Writing an IT Compliance Policy: 7 Things UK Businesses Need to Cover

An IT compliance policy takes the rules your business has to follow and turns them into clear instructions for your team: how to use devices, handle data, share files, and what to do when something goes wrong. Without one, compliance depends on everyone happening to do the right thing.

Writing it isn’t mainly a technical job. Compliance gaps more often come from people and processes than from missing software, so the policy has to cover all three. Here are the seven areas a UK small business’s policy needs to cover.

1. The rules that actually apply to you

Start by listing what you have to comply with. For most UK businesses that means:

• UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. The security principle requires “appropriate technical and organisational measures” to protect personal data. Since 19 June 2026 you also need a process for handling data protection complaints.
• Your regulator. Solicitors must meet the SRA Code of Conduct for Firms, which requires effective systems and controls (paragraph 2.1), management of all material risks (2.5) and confidentiality of client affairs (6.3). Accountants should follow ICAEW’s cyber security guidance, including its ten steps for smaller firms. Financial services companies have FCA requirements on top.
• Standards you hold or are asked for, such as Cyber Essentials, Cyber Essentials Plus or ISO 27001.
• Client contracts, engagement letters and insurance policies. These often contain specific IT requirements, such as encryption, multi-factor authentication or where data is held.

The data protection regulator changed form on 30 September 2026: the Information Commissioner’s Office became the Information Commission. Its guidance, powers and your obligations didn’t change.

2. Who is responsible

A policy without named owners doesn’t get followed. Set out:

• Who owns the policy: a director or partner, not just “IT”. The government’s Cyber Governance Code of Practice is clear that cyber risk is a board-level responsibility.
• Who looks after each system: your internal IT lead, your IT provider, or both. Write down which tasks your provider does and which stay with you.
• Who staff go to with a question or a concern.

If you use an outside IT provider, include them in the policy. They have access to your systems, so they’re part of your risk.

3. How staff use devices and data

This is the part your team will read, so keep it plain. Cover:

• Which devices can be used for work, and the rules for personal phones and home computers.
• Where files must be saved (for example, SharePoint and OneDrive, never only on a laptop or a USB stick).
• How to share files with clients and third parties securely, and which tools are not allowed, such as personal email or consumer file-sharing apps.
• Locking screens, working in public places, and printing.
• Using AI tools with client or personal data, if at all.

4. Who can access what

Access control is where policy meets technology. Your policy should require:

• Unique accounts for every person, with no shared logins.
• Multi-factor authentication on email and every cloud service. Cyber Essentials requires it for cloud services.
• Access based on role, so people only see what they need.
• Separate admin accounts, used only for admin work.
• A joiners, movers and leavers process, so access is removed on someone’s last day.

5. Training and awareness

Most attacks on small businesses start with a person: a phishing email, a fake invoice, a phone call pretending to be the bank. Your policy should commit to:

• Security training when someone joins, and regular refreshers.
• Specific guidance on payment and bank detail changes, especially for conveyancing and client money. The SRA has highlighted email-based fraud as a major risk for law firms.
• A simple, blame-free way to report a suspicious email or a mistake quickly.

6. What happens when something goes wrong

Write the incident plan before you need it. It should say:

• Who to call first, inside the business and at your IT provider.
• How to decide whether a personal data breach must be reported. Under UK GDPR, reportable breaches go to the regulator within 72 hours of becoming aware of them, where feasible.
• When to tell your regulator, your insurer, your clients and the police. Cyber crime and fraud in England, Wales and Northern Ireland are now reported to Report Fraud, which replaced Action Fraud in December 2025.
• How you’ll restore systems and data from backup, and how often that is tested.

ICAEW’s cyber security guidance includes an overview of a cyber attack response plan, which is a useful starting point for any small business.

7. Checking, evidence and review

A policy is only as good as the evidence that it’s being followed. Plan for:

• Regular checks: who has admin rights, whether updates are applied (Cyber Essentials requires critical and high-risk updates within 14 days), whether backups restore.
• Automated reporting where you can. Microsoft 365 and device management tools can show which devices are encrypted, up to date and compliant, so you don’t have to check each one by hand.
• Records: training completed, incidents and near misses, access reviews, and decisions you made about risk.
• An annual review, signed off by the policy owner, and an extra review after any significant change or incident.

From our work

Many of our clients work in regulated sectors: property, legal and accountancy. Their insurers often ask for a cyber security declaration, and their ISO 9001 and ISO 27001 audits ask for disaster recovery test results and records. We pull that evidence together and complete the paperwork for them, with their final approval, so audits go quickly.

David Gilbey, Just Gilbey IT Solutions

Keep it short enough to be read

The policies that work best are usually a few pages of plain English for staff, backed by more detailed procedures for whoever runs the IT. Anything longer tends to sit in a folder unread.

If you’d like help, our page on IT support for regulated businesses explains how we put the controls behind a policy in place and help you prepare the evidence auditors and clients ask for.