Draft a privacy policy from a starter template

Steps

1. 1

   Open Privacy policies and training

   In Data Protection, select Privacy policies and training at the bottom of the module menu. It has six sections: Overview, Policy library, Attestation campaigns, Training modules, Training campaigns and Public privacy notice.

   • Select Privacy policies & training
2. 2

   Select Policy library

   Select Policy library. This is where privacy policies, notices and procedures are written, approved and published. It is empty until you create your first policy.

   • Select Policy library
3. 3

   Select New policy and choose a starting point

   Select New policy. Open the Start from list. It offers a starter template for each kind of policy, and Blank policy at the end. Choose Acceptable use of personal data: the rules staff follow when they handle personal data.

   • Select New policy
   • Select Privacy notice
   • Choose Acceptable use of personal data
4. 4

   Read what the template covers

   The box describes the template, reminds you to have counsel review it before publishing, and lists the articles of the law it refers to. With Blank policy you would type a title and choose a type instead.

5. 5

   Select Create draft

   Select Create draft. The policy opens as Draft, version 1.0, with the starter text in English and Arabic. An amber banner says Template, needs legal review. The banner is a reminder on this page only. It is not part of the policy text.

   • Select Create draft
6. 6

   Give the policy your own title

   Replace the English title with one that staff will recognise as your organisation's policy, and the Arabic title beside it.

   • Type Title (English): Meridian Souq acceptable use of personal data
   • Type Title (Arabic): سياسة ميريديان سوق للاستخدام المقبول للبيانات الشخصية
7. 7

   Set the effective date and the summary

   Effective date is the day the policy starts to apply. What changed is a short note for the version history. The line under the draft's heading says this is a major change: people who acknowledged earlier versions would be asked again. For a later version you choose between major and minor.

   • Type Effective date: 2026-10-27
   • Type What changed: First version, adapted from the starter template.
8. 8

   Replace the placeholder in the English text

   Scroll through Text, English. The starter text names the data protection contact as [data protection contact], in square brackets, because no contact is set yet in the entity's data protection profile. Replace it with the Data Protection Officer's address. ComplianceOS will not let you submit, approve or publish a version that still contains a placeholder in square brackets, in English or in Arabic.

   • Type Text (English): ## Rules for everyone at Meridian Souq Trading LLC - Use personal data…

   

9. 9

   Adapt the English text

   Edit the text under Text, English. The buttons above the box add a heading, bold or italic text, lists and a link. Here a contact section is added at the end.

   • Type Text (English): ## Rules for everyone at Meridian Souq Trading LLC - Use personal data…
10. 10

    Preview the text

    Select Preview above the English text to see it as staff will. Headings and lists are laid out, and nothing about the template or the legal review appears in the text. Select Edit to go back to the box.

    • Select Preview
11. 11

    Keep the Arabic text in step

    Go back to Edit, then scroll to Text, Arabic. Replace [data protection contact] there too, and add the same contact section, so that staff who read the policy in Arabic see the same rules.

    • Select Edit
    • Type Text (Arabic): ## قواعد لجميع العاملين في Meridian Souq Trading LLC - استخدم البيانات…
12. 12

    Select Save draft

    Go back to the top of the draft and select Save draft. Your changes are kept, and the page heading now shows your title.

    • Select Save draft
13. 13

    Check the owner and the review cycle

    On the right, Ownership and review holds the policy's type, its owner, how often it must be reviewed, the next review date, and whether it is shared with other entities in an org unit. You are the owner because you created the policy, and it is reviewed every 12 months. Rewrite the description and select Save in that box.

    • Type Description: Everyday rules for all staff who handle customer or employee data.
    • Select Save
14. 14

    See why you cannot record the legal review

    At the top right, Mark legal review done is greyed out for you. The amber note explains why: you drafted or edited this policy, so someone else must record its legal review: your legal counsel, whose role includes Record legal review, or a colleague with the right to approve policies.

15. 15

    Select Submit for approval and check the library

    Select Submit for approval. The draft is locked while it waits, and a note says that whoever wrote or edited this version cannot approve it. Then select Back. The library lists the policy under your own title, tagged Draft, Awaiting approval and Needs legal review.

    • Select Submit for approval
    • Select Back