You've written the policy. It was approved. Everyone received an email. So why are people still unsure what to do when a real issue appears?

A policy explains intent. Everyday work reveals whether the intent has turned into something people can follow.

Consider a simple situation: someone receives a request to share sensitive information with a new supplier. Who decides whether it is appropriate? Where is the relevant guidance? Who is contacted if something feels wrong?

If the answers vary depending on whom you ask, the issue may not be the policy text alone.

Five signs that the policy hasn't reached everyday work

1. People know the rule exists, but can't find it

Employees should be able to find the current version without searching old emails or guessing who has a copy. A clear location and an obvious owner are small changes that can make a big difference.

2. No one can say who decides

Policies often mention responsibilities in broad terms. In practice, people need names or roles: who approves, who reviews, who records a decision and who handles an exception.

3. The process assumes every situation is straightforward

Real situations aren't. A good process makes space for exceptions, questions and escalation. It should show people what to do when the normal answer doesn't fit.

4. Training happens once and is forgotten

A presentation is not proof of understanding. Staff need examples relevant to their actual work, and occasional reminders when the process or risk changes. The ICO's accountability framework makes staff understanding, accessible procedures and ongoing review central to good data-protection governance.

5. Nobody checks whether the process is being followed

A useful review doesn't have to be heavy. It might involve looking at a small sample of requests, checking whether approval paths are clear or asking employees to explain what they would do in a familiar scenario.

Try the Monday-morning test

Pick one policy that matters. Ask three people who use it:

  • Where would you find the latest guidance?
  • What would you do in a common real-world situation?
  • Who would you ask when you're unsure?
  • How would you know a decision was recorded?

If the answers are unclear, you've found something practical to improve. The first step may be a clearer responsibility chart, a shorter procedure or a better escalation route, not a complete rewrite of every policy.

Start with what people actually do

A growing business does not need the same framework as a large global organisation. The right control should fit the risk, the people involved and the way work gets done.

Evolut can help clients think through responsibilities, gaps and practical priorities, and connect with relevant specialists where more detailed assessment or implementation is needed.

Further reading: original sources

This article offers general information and is not legal or regulatory advice. Requirements depend on your organisation and circumstances.