A data-protection framework for organisations without a national law

Customers, citizens and partners increasingly expect organisations to handle personal data responsibly, whether or not a regulator is asking. Foreign partners, correspondent banks, international donors and cloud providers also ask for evidence of how personal data is governed. Where no dedicated national law applies to your sector, the sensible course is to adopt recognised international good practice as your own internal standard. Doing so protects individuals, reduces breach and reputational risk, and prepares you for any future requirement. Here is a practical framework you can put in place without waiting for one.

Start with principles and a policy

Approve a short data-protection policy, signed off by senior management, built on widely accepted privacy principles:

• Lawfulness, fairness and transparency: collect and use personal data on a clear, documented basis and tell people what you do with it.
• Purpose limitation: use data only for the purposes declared at collection.
• Data minimisation: collect only what is needed.
• Accuracy and retention: keep data correct, and delete or anonymise it when the retention period ends.
• Security: protect data with controls proportionate to risk.
• Individual rights: give people a channel to ask about, correct or request deletion of their data, and define response times.
• Breach notification: set internal rules for detecting, escalating and notifying affected people and relevant authorities or partners when a breach occurs.

Build the management system on ISO/IEC 27001 and 27701

ISO/IEC 27001 gives you an information security management system with risk assessment, controls, audit and continual improvement. ISO/IEC 27701 extends it with privacy-specific requirements and guidance for organisations that act as controllers or processors of personal data. You do not have to seek certification on day one; using them as the structure for your framework already gives you a recognised, auditable baseline. Map the principles above to controls, owners and evidence.

Assign clear roles. Appoint a data-protection lead, a DPO-like function, with enough independence and access to management. Give business owners accountability for the data in their processes, and make security and legal teams partners rather than gatekeepers.

Inventory, impact assessment and vendors

Three working tools carry most of the practical load:

• Data inventory and mapping: record what personal data you hold, why, where it is stored, who can access it, who it is shared with and how long you keep it. Everything else depends on this register.
• Data protection impact assessment (DPIA): for new systems, projects or uses of data that could significantly affect individuals, such as biometrics, large-scale profiling or sensitive categories, assess the risks before launch and record the mitigations.
• Vendor and cloud contracts: include confidentiality, purpose restriction, security requirements aligned with ISO/IEC 27001, sub-processor approval, breach notification timelines, audit rights, cross-border handling and return or deletion of data at contract end. Assess critical suppliers before onboarding and periodically afterwards.

Make it operational

A framework is only real when it is practised. Train staff according to their roles, test your breach response with a tabletop exercise, apply retention schedules in systems and not only on paper, and review the register at least annually. Report a few simple indicators to management, such as the share of systems inventoried, open DPIAs, rights requests handled on time and supplier assessments completed.

Finally, stay aware of obligations that may come through other routes, such as sector regulators, contractual requirements from partners or rules that apply to data of individuals in other jurisdictions. A good internal framework makes it far easier to meet them.

How Wethaq ICT helps

Wethaq ICT supports government bodies, companies and financial institutions in building a practical data-protection programme. We run data-mapping workshops, draft policies and procedures aligned with ISO/IEC 27001 and ISO/IEC 27701, conduct DPIAs, review vendor contracts from a security and privacy perspective and train your teams, giving you a defensible and proportionate framework you can grow over time.