Appropriate policy document template for accountancy practices
Set out the Schedule 1 conditions you rely on for staff health data, payroll data and anti-money laundering checks, how you follow the data protection principles, and how long you keep each record. This appropriate policy document template is one Word document, filled in for a typical practice.
UK practicesGet this pack and 100 more for $129
What the document looks like
When you need it
The Data Protection Act 2018 asks for an appropriate policy document whenever you rely on a Schedule 1 condition that requires one. The employment condition and most substantial public interest conditions do. For an accountancy practice that usually means:
- You keep sickness absence or other health records for your own staff
- You run payroll for clients and handle statutory sick pay or other health details
- You carry out anti-money laundering checks that turn up criminal convictions, offences or suspicions
- Your MLRO makes or considers reports of suspected money laundering or terrorist financing
How to use the appropriate policy document template
- Fill in the record of processing first. It shows which special category and criminal offence data the firm holds, and so which rows you need.
- Check the table of conditions. Delete the rows that don't apply and add any others, with the Schedule 1 condition for each.
- Name who can see AML records. Pick the MLRO and partners, or the people named in your AML procedures.
- Match the retention periods. Use the same periods as your retention schedule, so the two documents agree.
- Approve and date it. Name the data protection lead who keeps it and reviews it once a year.
Questions
When do you need an appropriate policy document?
When you process special category or criminal offence data under a Schedule 1 condition that requires one. That includes the employment, social security and social protection condition in Part 1 and most of the substantial public interest conditions in Part 2, which Part 3 also applies to criminal offence data. The document must be in place when the processing is carried out.
What must an appropriate policy document include?
Schedule 1, Part 4 sets two things. It must explain your procedures for following the data protection principles in Article 5 of the UK GDPR for that data, and your policies on keeping and erasing it, with an indication of how long you are likely to keep it.
Does an accountancy practice need one for anti-money laundering checks?
Yes, in most cases. AML checks can reveal criminal offence data, and the usual condition for using it is the regulatory requirements condition in Part 2, paragraph 12, applied by Part 3, paragraph 36. That condition needs an appropriate policy document.
How long do you keep an appropriate policy document?
From the day you start relying on the condition until six months after you stop. During that time you must review it from time to time and give it to the Information Commission (ICO) free of charge if asked.
How does it link to the record of processing?
For processing that needs an appropriate policy document, your record of processing must say which condition you rely on, how the processing meets Article 6 of the UK GDPR, and whether the data is kept and erased in line with your policy, with reasons if not.
Also in the UK GDPR pack for practices
Who it's for
Accountancy practices that keep staff sickness records, run payroll for clients or carry out anti-money laundering checks.
Last checked
Checked against the Data Protection Act 2018, Schedule 1, in November 2026.
