Personal data protection policies and procedures are internal documents of an organisation adopted by an internal act of its body and binding on an employee and/or employee. These documents set out the procedures for the processing of personal data by an employee and/or employee. These documents must be proportionate to the requirements of the data protection policy and, if applicable, to the relevant data protection requirements of the internal data protection authorities.