Data Protection Incidents

Any suspected or actual data protection incident must be reported immediately:

1. Report the incident to the Data Protection Officer within 4 hours of discovery
2. Assess the severity, scope, and potential impact on data subjects
3. Contain the incident to prevent further data loss
4. Notify supervisory authorities within 72 hours if required (GDPR Art. 33)
5. Notify affected data subjects without undue delay if high risk (GDPR Art. 34)
6. Document the incident, response actions, and lessons learned

Refer to the Incident Response Plan (`INCIDENTRESPONSEPLAN.md`) for detailed procedures.

## 7. Training and Awareness

- All employees must complete data protection training within 30 days of joining
- Annual refresher training is mandatory for all staff
- Specialized training for roles with access to Restricted or Confidential data
- Training records must be maintained for audit purposes

## 8. Third-Party Data Processors

All third-party processors must:

- Sign a Data Processing Agreement (DPA) before processing begins
- Demonstrate adequate technical and organizational security measures
- Process data only on documented instructions from the controller
- Notify us of any sub-processor changes (see Sub-Processor Change Notification process)
- Delete or return all personal data at the end of the engagement

### Currently Engaged Processors

Service | Category | DPA Required
--- | --- | ---
@sentry/node | monitoring | - [ ] Signed
@supabase/supabase-js | auth | - [ ] Signed
openai | ai | - [ ] Signed
posthog | analytics | - [ ] Signed
resend | email | - [ ] Signed
stripe | payment | - [ ] Signed
stripe-ios | payment | - [ ] Signed

## 9. Compliance and Monitoring

- This policy must be reviewed at least annually or after significant changes
- Compliance audits will be conducted at least annually
- Non-compliance may result in disciplinary action, up to and including termination
- All data protection activities must be documented for regulatory accountability

## 10. Roles and Responsibilities

Role | Responsibilities
--- | ---
Data Protection Officer (Jane Mueller) | Oversee compliance, handle DSARs, liaise with authorities, conduct DPIAs
Management | Ensure policy is implemented, allocate resources, support DPO
IT/Engineering | Implement technical controls, maintain security measures, manage access
All Employees | Follow this policy, report incidents, complete training

## 11. Contact

For questions about this policy or to report a data protection concern:

- Data Protection Officer: dpo@acme-saas.com
- General Contact: legal@acme.com

This Data Protection Policy was auto-generated by Codepliant based on code analysis. It should be customized to reflect your organization's specific requirements and reviewed by legal counsel and your Data Protection Officer.