EXECUTIVE SUMMARY:

Data is the new gold. Nearly everyone has clicked ‘accept’ on cookie tracking pop-ups without reading the fine print. In fact, it’s almost become second nature. But employees and consumers have many questions. Where does the data go, who controls it, what are the implications, and how will it be secured?

As a business stakeholder, you may know the answers to these questions. However, the average person is in the dark.

According to a 2022 Ipsos poll, fewer than 35% of Americans believe that companies place adequate safeguards around their data. The average consumer cares deeply about their digital footprint, yet remains unsure about information collection and storage practices.

This is why you need a data collection policy that’s easy to understand and readily available. In this article, get step-by-step insights into how to create one. Keep reading for data collection policy insights.

What are data collection policies?

Data collection policies are critical for any organization that collects, processes or stores data. Chances are that your organization already has some data collection policies in place. If your organization aggregates data using websites, apps or other digital means, your organization likely has a well-established privacy policy and a GDPR policy.

However, organizations are often behind when it comes to creating privacy policies around the collection of employee data. You may want to investigate how your organization currently stores employee data, and addresses employee handling of data. Consider including this information in welcome packets and/or employee handbooks – whatever would be most effective for your organization.

Creating a data collection policy

A data collection policy can be useful for internal and external reference purposes. Questions about data collection, use and storage are becoming increasingly frequent, and a data collection policy can help quickly address individual concerns. Ensure that your HR team knows where to find your data collection policy at a moment’s notice.

A central data collection policy is a single set of rules that can be referred to when implementing programs and when individuals inquire. Further, a data collection policy can help your organization better comply with data privacy legislation.

Data collection policy: Key points to cover

A data collection policy needs to include key insights into what data you store and how it is used. Points to cover include:

• How is data collected?
• What data is being collected?
• Why is this data being collected?
• What will the data be used for?
• Who will have access to the data?
• Where will the data be stored and for what length of time?
• Can consumers request removal of data from the database?
• Will the data be confidential or anonymous?
• Will the data be shared with third parties?
• How will people be notified in the event of a security breach?
• How is your organization protecting employee data?
• How is the company ensuring compliance with privacy regulation?

In your data collection policy, use easy-to-read formatting. Explain precisely which data points are collected from job applications, employees, and customers. Be sure to detail why the data needs to be collected. Consider providing contact information in case of further questions, quandaries, or concerns.

Data collection policy creation – Who should be involved?

When developing a data collection policy, ensure that the right people are involved, making the policy more effective in the long-run. Invite the following parties to discussions:

The legal team

A key reason to create a data collection policy is in order to comply with legislation. Thus, it’s critical to consult your legal team for advice. Your general counsel will be able to assist you in creating a data collection policy or policies that fit your industry sector, meet business needs and that comply with relevant legislation.

The HR team

Ordinarily, HR oversees certain data collection processes involving employees and external job candidates. Have HR managers provide input into policy language. Draw on their knowledge about which data is currently collected, when, and why the data needs to be collected.

The C-Suite

Once you’ve drafted a data collection policy, obtain executive sign-off. Leaders across the organization need to understand what’s happening with data collection.

Employees

While most employees may not be involved in drafting the policy, they still need to agree to it. Request for your organization’s HR team to distribute a draft of the policy, and ensure that everyone is on-board. Create a means through which people can give consent. This could be a signature on a physical form, or a digital action that confirms that they’ve read and agreed to certain policies.

5 easy steps: Data collection policy development

1. First, determine the type of data collection policy needed. Gather relevant parties. Brainstorm goals and requirements. Questions to ask include:

• What type of data are we already collecting, if any?
• What types of data collection are we planning for?
• What legal requirements do we need to adhere to?
• Are there further human resources needed in order to create the policy?
• Do we need to provide employees with data culture awareness training?

2. Determine who will be involved in creating the data collection policy. As noted previously, the policy will likely be a joint-effort between the HR and legal teams, with C-Suite buy-in. In the end, the right combination of people to participate in policy development will be determined by your organization’s culture, industry, and needs.

3. Create a draft version of the data collection policy. Assign an individual (or a team) to create a draft of the policy. Attempt to address all contingencies. This includes future data collection needs that your organization might encounter. Attempt to be clear and detailed in your communication here.

You might consider including language noting that the data policy is subject to modification in the future. There may be circumstances in which you need to change it. In the event of changes, ensure that relevant parties receive notification and an opportunity to consent.

4. Review the policy. Send the draft of your policy to leadership for review. Ensure that you incorporate any related input or feedback. Consider sending leadership an updated, finalized draft. Then, read it over one more time to ensure that there are not any unexpected changes, omissions, or glaring errors.

5. Distribute the policy. When ready, distribute the data collection policy as needed. This includes sharing it with whomever may need to consent to it. You may wish to post it on your website, incorporate it into your terms and conditions, distribute it in an internal communication, and include it in an employee handbook. Ensure that you have a mechanism through which to ensure that everyone has read and agreed to the policy.

Further thoughts

A data collection policy is an essential component of creating a more data privacy-centric business culture. For more data privacy and security insights, see CyberTalk.org’s past coverage.

If your organization needs to strengthen its security strategy, be sure to attend Check Point’s upcoming CPX 360 event. Register now.

Lastly, to receive cutting-edge cyber security news, best practices and resources in your inbox each week, please sign up for the CyberTalk.org newsletter.