A data protection policy should be well structured because it has to be understandable for both internal and external stakeholders. It must also depict the individual conditions in a company. Therefore, templates or samples should always be customised for the specific case. However, a proper data protection policy should contain at least the following contents: Data protection policy and responsibilities in the company Legal framework in the company Documentation Existing technical and organisational measures Organisational minimum regulations